Make a section on how modern hardware (Intel post 2006 and AMD post 2012) should be avoided? #292

New Issue

2017-07-19T10:12:40Z

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented

2017-07-19 10:12:40 +00:00

(Migrated from github.com)

Before anyone points that privacytools is only about tools, let me respectfully affirm that all these tools are only effective as long as the underlying hardware is not compromised.

This issue has not received the coverage that it needs, and I think we should at least mention it.

https://libreboot.org/faq.html#intel
https://libreboot.org/faq.html#amd

Edit: Just to be precise, it doesn't have to be an obligation "don't buy intel post /amd post... since X", we could just shed some light on this issue.

Before anyone points that privacytools is only about tools, let me respectfully affirm that all these tools are only effective as long as the underlying hardware is not compromised. This issue has not received the coverage that it needs, and I think we should at least mention it. https://libreboot.org/faq.html#intel https://libreboot.org/faq.html#amd Edit: Just to be precise, it doesn't have to be an obligation "don't buy intel post /amd post... since X", we could just shed some light on this issue.

👍 1

ghost commented

2017-07-19 10:17:30 +00:00

(Migrated from github.com)

We should mention it, but know that our audience is non-expert -- they're not gonna build their own computer using open-source hardware. Those who should be concerned with HW already know everything that's on our website.

Probably not a big section like https://privacytoolsio.github.io/privacytools.io/#ukusa, but yeah, we should mention it somewhere.

We should mention it, but know that our audience is non-expert -- they're not gonna build their own computer using open-source hardware. Those who should be concerned with HW already know everything that's on our website. Probably not a big section like https://privacytoolsio.github.io/privacytools.io/#ukusa, but yeah, we should mention it somewhere.

0verk1ll commented

2017-08-06 20:59:38 +00:00

(Migrated from github.com)

Maybe you could provide links to secure hardware that runs open source/free software.

The Free Software Foundation has a page with links to relevant lists of hardware (https://www.fsf.org/resources/hw).
A company called Purism makes laptops that run free software (https://puri.sm).
A company designs physically secure desktops that require a password and hardware token just to boot (https://orwl.org).
H-Node is a wiki that lists hardware that runs free software (https://h-node.org).

Maybe you could provide links to secure hardware that runs open source/free software. - The Free Software Foundation has a page with links to relevant lists of hardware (https://www.fsf.org/resources/hw). - A company called Purism makes laptops that run free software (https://puri.sm). - A company designs physically secure desktops that require a password and hardware token just to boot (https://orwl.org). - H-Node is a wiki that lists hardware that runs free software (https://h-node.org).

👍 2

privacytoolsIO commented

2017-08-08 12:58:20 +00:00

(Migrated from github.com)

@0verk1ll
Thanks for your input. I've just added the new category: https://www.privacytools.io/#hardware

Let me know if you guys have anything to add.

@0verk1ll Thanks for your input. I've just added the new category: https://www.privacytools.io/#hardware Let me know if you guys have anything to add.

ghost commented

2017-08-08 13:05:09 +00:00

(Migrated from github.com)

I think this section requires a lot of research. How does Purism solve the ME problem with Intel processors?

privacytoolsIO commented

2017-08-08 13:29:48 +00:00

(Migrated from github.com)

It doesn't solve the problem. But it's still worth mentioning since there are no better alternatives at the moment.

ghost commented

2017-08-08 13:46:19 +00:00

(Migrated from github.com)

Worth mentioning but not worth being the first option. There are open-source processors.

ghost commented

2017-08-08 14:00:55 +00:00

(Migrated from github.com)

corna/me_cleaner

Purism uses coreboot which contains blobs. https://libreboot.org/

https://puri.sm/learn/intel-me/

[corna/me_cleaner](https://github.com/corna/me_cleaner) Purism uses coreboot which contains blobs. https://libreboot.org/ https://puri.sm/learn/intel-me/

C-O-M-P-A-R-T-M-E-N-T-A-L-I-Z-A-T-I-O-N commented

2017-08-17 11:12:03 +00:00

(Migrated from github.com)

pre-2013 AMD hardware sounds like a good recommendation.

ghost commented

2017-10-12 15:34:41 +00:00

(Migrated from github.com)

Yeah, probably better than pre-2006 Intel hardware.

hugoncosta commented

2017-10-22 18:03:46 +00:00

(Migrated from github.com)

@Shifterovich I'm thinking we could do this in "partnership" with a guide/post on The Privacy Guide. I believe that we should just make people aware that just a computer is more than it's software, and they should take that into consideration when buying newer hardware.

On the Intel topic, we should make reference to the two Russian researches that are going to present a way to run unsigned code on the Intel ME chips during Defcon this year.

@Shifterovich I'm thinking we could do this in "partnership" with a guide/post on The Privacy Guide. I believe that we should just make people aware that just a computer is more than it's software, and they should take that into consideration when buying newer hardware. On the Intel topic, we should make reference to the two Russian researches that are going to present a way to run unsigned code on the Intel ME chips during Defcon this year.

ghost commented

2017-10-22 20:18:35 +00:00

(Migrated from github.com)

Yeah, I'm planning on writing something about secure HW anyway. I think I might have time for that this week.

hugoncosta commented

2017-10-22 20:27:01 +00:00

(Migrated from github.com)

Let me know if you need help with it, I'd be happy to help

ghost commented

2017-10-22 20:28:16 +00:00

(Migrated from github.com)

Got Telegram?

0verk1ll commented

2017-11-02 01:25:25 +00:00

(Migrated from github.com)

@Shifterovich Purism recently solved the ME problem.
https://puri.sm/posts/deep-dive-into-intel-me-disablement/

@Shifterovich Purism recently solved the ME problem. https://puri.sm/posts/deep-dive-into-intel-me-disablement/

kewde commented

2017-11-07 03:46:40 +00:00

(Migrated from github.com)

@Shifterovich note on telegram
https://github.com/xdb6f/telegram-ipleak

Was posted on privacytools irc, I don't have another way to reach you so here it is.

@Shifterovich note on telegram https://github.com/xdb6f/telegram-ipleak Was posted on privacytools irc, I don't have another way to reach you so here it is.

ghost commented

2017-11-07 18:00:26 +00:00

(Migrated from github.com)

@kewde It's what I use for general usable chat. For private conversations I obviously use OTR. Might add this resource to the website, though.

Omar-Elrefaei commented

2017-11-12 11:20:28 +00:00

(Migrated from github.com)

Yeah, Purim is doing very good job recently in the ME field.
You should also check their phone project, they finished a successful fundraising for a fully open source, privacy focused phone.

Yeah, Purim is doing very good job recently in the ME field. You should also check their phone project, they finished a successful fundraising for a fully open source, privacy focused phone.

angela-d commented

2017-12-17 22:57:48 +00:00

(Migrated from github.com)

@privacytoolsIO
I can't see the hardware sections on privacytools.io - nothing in Firefox ESR, Waterfox or Epiphany.
Can only see the commits here on github.

@privacytoolsIO I can't see the hardware sections on privacytools.io - nothing in Firefox ESR, Waterfox or Epiphany. Can only see the commits here on github.

blacklight447 commented

2019-08-28 11:02:46 +00:00

(Migrated from github.com)

After some thinking, the actual threat model for exploits like this is really high, and more then 99% of user would not have to bother with exploits on this level, saying that this hardware should be avoided will most likely confuse users and do more harm then good. there is also the issue that older hardware no longer gets firmware updates, so they will be less secure to spectre/meltdown types of exploits, which is why i don't think it would be wise to recommend avoiding modern hardware. closing issue, if someone think it should be reopened, then they can comment with new arguments that address the issues described above.

👍 1

This repo is archived. You cannot comment on issues.