undefined | Better HN

0 pointsthathndude2y ago0 comments

Technically, researchers have proven that you can shutdown a machine, hit the RAM with a cold spray (like liquid nitrogen) and keep the bits "alive" long enough to dump them for analysis.

But, obviously, that's pretty insane. Agree with everything that this is a big leap in the step of better protection for users.

0 comments

NhanH2y ago

Even if that attacks has close to 100% success rate, I'd imagine it being nigh physically impossible to execute a targeted attack, as you don't know which machine to hit for a specific user. And that seems to be the main threat model we would be concerned about for this.

foobiekr2y ago

Of course they know which machine to hit. How do you do customer service without such a basic function?

hiatus2y ago

Mullvad gives you the option to connect to multiple servers. They offer wireguard configs for every endpoint. How does law enforcement know which server the client plans to connect to? There is no metering either, just a flat monthly rate so nothing to track there either.

1 more reply

caeril2y ago

There's a fairly easy physical mitigation for this.

Once DIMMs are seated, secure the ends with superglue, then brush conformal coating over the bus traces.

The second step is likely not even necessary if the motherboard is a 4 layer pcb with traces in the middle.

sumtechguy2y ago

The likelihood of them showing and doing that is low. However, the likelihood of them showing up with a set of USB drives and just running rsync/cp/dd is higher.

heyoni2y ago

Normally you unplug the drives and take them to a lab. Never let the host operating system continue running with those disks!

jstarfish2y ago

Maybe in the 90s. Unplugging the drive is how you kick FDE in now. The drive only has value while mounted and running on the host OS.

Even cellphones...you want them running decrypted, but inside a Faraday cage of some kind to block remote wipes.

1 more reply

j / k navigate · click thread line to collapse

0 comments

NhanH2y ago

foobiekr2y ago

Of course they know which machine to hit. How do you do customer service without such a basic function?

hiatus2y ago

1 more reply

caeril2y ago

There's a fairly easy physical mitigation for this.

Once DIMMs are seated, secure the ends with superglue, then brush conformal coating over the bus traces.

The second step is likely not even necessary if the motherboard is a 4 layer pcb with traces in the middle.

sumtechguy2y ago

The likelihood of them showing and doing that is low. However, the likelihood of them showing up with a set of USB drives and just running rsync/cp/dd is higher.

heyoni2y ago

Normally you unplug the drives and take them to a lab. Never let the host operating system continue running with those disks!

jstarfish2y ago

Maybe in the 90s. Unplugging the drive is how you kick FDE in now. The drive only has value while mounted and running on the host OS.

Even cellphones...you want them running decrypted, but inside a Faraday cage of some kind to block remote wipes.

1 more reply

j / k navigate · click thread line to collapse