A case against security nihilism
Just the other day I suggested using a yubikey, and someone linked me to the Titan sidechannel where researchers demonstrated that, with persistent access, and a dozen hours of work, they could break the guarantees of a Titan chip[0]. They said &quot;an attacker will just steal it&quot;. The researchers, on the other hand, stressed how very fundamentally difficult this was to pull off due to very limited attack surface.<p>This is the sort of absolutism that is so pointless.<p>At the same time, what&#x27;s equally frustrating to me is defense without a threat model. &quot;We&#x27;ll randomize this value so it&#x27;s harder to guess&quot; without asking who&#x27;s guessing, how often they can guess, how you&#x27;ll randomize it, how you&#x27;ll keep it a secret, etc. &quot;Defense in depth&quot; has become a nonsense term.<p>The use of memory unsafe languages for parsing untrusted input is just wild. I&#x27;m glad that I&#x27;m working in a time where I can build all of my parsers and attack surface in Rust and just think way, way less about this.<p>I&#x27;ll also link this talk[1], for the millionth time. It&#x27;s Rob Joyce, chief of the NSA&#x27;s TAO, talking about how to make NSA&#x27;s TAO&#x27;s job harder.<p>[0] <a href="https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2021&#x2F;01&#x2F;hackers-can-clone-google-titan-2fa-keys-using-a-side-channel-in-nxp-chips&#x2F;" rel="nofollow">https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2021&#x2F;01&#x2F;hacke...</a><p>[1] <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=bDJb8WOJYdA" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=bDJb8WOJYdA</a>