12:08:35
321bob321:
https://github.com/Alpha-Legents/Q-SSP
12:08:35
321bob321:
Quantum-Stable Sanitization Protocol (Q-SSP). A non-deterministic data erasure tool utilizing ANU Quantum Vacuum Fluctuations. Verified Shannon Entropy: 7.997 bits/byte
12:14:38
DataHoarder:
I thought this was MRL
12:15:30
DataHoarder:
emojis ofc
12:15:32
DataHoarder:
> PASS 2: AES-256-CTR (QUANTUM NONCES)
12:15:50
Cindy:
this is AI generated :P
12:15:51
Cindy:
obviously
12:16:01
Cindy:
fetching random numbers from an API? really?
12:16:31
DataHoarder:
> Q: Is the ANU Quantum API connection secure?
12:16:33
DataHoarder:
> A: Yes, all API calls use HTTPS.
12:16:50
Cindy:
psssst.. ANU Quantum
12:16:51
DataHoarder:
ok
12:16:56
Cindy:
can you like.. make your API return zeros?
12:17:00
Cindy:
or a predictable pattern?
12:17:01
DataHoarder:
this is fucking funny
12:17:03
DataHoarder:
https://qrng.anu.edu.au/
12:17:05
DataHoarder:
their cert expired 😆
12:17:30
Cindy:
well thats super easy
12:17:34
DataHoarder:
also uses RSA 2048
12:17:40
Cindy:
the feds can just MITM and give you zeros :P
12:17:54
Cindy:
and then they say "PRNGs like /dev/urandom are deterministic"
12:18:02
DataHoarder:
it also doesn't use quantum safe ssl
12:18:04
Cindy:
this is literally deterministic if you have access to the connection
12:18:10
DataHoarder:
so you can indeed just store now and decode later
12:18:16
Cindy:
infact, even worse
12:18:25
Cindy:
because you're trusting an external computer with random numbes
12:18:27
Cindy:
numbers*
12:18:39
DataHoarder:
https://github.com/Alpha-Legents
12:18:43
DataHoarder:
> Building Entropy-focused security protocols. Shifting data erasure from computational logic to physical indeterminacy.
12:18:48
DataHoarder:
edgy 16y old phrase
12:18:56
Cindy:
not like this really fucking matters anyway
12:18:59
Cindy:
this is for data erasure
12:19:09
Cindy:
you can get away with writing your whole hard drive with zeros
12:19:21
Cindy:
i'm glad it's not for something like key generation
12:19:39
DataHoarder:
ok
12:19:43
DataHoarder:
they ARE 17
12:19:47
DataHoarder:
I was one year off
12:19:52
DataHoarder:
their linked linkedin
12:20:03
Cindy:
and indian..
12:20:10
DataHoarder:
> I'm 17 , and I believe modern data erasure techniques are outdated and fundamentally broken.
12:20:11
Cindy:
linkedin AND indian
12:21:56
plowsof:
Racism?
12:22:12
Cindy:
no, not in that way
12:22:39
Cindy:
it's just that the majority of slop repos i see in github have those characteristics
12:23:17
DataHoarder:
it's just a common checklist of slop, plowsof, Recent GH account made for a single-off project or PR 100% AI (or in years past, just random line changes)
12:23:37
plowsof:
AI'ism and Ageism
12:23:41
DataHoarder:
there's some requirements in india that has them build cred/stuff via contributions on github
12:23:57
Cindy:
i remember that indian github tutorial
12:24:01
DataHoarder:
"Shifting data erasure from computational logic to physical indeterminacy." is an edgy phrase, I took a guess :D
12:24:04
Cindy:
that ended up causing a mass flood of PR slop
12:24:10
Cindy:
to some random repository
12:24:16
DataHoarder:
or the digitalocean october stuff
12:24:31
DataHoarder:
it's the system that's broken anyhow
12:24:36
DataHoarder:
that requires those things
12:25:13
DataHoarder:
so much AI slop on cryptography subreddits
12:25:31
Cindy:
they made a reddit post about it
12:25:31
DataHoarder:
claiming to have solved world hunger (or equivalent there)
12:25:34
DataHoarder:
ofc. this was there
12:25:41
Cindy:
https://old.reddit.com/r/cybersecurity/comments/1pzfz34/oc_quantumbased_disk_sanitization_tool/
12:26:30
Cindy:
"But in High Security Forensics Situations where data should be absolutely unrecoverable, 0 filling is predictable and easy to reconstruct.
12:26:51
Cindy:
does not explain any further
12:27:12
plowsof:
I'm Troy McClure, you may remember me from
12:29:34
Cindy:
just look at the writing style in the reddit comments
12:29:43
Cindy:
vs the writing style in the README
12:29:50
Cindy:
and even FAQ
12:33:00
Cindy:
as much as i don't want to say it, this is probably just a drop in the bucket of slop sludge
12:49:08
DataHoarder:
the AI convinced them this is now the way
12:49:16
DataHoarder:
and that everyone else was doing it wrong
12:52:14
Cindy:
bro is acting like you need the most random data possible for disk erasure
12:56:49
hooftly:matrix.org:
Isnt he just trusting a third party API as well?
12:56:53
DataHoarder:
^
12:57:10
DataHoarder:
not only. they suggest the disk controller could guess the seed so data needs to be non-guessabel
12:57:15
DataHoarder:
except
12:57:23
DataHoarder:
they don't read it back :')
12:57:40
hooftly:matrix.org:
LOL
13:00:18
Cindy:
what would the disk controller do if it could guess the seed
13:00:27
Cindy:
STOP RIGHT THERE CRIMINAL SCUM
13:00:38
Cindy:
writing predictable random data is AGAINST THE LAW
13:01:05
hooftly:matrix.org:
JudgeDredd.jpg
13:02:52
DataHoarder:
Cindy: recreate it, so it doesn't write the data so it's recoverable :')
13:03:11
DataHoarder:
also this is targeted to SSDs
13:03:29
Cindy:
doesn't like
13:03:35
Cindy:
doing tons of writes harm SSD?
13:03:35
DataHoarder:
which mean they are already using random seeds themselves to make data less even due to how they work
13:03:52
DataHoarder:
this is just a couple of rewrites :)
13:04:06
DataHoarder:
anyhow. they also missed that
13:04:33
orly_owl:
just restore from backup :)
14:01:00
BlueyHealer:
DataHoarder | there's some requirements in india that has them build cred/stuff via contributions on github <- Like, in universities? Like how you're required to publish papers in uni?
14:39:41
cornfeedhobo:
Cindy: i can't comment on the detail they don't give, but i can at least say i've definitely seen drives recovered that were 0'd out.
14:40:53
cornfeedhobo:
i was told it's kinda standard. but this was back on platters only. i have no idea how you would do that on ssd
14:44:36
BlueyHealer:
Shouldn't data recovery be not that big of a deal if you have LUKS all over the drive?
14:53:56
cornfeedhobo:
yeah, if you have luks underneath, there should be no need to worry. bonus points if you write random multiple times over the header portion of the disk
14:55:24
BlueyHealer:
Are there tools for automating that? I know it's easy to remove those headers, but not questioned about extra overwrites.
14:56:10
cornfeedhobo:
There was a project that did make it easy, and there was even a deadman switch - type the "wrong" luks password and it started background wiping the disk
14:56:25
cornfeedhobo:
but i forget what the name was
15:01:04
BlueyHealer:
Yeah, I remember seeing one with the latter functionality!
15:19:17
DataHoarder:
cornfeedhobo: it was easier with old drives, but yeah
15:19:30
DataHoarder:
nowadays it's getting tighter. wipe with random and that's fine
16:13:41
Cindy:
cornfeedhobo: that deadan switch wouldn't work if the drive is connected in-between a device that blocks write accesses over SATA
16:13:48
Cindy:
or NVMe or whatever
16:13:57
Cindy:
law enforcement do infact have those devices
16:14:18
Cindy:
or at least forensics people do
16:15:14
cornfeedhobo:
Cindy: of course, but it's also really common for officers to request the owner to unlock the device. if you are so important that they are dissembling your device first, you have much much bigger problems than worrying about this mental exercise.
16:15:25
Cindy:
https://www.logicube.com/shop/writeprotect-desktop/
16:15:53
DataHoarder:
Cindy: fun fact: you can install Linux in an HDD
16:16:38
BlueyHealer:
If officers are the concern, that's a non-issue, they have the $5 wrench))
16:16:50
cornfeedhobo:
exactly
16:17:08
Cindy:
DataHoarder: still would not prevent stuff over the interface from being filtered
16:17:25
DataHoarder:
as in, read a specific sector without then reading X sector later
16:17:27
Cindy:
unless your whole computer is.. the HDD
16:17:29
DataHoarder:
that triggers it
16:18:31
Cindy:
DataHoarder: what about just having the data within the hardware require both TPM2 and a password
16:18:42
BlueyHealer:
They'd also probably make a backup of the device while such thing is connected
16:18:43
Cindy:
and if you don't type the correct password, it'll wipe the CPU's TPM2
16:18:58
DataHoarder:
that has been broken
16:18:59
Cindy:
data within the hard drive*
16:19:09
Cindy:
DataHoarder: can you explain how?
16:19:16
BlueyHealer:
I think TPM, at least some versions of it, has been bypassed.
16:19:29
DataHoarder:
they were able to dump the internals, not just bypass, due to signature issues
16:19:36
DataHoarder:
they had custom microcode for the CPUs
16:19:47
BlueyHealer:
Like, at least the versions not embedded into the CPU itself - then there are points to listen on.
16:20:03
Cindy:
BlueyHealer: make sure that the TPM2 is within the CPU?
16:20:07
Cindy:
DataHoarder: yeah hardware bugs suck
16:20:32
DataHoarder:
another example https://github.com/google/security-research/blob/master/pocs/cpus/entrysign/zentool/README.md
16:20:45
BlueyHealer:
Cindy, that's at least the one I've heard about on the news. And the slightly older CPUs don't have it integrated.
16:21:13
Cindy:
i doubt there are any new hardware being produced that doesn't have the TPM integrated
16:21:19
Cindy:
due to bus-sniffing concerns
16:21:48
Cindy:
DataHoarder: they reverse engineered the AMD Zen instruction set?
16:21:55
Cindy:
i mean the instruction set for the microcode
16:27:14
ravfx:xmr.mx:
BlueyHealer: Tpm 1.2 can be tapped in
16:27:22
DataHoarder:
yeah they manged to deploy arbitrary updates so they went full in and reverse engineered that part as well
16:27:33
BlueyHealer:
oh
16:27:43
ravfx:xmr.mx:
That was because it was extermal to the cpu. Same for tpm addon mini board you can stuff into the LPC port on some board
16:28:15
BlueyHealer:
The one I've seen on the news earlier was about the external TPMs, yeah
16:28:26
BlueyHealer:
Kinda not following the topic because I've never utilized it
16:28:41
BlueyHealer:
(also so cool to know it can be useful in a non-hostile way)
16:28:42
ravfx:xmr.mx:
Now its inside the cpu. But even then it would require them to modify your system in advance of arresting you so you continue to use it and they can see the tpm exchange when your using the system normally
16:29:11
ravfx:xmr.mx:
I use it too, I mean, if you control it it is quite practical
16:29:47
BlueyHealer:
Why would they bother, though? The hardware isn't the weakest link, the person is. The only case I can think of is if the owner has fled or died.
16:30:34
ravfx:xmr.mx:
You can also derive the encryption key based on : the password + the exact hardware with a granularity that go fo only the rom up to everything in the computer including the location of the usb device + the tpm key (not supposed to be able to leave the tpm)
16:31:53
ravfx:xmr.mx:
If anything change in the machine, missplaced usb, extra surprise hardware, trafficked bootloader, swapped kernel -> the encryption key dont work anymore, except if you can revert all of that
16:33:09
ravfx:xmr.mx:
For the kernel bits you use secure boot to verify the signature of the bootloader and kernel (then tpm evaluate secureboot)
16:34:30
BlueyHealer:
the TPM-based disk encryption felt so pointless to me, but now realizing that if it's *in addition* - indeed makes perfect sense.
16:35:08
ravfx:xmr.mx:
The tpm is an extremely simple device at the end. It just a bunch of registers (PCR) that have hashes.
16:35:08
ravfx:xmr.mx:
One is for the rom, one for cmos setting, one for hardware (pcie shit), one for more hardware, one for secure boot, etc etc.
16:35:08
ravfx:xmr.mx:
The hash values change when something that specific register watch
16:36:15
ravfx:xmr.mx:
BlueyHealer: Yeah, dont just use the tpm to "store the key"
16:36:15
ravfx:xmr.mx:
Have a password protectrd gpg key, that is processed by the tpm. You not only you need everything to be valite on the tpm side, but you still need your gpg password
16:38:21
ravfx:xmr.mx:
But beware you need to have a secondary key (or a backup of that gpg key file) somewhere.
16:38:21
ravfx:xmr.mx:
Like mentionned, any change in the hardware, rom, bootloader, will prevent you from accessing the hard drive
16:39:01
ravfx:xmr.mx:
So if something pop in your conputer, or just just update the bios and forget about the tpm and oups.