Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Typing data in is not inherently different from transferring it on a USB drive. Your "truly airgapped" machine is still parsing input from an untrusted and potentially malicious source. Yes, you're protected against malicious filesystems, but I'm a lot more worried about buffer overflows in the S-expression parser and SPKI interpreter that you're typing into than e.g. the ext2 or FAT implementation in the Linux kernel, simply because no SPKI implementation has been subject to nearly the same level of attack or scrutiny as Linux kernel filesystem drivers.

I think you could probably do it for something like Ed25519, which has the nice property that any 32-bit string is a valid key, so all you have to do is type exactly 64 hex characters. But SPKI seems like a huge attack surface.



You would not accidentally type, with your own hands, some string that would attack the parser. People do not actually name their children Robert"); drop table.

An SPKI parser + a manual keyboard operated by a trusted user is an incredibly small attack surface.


Ok but it is a lot more "gapped". A buffer overflow vulnerability is a lot more unlikely to be exploitable if you can't extend arbitrarily the amount of data passed and you have very little room to manipulate it (and it is so if the target has at least a vague knowledge of the format of the data).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: