[117137] in Cypherpunks
a wee bit o' ultraparanoia
daemon@ATHENA.MIT.EDU (Anonymous)
Fri Aug 27 01:27:13 1999
Date: Fri, 27 Aug 1999 07:05:44 +0200 (CEST)
Message-Id: <199908270505.HAA24679@mail.replay.com>
From: Anonymous <nobody@replay.com>
To: cypherpunks@toad.com
Reply-To: Anonymous <nobody@replay.com>
>> This makes verifying the binaries a SERIOUSLY non-trivial
>>task, and makes comparing them utterly useless without going thru
>>them byte by byte, and then you STILL may miss a clever compromise.
>
>The fact that it is not trivial is NOT a reason. Somebody with the energy,
Gents,
if you have a bit-carrier which is trusted (e.g., a floppy or an iButton
ring) then you can
verify other pieces of code, and bootstrap yourself into a fully verified OS.
The military trusts their suppliers, and enforces strict discipline over
ownership chains. Mere businessfolk buy COTS and use the physically-separate
bitcarrier PK verification technique.
If you don't trust prefabbed hardware, buy a PLD and configure your own.
.....
If the device which encrypts is with you all the time, its very hard to
mess with it. Think Moore's law. PalmDogTag? Woof.
.....
Michael Faraday and his newborne babes are your friends.
