Paul Cantrell
IN THIS HOUSE, WE BELIEVE
- passwords should be random
- data should be backed up
- anonymity should be the default
- dishwashers don’t need wifi
- the drivetrain should be airgapped from the Internet
Nov 3 at 10:22pmWeb
Show threadPaul CantrellNov 4
Here, I did the thing
Show threadPaul CantrellNov 6

Here you go, PDF and SVG, print to your heart’s content:

https://innig.net/tmp/in-this-secure-house.pdf

https://innig.net/tmp/in-this-secure-house.svg

Show threadvfigNov 4
@inthehands if every warning sign is a story... whats the story behind "the drivetrain should be airgapped"?
Show threadPaul CantrellNov 4
@vfig
The real horror story hasn’t happened yet: it’s every car in the world of a certain make suddenly suddenly failing to run — or losing its brakes, or spontaneously catching fire — because of a bad over-the-air update.
Show threadTexan_ReverendNov 4
@inthehands @vfig Also, there are things like the ability of OnStar to remotely bring your vehicle to a halt.
Show threadTexan_ReverendNov 4
@inthehands @vfig And basically every GM salesperson will tell you that registering with OnStar is a requirement of purchase when it's not.
Show threadMx Rey (Fuck ICE) 💜 🏳️‍⚧️Nov 4
@inthehands @vfig I regret to inform you that https://www.jalopnik.com/1996500/jeep-hybrids-bricked-after-ota-software-update/
Some Jeep Hybrids Bricked After Disastrous Weekend OTA Software Update

A weekend over-the-air update left many Jeep owners frustrated - and some stranded.

Jalopnik
Show threadPaul CantrellNov 4

@rey @vfig

Ah, I missed that one! At least they were only bricked and nothing worse…

Show threadF4GRX SébastienNov 4
@inthehands @vfig there was a land rover (or jeep?) bricking update a while ago IIRC?
Show threadPaul CantrellNov 4
@f4grx https://toot.cat/@rey/115489703700634978
Rey 💜 🏳️‍⚧️ (@[email protected])

@[email protected] @[email protected] I regret to inform you that https://www.jalopnik.com/1996500/jeep-hybrids-bricked-after-ota-software-update/

Toot.Cat
Show threadF4GRX SébastienNov 4
@inthehands Yes, thanks!
Show threadMartin Vermeer FCDNov 4
@inthehands @vfig As the aviation saying goes, regulations are written in blood
Show threadKevin Neely Nov 4
@vfig @inthehands Charlie Miller?
Show threadProto Himbo EuropeanNov 5
@vfig @inthehands We have several stories, now, of automobiles with internet-connected engines etc. being modified in bad ways or disabled remotely, either because of corporate profit-greed or someone's fsckup.
Show threadglasspshrNov 4
@inthehands outstanding
Show threadFrederik Braun �Nov 4
@inthehands this is nice. I need this in my home :)
Show threadOcéane 🏳‍⚧️ Nov 4

@inthehands Lol, I wonder if you could do a 1:1 replica based on cyberactivism and cypheractivism principles.

(Like cyberpunk and cypherpunk, but as 30-years-old adults taking up our responsibilities toward actually endangered underage people.)

Show threadCassandrichNov 3
@inthehands Passwords to most things honestly should be "cypherpunks".
Show threadPaul CantrellNov 3
@dalias
Sounds pretty random to me!
Show threadEsther #antifaNov 3
@inthehands @dalias
I have always taught all my interns to use passphrases. Once, an intern asked me what I meant, and I said, "Not a word, but a sentence, for example: 'I am crazy!'"... That became his first passphrase...
Show threadPaul CantrellNov 3
@src_esther @dalias
It’s an improvement over a single word! Really, though, most passwords should be machine-generated and stored in a password manager unless it’s essential that you be able to type it from memory.
Show threadFlexi Bell Nov 6

@inthehands @src_esther @dalias

Nope.

Password manager - single point of failure. When compromised renders all other sensible measures useless. Just don't.

A pasword neeeds to be:
- looooong
- memorable

That's really all.

(Btw: agreement with all you other points, of course!)

Show threadCassandrichNov 6
@flexi @inthehands @src_esther That doesn't scale. Passwords to a few key things that actually matter to you need to be long and memorable, but the hundreds of junk passwords for junk accounts you were forced to create and never wanted belong in password managers. Whether that's software on your device or a little notebook.
Show threadFlexi Bell Nov 6

@dalias @inthehands @src_esther

That's indeed a point.
But it's just not a good guideline for average users.

And yes, I think a notebook ist a way better place than a software in that case.

Show threadFlexi Bell Nov 6

@src_esther @inthehands @dalias

That's the spirit.

A "random" password is a (very common) mistake, because you could never memorize it and have to immediately create a security breach.

Show threadPaul CantrellNov 6

@flexi @src_esther @dalias
If only someone had invented some kind of…bear with me…“password manager” to solve this problem.

(In general, a passphase that is memorizable by a human does not have sufficient entropy to handle many forms of brute force attack; memorizable passwords should be kept to a minimum.)

Show threadFlexi Bell Nov 6

@inthehands @src_esther @dalias Just no.

Anything that will bruteforce your pwd does not care about "random". But will thank you for your single point of hack-one-get-all-free.

But don'f forget "long". My passwords are really long and I simply keep them in my mind.
And neither you nor any algorithm will bruteforce them in years. 🙂

Show threadFlexi Bell Nov 6

@inthehands @src_esther @dalias In simpler words.
A password manager is the big security breach I was talking about.

Unfortunately, that's an already very common misconception.
It does not become more difficult to crack just because *you* can no longer remember it.

Instead you create the biggest risk, a place where the password (or even *all* passwords) is stored - for not only yourself.

Show threadThis Account Kills FascistsNov 3
@inthehands My husband works for NASA. We have exactly zero "smart" home things.
Show threadPaul CantrellNov 3

@violenteastcoastcity

Hat tip to another crusty old (in spirit) engineer

Show threadMister DaveNov 3
@inthehands is that last one even an option these days? like maybe most of the time when you're driving, but i feel like OTA engine computer updates are a thing in the new cars.
Show threadPaul CantrellNov 3

@misterdave

It’s an option if you drive a 20yo Civic and mostly get around on a bike!

Show threadmaxelcatNov 4
@inthehands our dishwasher has an app! I mean, why? Does the little chap post regularly updates?
Show threadPaul CantrellNov 4
@maxelcat
I mean, given what data brokers will stoop to, quite possibly yes
Show threadPhilipp SchwendkeNov 4
@inthehands Dishwashers maybe, but my coffee grinder has wifi. I don't know why. The app does exactly nothing. I guess it's a 'Why not?' design choice. Thankfully it can be disabled.
It's a nice grinder though ^^
Show threadSeán C McCord Nov 4
@inthehands Why does a house need a drivetrain?
Show threadPaul CantrellNov 4

@ulexus

Same reason a dishwasher needs WiFi

Show threadCarlos SolísNov 4
It's probably about "smart" vehicles, and yeah, imagine a hacker remotely disabling your drivetrain
Show threadShawn KovalchickNov 4
@inthehands
- Dance like nobody is watching.
- Encrypt like everyone is.
Show thread�Nov 4

@inthehands

- my random password
- is backupped on a ftp server
- where anonymous can be connected
- that i need for my dishwasher that has a built in lte module
- trains i engineer communicate unencrypted over CB radio

am i doing this right?

Show threadCenbeNov 4
@inthehands Just got a fancy new range, and the first thing I did was to turn off the wireless. A stove with an internet connection, well I mean to say! Who knows what kind of ideas it might get?
Show threadPaul 💙 28 💔 💚Nov 4

@inthehands

In light of the Yossi Cohen comment

All vital electronic systems should be airgapped and removed from Israeli influence

Show threadPaul CantrellNov 4
@PGBeattie
I wouldn’t single out Israel here. There’s at least half a dozen nation-states who could wreak absolute havoc at national or even global scale if a crumb went down the wrong way. Essential systems are distressingly brittle right now.
Show threadPaul 💙 28 💔 💚Nov 4

@inthehands

I only singled out Israel out of the many... as Israel is the only one to my Knowle who have used exploding pagers as a terror weapon and publicly announced their ability to do more if needed

But agreed I'm sure other countries and individuals have a similar horrific ability

Guess it's the age we live in and how war and terror is developing in this tech age

Hope you're having a great evening

Show threadCarlos SolísNov 5
In related news, recently deceased politician Dick Cheney had to get his own pacemaker airgapped (it had a wireless point of access) out of fear that a hacker could override it
Show threadPaul 💙 28 💔 💚Nov 5

@csolisr

We also have news today of China being able if they wished to disable Chinese built buses sold into Denmark and Norway ... an older unverified story is the US being able to ground Fighter Aircraft sold to allies

Show threaddxzdbNov 4

@inthehands I like the concept of a house/life drivetrain 😊

Thermostats don't need wifi either - you don't need that convenience - probably…

Show threadAdam SjøgrenNov 4
Also, we obey the laws of thermodynamics!
Show threadProto Himbo EuropeanNov 5
@inthehands You did the thing!
Show thread ShalienNov 5
@inthehands What about freedom to choose your operating system