Joanna Rutkowska

Joanna Rutkowska @rootkovska

RT @SwiftOnSecurity: When Google revokes ur license https://t.co/1PvRRJGL7d — PolitiTweet.org

Joanna Rutkowska @rootkovska

20 yrs ago I thought the ultimate exploit to be CPU usermode-to-kernel escalation. Today I fancy more a BT headphones exploit which whispers “difficult” questions directly into the head of a victim... https://t.co/jWH3bvfgSy — PolitiTweet.org

Joanna Rutkowska @rootkovska

Perhaps a World of Auditable Minds would indeed function correctly, yet would it be creative and fun? — PolitiTweet.org

Joanna Rutkowska @rootkovska

@IgorSkochinsky There is a difference IMHO between: 1) “lets build a whole, new, embedded, obscure OS to run your sensitive code”, vs 2) adding mechanisms which let minimize the TCB. ME, TrustZone are examples of #1, SGX, MKTME/SEV of #2. T2 and Titan might perhaps fit in the middle? — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @IgorSkochinsky: Intel DAL (Dynamic Application Loader) SDK is now available. Run your own Java code inside the ME! https://t.co/ef8gVFY… — PolitiTweet.org

Joanna Rutkowska @rootkovska

@IgorSkochinsky Heh. As I wrote in 2015, Intel wants “zombification” of our general-purpose OSes: https://t.co/IfpTBDKSs3 — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @QubesOS: QSB #049: Microarchitectural Data Sampling speculative side channel (XSA-297) https://t.co/BAULbLE5Qy — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @tugraz: After #Meltdown and #Spectre: TU Graz researchers discover new security flaws. #ZombieLoad impacts on the security of #Intel pr… — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @vu5ec: Today we present #ridl (or #mds), a new class of speculative execution vulnerability on #intel CPUs to leak in-flight data acros… — PolitiTweet.org

Joanna Rutkowska @rootkovska

Congratulations, all your selfies have been uploaded! You can now go live your life. — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @quarkslab: Updated version with E2E encryption. Tricky points like key management or group conversation are not differentiated. We migh… — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @OhNoSheTwitnt: Remember when men told us that saying that we’re a few steps away from a Handmaid’s tale was an exaggeration? We don’t l… — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @torproject: "The evidence that they have is the book of Noam Chomsky, a couple of USB sticks, and a couple of computers... there is no… — PolitiTweet.org

Joanna Rutkowska @rootkovska

@dakami @Alexeyan2 Only problem is: code in the enclave has very limited ways of getting info about the external world (such as mouse movements, interrupts, etc) bypassing the host OS, so that the (untrusted) host OS cannot intercept nor sniff this entropy... — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @torproject: Very exciting call for research: @Mozilla has an interest in potentially integrating more of Tor into Firefox 🔥 Tor has ne… — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @gnupg: GnuPG's #OpenPGP (gpg) and #SMIME (gpgsm) implementation approved for restricted communication in Germany and Europe. #windows… — PolitiTweet.org

Joanna Rutkowska @rootkovska

I’ve added the question marks in the above tweet, because I thought there perhaps could be ways to generate entropy inside enclaves by using some non-intercept-able instructions still? RDTSC-like counters? (But not RDTSC obviously). — PolitiTweet.org

Joanna Rutkowska @rootkovska

RDRAND might be optional for traditional computing, but (seems) required for envlave-based computing. RDRAND is the source of entropy for code in enclaves, which the OS cannot see nor compromise. So, if we don’t want to trust the OEM+devices+OS+admins, we must(?) trust RDRAND :/ — PolitiTweet.org

Joanna Rutkowska @rootkovska

RT @evainfeld: Meanwhile in Poland, 52 year old Ela Podleśna was just arrested for making this image. Let's spread it. https://t.co/hBNx9S… — PolitiTweet.org

Joanna Rutkowska @rootkovska

@kravietz2 @kevinmarks @abaranov @Kravietz How is this hiding/aliasing of addresses implemented under the hood? SSB boats no singleton structures... — PolitiTweet.org

Joanna Rutkowska @rootkovska

@Ianopolous @IPFSbot @Peergos How does this relate (is better/different than) the Scuttlebutt: https://t.co/niLhqsTR63 — PolitiTweet.org

Joanna Rutkowska @rootkovska

@andrestaltz FWIW, from what I've read so far about Scuttlebutt would make me try it immediately with a few friends, because I SO love some of its core concepts (serverlessness, privacy, offline-friendliness, asynchronicity) yet... lack of an iOS client app makes this a no-go in my circles :/ — PolitiTweet.org

Joanna Rutkowska @rootkovska

Patchwork seems to be the most popular reference implementation of a client app which provides a social platform service on top of this Scuttlebutt protocol. There is also an Android Manyverse app by @andrestaltz which looks v. promising. Sadly no iOS app (...seriously?) — PolitiTweet.org

Joanna Rutkowska @rootkovska

Scuttlebutt [1] - a server-less (p2p) protocol for async feeds publication - looks really interesting. Primarily designed for social platforms, but many other uses come to mind (camera/sensor feeds, serverless git) [1] https://t.co/6Yqx1Fpbpp https://t.co/dRSL5xQRwh — PolitiTweet.org

Joanna Rutkowska @rootkovska

@bizandsec I’d be happy to pay. Just like I pay for many apps and services I like and use (even if they’re not ideal and not open source). — PolitiTweet.org

Joanna Rutkowska @rootkovska

Ok, before the next 64 people jump to tell me about Mastodon: — PolitiTweet.org

Joanna Rutkowska @rootkovska

@breard_r Yeah, I used Mastodon. It seemed more like Twitter alternative to me. Does it support e2e encryption? Closed groups of friends? Again, the goal is a platform facilitating private social life with select friends. — PolitiTweet.org

Joanna Rutkowska @rootkovska

And with clients for iOS, please :p — PolitiTweet.org

Joanna Rutkowska @rootkovska

So, if Facebook is “Windows”, what would be the “Linux” of social platforms? Ie. decentralized/federated/privacy respecting platform? Here the goal being to keep in touch with select friends - privately sharing photos, stories, comments, etc; _not_ a public broadcasting platform. — PolitiTweet.org

Joanna Rutkowska @rootkovska

I’ve been long admiring Andrea’s expertise on {open, secure}hardware design and his perfectionist’s attitude. This upcoming USB armory Mk II looks very exciting :) — PolitiTweet.org