PrimaryAlibi

I couldn't find info if disabling intel management engine with HAP bit or through bios settings will also disable the firmware TPM or intel TXT. If disabling intel ME doesn't disable the latter two features then a discrete TPM is not necessary.

To be clear, I'm not talking about overwriting large parts of intel ME with zeros. This is only the simple way of setting the HAP bit or disabling it in BIOS settings.

QubesOS doesn't require a TPM but qubesOS is often used with AEM or Heads. It's also popular to disable intel ME. Both Heads and AEM requires a TPM. AEM also requires intel TXT.

This means if disabling intel ME also disables firmware TPM and intel TXT then it's necessary to have a discrete TPM. So that is the main question here. I couldn't find an answer, does anyone know and can link to the source for verification?

Maybe it's also not possible or unecessary to disable intel ME if your CPU doesn't have AMT. You can see of your CPU has AMT or not on intel's website. So if it says there is not AMT feature, then it maybe means it's uneccesary to get a discrete TPM?

There is recaptcha v2 and v3. V3 uses V2 if V3 isn't sufficient to identify you.

What I mean with identify is fingerprinting. recaptcha collects info on how we solve the recaptcha. People have very unique way of solving captchas. You would have hard time seeing this with your own eyes but if there are 100 people who did 100 recaptchas each, then the algorithm will be able to know which recpatchas were solved by which person. This is also in combination with standard browser and device fingerprinting.

So is it possible to avoid being identified? If I've done recaptcha thousand times before, can I do it next time in a way that Google won't be able to link me to the same identity as all the previous thousand times?

I think the solution has to be done automatically in some way. Because if you try to solve the recaptcha manually with your own hand, then chances are high you will be identified. But solving it automatically is precisely what recaptcha is meant to defeat (bots).

I've had many many many times experience with recaptcha where I have had to sit there and try solve it manually the way Google intends us to solve it, for more than 1 hour I'll sit their frustrated and keep tring to solve it but it says I am failing even though I'm really not. This usually happens when I manually click in a non-human way. I might for example move the cursor by pushing the mouse with a pen. This causes mouse movements and timing and click locations to be different. But this only works for a number of times, i guess after thousands of times Google will know that is me messing around.

V3 is scary because it's first-party fingerprinting and you won't know it's there until it throws a v2 recaptcha at you. It tracks your interaction and habits on the website to see if it's human-like and probably also to uniquely identify you. If it can't identify you then it will make you solve a v2 recpatcha instead.

Google is also very anti-competitive against browsers that are configured for privacy. That's probably another reason I often have to spend hours trying to solve them.

I am afraid that the only way to not get identified by v3 recaptcha is to turn off JS. But if you do that then you can't use the website which is protected by v3 recaptcha. Unfortunately most of the internet is using either mitm cloudflare or recaptcha, so turning off JS means good bye internet.

Protection against 3rd party tracking does not help against these privacy threats because they are first party threats.

Chargers should only charge, there shouldn't be any data transfer. When it comes to security, we should not give something more privileges than it requires to do its job. Why do laptop chargers have data wires?

Maybe you have heard of usb condoms? It's a usb-c to usb or vice versa adapter where you modify it by removing the data wires which are on the sides. Then there is only power. Why don't the charger manufacturers do this themselves and remove the data wires if there is no purpose for them? It creates an unnecessary security risk by having the data wires.

What are your opinions on this? How do you approach this security threat? Or do you not do anything about it at all?

Most computer components have firmware otherwise they wouldn't do anything. This means that firmware exists in more than just the boot rom. This topic excludes the boot rom because I know it's not too theoretical for a hacker to flash the boot rom. It's clearly explained step by step how to do external boot rom flash on many different websites such as Coreboot. But this topic is not about the boot rom, it's about the other firmwares on a laptop such as cam, mic, keyboard, bluetooth, embedded controller.

Is it too theoretical how a hacker would do that? As in would it require some very rare 0-day vulnerability which might not exist currently? Or are there known ways how a hacker would be able to flash malware into these components such as the embedded controller or cam?

The reason I ask is because I've heard from people in cyber security saying two arguments: yes it's possible, no it's too theoretical or "way too unlikely". So which is it? No one has actually tried explaining their answer or linking to any source. Answers are always vague.

I think it's important to have these answer because when it comes to firmware security, it makes a huge different if all you need to do is to flash the boot rom to ensure your firmware is uncompromised. That would make security 1000 times easier. But if it's not enough then you would maybe have to Unfortunately throw away the computer if you think there's compromised firmware because you won't be able to get rid of it.

Don't forget to explain your answer. Please give link to source and further reading about this.

Verify hardware for what? Malware, spyware, backdoors. This question/topic isn't meant to go very indepth, its meant more to give an overview or starting point to research further from. Providing links to sources and where to learn more is helpful.

Here are the parts of a laptop:

    Laptop screen/display assembly

    Keyboard/top cover

    Touchpad

    Hard drive

    Hard drive connector cable

    Hard drive bracket

    Fan

    Heat sink

    Power connector cable

    Power button/USB board

    System board

    Solid state drives (M.2)

    Memory modules

    WLAN module

    Battery

    Speakers

    Bottom cover

I think we can agree that the HDD bracket is the easiest to verify because it shouldn't have any chips or anything like that so just a quick glance at it should be enough.

The power charger I've seen videos and articles that there are many spyware power chargers which you can buy and then replace the targets power charger with the one that has spyware.

But I think those are just for power chargers with USB-C connector because I think the older power connectors simply don't have any capability to transfer data. So it doesn't matter what kind of firmware the power adapter has because data can't be transferred. Data can only be transferred if the connector is USB-C.

But how do we actually verify if this is correct? With all the unconstitutional mass surveillance and gag orders the manufacturers can write in the manual that the charger connector has no capability for data transfer but it actually does secretly have that capability.

I have read WIFI and Bluetooth firmware can be replaced. I haven't looked into how yet but there are open source firmware you can use. There are also blob-free firmware which is misleading because it is technically correct to say blob-free even if the firmware is proprietary closed source as long as its embedded into the hardware and can't be modified. But this kind of "blob-free" doesn't sound good.

The Embedded Controller (EC) can have open source firmware in modern laptops but these laptops have difficulties with disabling intel ME. Which is more important becomes the question?

I hope I have given a good start to this topic. The point goal is to summarize all hardware that needs to be verified when buying a new laptop. What not to buy and what to buy. What is there that can't be done anything about. It's not meant to be a topic that goes very indepth into each part but if you want to then please do.

Read this first to understand what I'm counter arguing against: http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/faq/#how-does-qubes-os-compare-to-running-vms-in-a-conventional-os

QubesOS devs make a great point about how difficult it is to trust operating systems and because of that qubesos is great because it's easier to trust the xen hypervisor.

But all the Qubes still use a "conventional" OS, by default it's either Fedora or Debian. That means if Fedora or Debian OS is compromised then all Qubes will be compromised if all Qubes are using either of those OS. And most likely a user won't mix between both Fedora and Debian, more likely they will use just one of these OS for all or most of the Qubes.

How would the OS be compromised? Probably a 0 day in one of the official packages which come by default with a fresh installation of the OS. Or maybe one of the developers have been compromised such as the one who builds the .iso for installing the OS from.

So qubesos is more secure but just from this FAQ I've linked to, I think it doesn't seem like such a huge difference. I could even argue that qubesos is less secure because like I have explained, if the OS used in all or most Qubes is compromised then all or most of your Qubes are compromised so it's almost same problem as if you used that OS to host VMs on. But when you use QubesOS you also have the additional attack surface that comes from the hypervisor.

I'm still learning about QubesOS because I'm not sure if I will use QubesOS or a linux distro to host VMs on. I think if you use a similar approach as QubesOS does by using VMs for compartmentalization of different identities and trust levels alongside strict SELinux/AppArmor/Firejail/Bubblewrap and firewall configurations you can achieve close to same level security as QubesOS.

QubesOS also does some things I need to do more research on, such as making the GPU nearly useless in App Qubes. But if you use a linux distro to host a VM then you won't have problems passing through the GPU if your hardware supports IOMMU. But there is probably a good reason for QubesOS doing that and that's a reason to use QubesOS because QubesOS does a lot of things most people don't understand or know about but it increases security.

Another thing I like about QubesOS is I've read that anyone can build the OS from source code and that way there is no trust involved when installing QubesOS. And you can also do updates for QubesOS and the Qubes from source code as well. I haven't looked into how all that is done yet but if it's not too difficult or too much work for every update then that is a huge huge reason to use QubesOS because with most other OS you have to trust the .iso because you're not installing from the open source code because the dev who build the .iso could secretely add malicious modules.

It was difficult to make a title because of char limit.

when you use me_cleaner to neutralize intel ME, it also removes TPM. TPM is required for boot verification technologies like Heads or AEM. So you can't use Heads/AEM and me_cleaner, you have to choose one and in this case we choose to prioritize me_cleaner.

Heads: https://osresearch.net/ me_cleaner: https://github.com/corna/me_cleaner

Then the question becomes, what do you personally do to protect your computers boot firmware? There are many ways you can do that such as the popular glitter nailpolish technique. The problem with that technique is you need a good camera with a firm stand so you can take the before and after pictures at the exact same distance and place to compare them. It's also quite a lot of work to do that every single time you leave your computer which could be several times every day. AEM is also most popular to use when traveling and when traveling, having all that extra equipment with you is a problem.

What else? Maybe a secret camera without any internet connection capability which you can place somewhere in the room with the computer and that way you can know if someone was inside the room and if they did anything with the computer. The camera would have to record to a local storage like a micro sd card and you overwrite all data on that card every day so you won't need too much storage capacity. And maybe the camera only activates on movement triggered then its even easier to quickly check if there's any video when you come back to your computer. You would also need to be sure that the adversary doesnt replace the camera so you dont know its not your camera anymore or if they can erase the video files before they leave like hackers who erase logs. What do you think about that?

Another idea is a container for the computer. The container can of course be destroyed easily but then you will at least know they did something with the computer. But you would need a container that the evil maid can't go get a duplicate of or have one manufactured so they can replace the container after destroying original one.

Same problem with a sticker on the screws to open up the laptop, they could get a duplicate sticker to replace yours. I also heard there are ways to remove a sticker and then put it back again.

Practically I think camera technique is best to use on daily basis because its effective and relatively simple but maybe in some situations you have to gamble by using a container or sticker.

And then you also need to check your firmware once in a while even if you don't suspect anything. I'm not sure the best way to do that because I've read it is practically impossible to know if rom has been maliciously modified. So its probably not enough to simply dump the rom and do a diff against the rom you flashed. Maybe you just have to redo the flash again not knowing if it was necessary or not.