So, the problem with USB tokens that we basically have two choices: - Unauditable black boxes built on *supposedly* more secure ICs that require NDAs to develop for - Open and auditable, but definitely pwnable off the shelf microcontrollers. Which poison do you prefer?
-
Show this thread
-
Open IC, because of you master assembly language and code everything with it, you can code things that can resist usual pwn techniques.
1 reply 0 retweets 0 likes -
No. Coding in assembler has nothing to do with writing secure software (in fact it's a lot worse most of the time), and certainly has nothing to do with the physical attacks I'm talking about, which cannot be mitigated in any programming language.
3 replies 0 retweets 1 like -
For example, in assembly language, there are technics from assembly language jedi knights like me to mitigate stack & buffer overflow, but also ROP and maybe JOP (I'd have to review JOP's white paper to ensure my tricks can work). It's all a matter of being an advanced highly
1 reply 0 retweets 0 likes -
Or you could just code in Rust and never have to worry about buffer overflows. Sorry, I would never hire you. You don't know what you're talking about if that's your mindset. If you think coding in assembler means you write more secure code, I am certain your code is not secure.
5 replies 0 retweets 0 likes -
Do I won't argue with you. Code in Rust, it's an option, but coding in Rust makes you dependant of an OS, of a kernel, of libraries, full of security breaches. When I code in assembly language, usually for embedded systems, 100% of the code is my own code. I use no library.
1 reply 0 retweets 0 likes -
If you had actually looked into Rust, you'd know it works standalone without an OS, a kernel, or anything but a tiny subset of the standard library, which is itself written in Rust and thus largely free of security flaws by design. Rust works fine on embedded systems.
3 replies 0 retweets 1 like -
Great for those who don't have my skills in assembly language.
1 reply 0 retweets 0 likes -
Great for those who want to write maintainable and safe code efficiently. You do you, but I still won't hire you. You're not superhuman, your assembly has exploitable bugs. The only way to write safe code is to use tools that reduce the chances of mistakes.
3 replies 0 retweets 0 likes -
would surprise you. Again, I agree with you, because not everybody has my skills & experience in assembly language, but don't pretend that Rust is the only way.
1 reply 0 retweets 0 likes
Rust is not the only way, it's just a better way. What doesn't make sense is saying that "skillz+asm" is better. Truly skilled individuals know to use the tools that best help them achieve their goals, and asm is never going to be on your side when writing secure code.
-
-
I did say it just for the very very very vety few folks like me that are still alive. That were not murdered or compromized by CIA. Can't be more honnest with you.
0 replies 0 retweets 0 likesThanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
But beside "my" personnal case, skills & experience, I fully agree with you.
0 replies 0 retweets 0 likesThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.