more md formatting

This commit is contained in:
anarsec 2023-07-08 20:49:47 +00:00
parent b6bbc36b6f
commit 11986c34cb
No known key found for this signature in database
10 changed files with 237 additions and 88 deletions

View file

@ -37,6 +37,8 @@ Verification that the random pattern hasn't changed can be done manually with wh
The Blink Comparison app encrypts its storage, to prevent an adversary from easily replacing the photos, and gives a helpful interface for comparing them. The app helps you to take the comparison photo from the same angle and distance as the original photo. Blink Comparison then switches between the two images when the screen is touched, making direct comparison much easier.
## Implementation
Now that you understand the nuances of using nail polish on the chassis screws of your laptop(s), we'll actually do it - this is best done after [flashing HEADS](#tamper-evident-software-and-firmware) so that it doesn't have to be removed and repeated. Before getting started, you can also take a photo of the inside of the laptop, in case one day you need to check if its internal components have been tampered with despite the nail polish protection (keeping in mind that not all components are visible). Use a nail polish that has different colors and sizes of glitter, like that shown above.
* First, take a photo of the underside of the computer and use a software like GIMP to number the screws, in order to make it easier to verify. For example, the ThinkPad X230 shown above has 13 screws which need to be numbered so that in the future you know which screw the photo `3.jpg` refers to.
@ -63,21 +65,36 @@ Several colorful mixtures are described: [red lentils & beluga lentils](https://
This excerpted instruction assumes that we take the cellphone with us, but [as discussed elsewhere](/posts/nophones/#do-you-really-need-a-phone), this has its own security issues and so is not recommended. So the smartphone that we use to take a photo of the storage will need to stay in the house out of storage. [In the next section](#physical-intrusion-detection), we recommend that you acquire a cheap Android phone that only runs an app called Haven when you are out of the house. This device is going to stay out of storage anyway, so you can use it to take photos of the storage. Alternatively, if you don't have a dedicated Haven phone but you do have a [GrapheneOS](/posts/grapheneos/) device (or if the Haven phone camera is too low-quality), you can use it to take photos of the storage and then hide it somewhere in your home while you are away. With no phone, a camera can be used. Cameras, however, don't have encryption, so modifying the photos is significantly easier.
<details>
<summary><strong>If you use a dedicated Haven phone</strong></summary>
</details>
<summary>
**If you use a dedicated Haven phone**
</summary>
<br>
* Once you have put bagged electronic devices in the container, and covered them with a colorful mixture, take the photos on this Haven phone using the Blink Comparison app. Send them to yourself over [Signal](/posts/e2ee/#signal) (with the Note to Self feature, and delete for everyone) or [Element](/posts/e2ee/#element-matrix).
* Once you return, do the verification on the Haven phone using Blink Comparison.
* Once your devices are out of storage, check that the images you sent to yourself on Signal/Element aren't different from those on your Haven phone, and also check the timestamp. Once the verification is complete, you can delete the photos so that there is no confusion in future verifications about which photos to use.
<details>
<summary><strong>If you use a GrapheneOS phone, but not a dedicated Haven phone</strong></summary>
<br>
</details>
<details>
<summary>
**If you use a GrapheneOS phone, but not a dedicated Haven phone**
</summary>
<br>
* Once you have put bagged electronic devices in the container, and covered them with a colorful mixture, take the photos using the Blink Comparison app. Send them to yourself over [Signal](/posts/e2ee/#signal) (with the Note to Self feature, and delete for everyone) or [Element](/posts/e2ee/#element-matrix). Power off the device and hide it somewhere.
* Once you return, do the verification using Blink Comparison.
* Once your laptop is out of storage, check that the images you sent to yourself on Signal/Element aren't different from those on your GrapheneOS phone, and also check the timestamp. Once the verification is complete, you can delete the photos so that there is no confusion in future verifications about which photos to use. If the phone is found and the firmware or software is modified, Auditor will notify you.
<br>
</details>
# Physical Intrusion Detection
"Defense in depth" means that there are multiple layers of security that need to be bypassed for an adversary to succeed. [Physical intrusion detection](https://www.csrc.link/threat-library/mitigations/physical-intrusion-detection.html) should be done in addition to tamper-evident laptops and storage. This way, even if a covert house search doesn't interact with the tamper-evident storage (for example, because the goal is to install [covert surveillance devices](https://www.csrc.link/threat-library/techniques/covert-surveillance-devices.html)), you can still find out about it.