HN Explorer

Headset unlocks phone unlocks laptop: Dread Pirate Roberts didn't stand a chance

3 points by paradroid ↗ HN
My Bose QC35II headphones are set as a Trusted Device and so automatically unlock my android over bluetooth when I'm in range, and my phone is a trusted device to my Google Chromebook Pixel. Dread Pirate Roberts wouldn't have stood a chance.

To maintain security you really need a backup phone on you at all times that you can use to log out your other devices that isn't part of this chain. You additionally need someone else that you trust who has permission to do this, but that's just yet another attack vector.

Truth is, if someone wants to get at you they can and you can't stop them without being incredibly paranoid. So Bluetooth-based chain of trust, here we go.

9 comments

[ 0.23 ms ] story [ 37.9 ms ] thread
matt_the_bass
What’s the background on this? Did I miss something in the news?
Mister_X
It's pretty clear that he's pointing out a security problem with "trusted" devices. He just wasn't very articulate about it.
paradroid
I was fairly articulate, but you needed to be "in the know" to grok the writing :)
Mister_X
Glad I don't need a cell phone. I still use an MP3 player, and encrypted storage on my Linux notebooks. I never understood having all my personal data on a hand held tracking device, just crazy, from a security standpoint.
roryisok
I don't get the Dread Pirate Roberts joke. Is there some Princess Bride bit I'm forgetting about trusting or unlocking things?
j_s
https://hn.algolia.com/?query=silk%20road

Sild Road admin Ross Ulbricht aka "Dread Pirate Roberts" arrested with laptop left running, unlocked.

https://news.ycombinator.com/item?id=9545085

What unfolded next was a piece of improvisational theater. At 3:14 pm, DPR was typing away, writing to Cirrus. Just then, a middle-aged woman and man came toward Ross, ambling along in the kind of semihomeless shuffle you might often see in a San Francisco library. “Fuck you!” the woman yelled when they were directly behind Ross’ chair. As if they were a deranged couple about to fight, the man grabbed the woman by the collar and raised his fist.

Ross turned around for just a second, during which a hand reached across the table and grasped Ross’ Samsung. The petite, unassuming young Asian woman sitting across from Ross this whole time was, to everyone’s surprise, also an FBI agent. Ross lunged for his machine, a hair too late, as she turned like a quarterback for a quick handoff to Kiernan, who appeared out of nowhere—as instructed—to get the laptop. It took less than 10 seconds. From afar, Tarbell was astonished by the elegant choreography of the whole thing. It looked like the police procedural version of a tight jazz quartet.

WillKirkby
By enabling Trusted Device unlocking you're giving yourself convenience at the cost of an increased attack surface. To maintain security you really need to consider the threat model of these 'convenience' features and stop using them.