[Cryptography] Liberty Safe reveals that it has backdoor access to it's physical safes and provides access to law enforcement.

Ray Dillinger bear at sonic.net
Fri Sep 8 18:23:46 EDT 2023


This is what people get for using electronic security on a mechanical 
system: A system that has electronic vulnerabilities IN ADDITION TO the 
usual set of mechanical vulnerabilities.

This is what people get for using a connected device to secure anything: 
A system that has remote vulnerabilities IN ADDITION TO local 
vulnerabilities.

This is what people get for using something that relies on a trusted 
party to secure your information:  A system that has backdoor and trust 
vulnerabilities IN ADDITION TO intrinsic vulnerabilities.  Remember 
"Trusted" is a dirty word.

The more parts a system has, the more parts can fail resulting in 
vulnerabilities.  This is why we call  these things "attack surfaces."  
There may be a counterexample somewhere but I can't think of a single 
case where adding new attack surfaces mitigated vulnerabilities in 
existing attack surfaces.

More commonly, in fact, I've seen new attack surfaces heavily advertised 
as "secure" and emphasized in a way that deliberately draws attention 
away from blatant, bizarre defects in existing attack surfaces, like 
"electronic locks" that shatter into plastic shards under a single sharp 
blow from a hammer.  Don't be distracted by the shiny new parts: All the 
old boring parts still have to be just as good as ever.  Nobody would 
have fallen for the security claim if it had been a simple padlock.

Bear




More information about the cryptography mailing list