[twerkmonsta]

I would love to hear more about the kind of work done by people that need this level of security.

Like is the NSA covering their laptop screws in glitter nail polish? Are covert CIA agents? SOF?

Who needs this level of secrecy that would not have the physical security in place to protect the device in the first place?

[arkwin]

In the book, "This Is How They Tell Me the World Ends: The Cyberweapons Arms Race" or "Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy" (sorry, I read both recently), the author describes an incident where when she got back to her hotel room one night her door was open, the safe was open, and her laptop was laying there. She did cybersecurity reporting and wed how some governments abuse spyware to spy on their citizens.

I imagine the target audience for this type of security would be journalists and cybersecurity researchers whom governments might target. I'm sure other jobs could use this information to protect themselves better.

Large government agencies can afford to design systems that probably do not need these requirements, and they also probably wouldn't have any sensitive information on any unattended device.

[secfirstmd]

At secfirst.org over the past 10+ years we've probably trained hundreds of journalists on this exact scenario and how to detect/mitigate it.

[BadHumans]

This sounds like a warning more than anything else. They are saying "we can get to you if we need to."

[daniel_reetz]

When a warning comes in this form it has the same implications as action. It's a distinction without a difference.

[rdl]

Nuclear stuff uses more mechanically robust things like solder with a wire brush run through it and photographed over screws/joints.

(Also lol I did the 2013 glitter nail polish talk w Eric Michaud. I feel old now.)

[bediger4000]

I bet some reporters, Bart Gellman, Ellen Nakashima, Jason Leopold, Kim Zetter maybe, do this kind of thing.

Anna Merlan, Tim Marchman, those 404 Media folks probably. Reporting on crime syndicates probably leads you to be paranoid.

[dotancohen]

It seems that this might blow other types of cover, though.

If the border guard notices glitter-covered screws on Ordinary Joe's laptop, that might tip off the Imperial Guards to keep a close eye on him during his stay.

[praptak]

That's why it is good to make general public aware of these techniques. The more people use it the better for the people who really need to use it.

[matheusmoreira]

If success requires getting people to care about anything at all we've already lost. Electronics should just come with tamper-evidence as a feature. They should come with these things pre-applied so that everyone has them whether they care or not. Then they can't single you out for having them.

[walterbell]

Some HP PCs have tamper detection of cover removal, anchored in TPM and security coprocessor, http://h10032.www1.hp.com/ctg/Manual/c07055601.pdf

[pclmulqdq]

I run a service that needs some measure of L1 security (true randomness), and the servers that actually generate the random numbers get this sort of treatment. We get all the manufacturer's features like intrusion detection switches that tie into the TPM, but we also do some other tamper protection.

I am not going to detail everything that happens to these servers, but glitter epoxy and other annoying seals on the places the server might be accessed are some of the physical protection features.

[gorgoiler]

I was in the park with some friends yesterday and we took a cooler with some ice and beers in it. Not long after we arrived a lady came over and asked if we had seen a red purse she had lost. We hadn’t, but helped look in the immediate surrounding area for a few minutes.

She asked very shyly, if it wasn’t too much trouble etc., if she could look under the cooler as well. It might sound silly but I think it was completely understandable. While unlikely, she wanted to eliminate the possibility that the purse was in our area, before moving on.

I think a lot of tamper seals are like this. If you have a leak and need to decide if it was either from an unscrupulous employee in the office or from someone else at home tampering with your laptop then being able to definitively eliminate the latter will help you focus on the other possibilities.

[polotics]

It's fiddly and annoying, the exact opposite of what you'd put in a movie, or even a boring novel. From my year in the (redacted) MoD, I still get bad memories of having to deal with stuff like https://www.3m.com/3M/en_US/p/d/b5005310025/ or rather the equivalent from twenty years ago... btw. is anyone working on Haven or a reboot (eg. looking at https://github.com/guardianproject/haven/issues/465)

[wonder_bread_29]

This is not the way security works in a professional context. Did someone search my hotel room? who cares? Did someone go through my phone? who cares? The real purpose of detecting an intrusion is not to protect something there. The purpose is the detection--and you don't want an adversary to know you detected their activity. It's a test. You don't have anything in this world that you can actually protect. So the question to answer is, "Am I of interest?"