More secure than smartcard or cryptostick against remote attacks?

[Josef Schneider]

On Fri, Feb 8, 2013 at 1:17 AM, Robert J. Hansen <rjh at sixdemonbag.org> wrote:
>
> Sure.  That's theoretically possible.  I don't believe it to be true,
> though.  My machine is trusted not because I'm certain that it's immune
> to being pwn3d, but because I acknowledge that it can break my local
> security policy and I'm willing to accept what I perceive as the risks.
>
> If you don't trust your hardware, then that means you're not willing to
> accept the risks you perceive.  And that's a really big problem.  If
> you're not willing to accept the risks you perceive as associated with
> your hardware, then why are you using your hardware?

Of course you can trust a hardware created for the sole purpose of
signing clear text after displaying it more than a general purpose PC
that has a lot of software that has absolutely nothing to do with
security on it and regularly connects to a very insecure network (the
Internet).
You argue that there is only one level of trust for all hardware
someone owns and either you trust all of it or none, and that is just
not true!
Why do you think do Banks use Smart Card readers with own
display/keyboard and serial connection or TAN-generators using flicker
codes?
They do this because on the average PC there is a lot of software, a
lot of it closed source which the bank can not control and neither can
the owner.

I can write some "virus" a user has to install himself (and we all
know a lot will!) which sends signed mails to someone using GnuPG
installed on the PC, even if using a smart card, in probably less than
a day!
Writing a modified firmware that shows wrong amounts/account ids for
my Class 3 card reader and finding a way to install it (updates are
cryptographically checked) is much much harder. I have no idea how
long that would take or if I would ever succeed.
I assume for TAN generators which get the transaction data using
flicker codes it will be even harder!
So even if I get someone to install my malware on his PC, his online
banking will stay relatively safe.

I have a smart card that has digital certificates on it which can be
used to sign documents legally binding in my country. I use that card
with a reader with own pin pad. Of course someone can highjack my PC
and fake the data I want to sign. There are just a few problems:
• He can only sign something whenever I want to sign something, else I
won't input my PIN
• I expect something to have a valid signature after that, so either
he hopes I don't check this signature, or he fakes all the ways I can
check that, which is very hard.

With GnuPG on the other hand someone who has access to my PC can sign
whatever he likes and sign as much as he likes, as long as my card
reader is attached (which is, to be honest, quite long some times). If
I wouldn't have a smart card he could even copy my key and then sign
and decrypt whatever he likes, where- and whenever he likes!

So given the fact that I maybe sign an average of three documents a
day, in case one an attacker could sign up to three documents a day,
but I would notice that very quickly because someone of the recipients
would call me telling me the signature is invalid or I sent him some
things he didn't expect (except if the attacker waits for exactly THE
one document he wants to forge, has the right programming logic to
detect and change it accordingly, etc..). With GnuPG in its current
state he could sign millions of documents without me even noticing.

I see a difference there!
There is a risk to die when bungee jumping. There is a risk to die
when jumping naked from a bridge without bungee rope. This doesn't
mean I tell every bungee jumper to jump naked from bridges, because he
could die with bungee rope too! I I don't do this because the odds to
die are very different!