For example, Signal is a great app to use for private communication but if you use Signal on Windows OS then how private is the communication really? Typical Windows users aren’t good at security and Windows users also have a high amount of malware which can spy on the conversations. It was just an example for privacy starts with the hardware.

I have read a lot of people in privacy communities recommend buying older thinkpads and basically anything that Heads supports. The problem is not that they are old, the problem is they are second hand. You don’t know what the previous owner have been doing on the laptop and who might have had access to it. Remember, Windows users are typically not good at security and malware spreads commonly in Windows.

If a malware flashes a ROM then you buy their laptop and erase the hdd or ssd or buy a new hdd/ssd, then you flash coreboot to the computer. After all this the malware can still remain in the firmware and you would never know unless the malware makes itself obviously known by a ransom attack or stealing all your crypto or something.

There is nothing you can do to prevent this risk other than avoiding used computers.

Then there’s the entirely other debate if it’s even worth it for security & privacy to buy an old brick that is supported by Heads. And I’m not experienced enough on that topic yet although I’m learning about it and getting closer to being able to come to my own conclusion with the help of all the experts who have written about it.

These old bricks don’t get microcode updates for the CPU which means you will be vulnerable to many Spectre and Meltdown attacks. QubesOS can mitigate it to some degree such as by disabling hyperthreading, but QubesOS can’t mitigate it completely, only microcode updates can and these old bricks don’t receive them.

But the main point I wanted to make in this topic is about risk with used second hand laptops. Because of that I think it probably is best to buy a new unused laptop. Off the shelf for cash is best but maybe not depending on which country you live in. fed upgrade factories are a thing and some countries have it happening more than others. In that case maybe it’s better to order a laptop from one of those laptop vendors who ship it with tamper proof container, although it will be very expensive with taxes/customs but worth it.

  • dingdongitsabear
    101·
    1 day ago

    first off chill out, Jason Bourne.

    the threat mitigation is handled based on your threat model, not on a “defend all bases against anyone” approach. once you answer what your specific model is, then you can start building your defences. if your threat model is spouse looking through your shit, a password is more than adequate. if it’s the border nazis CBP, you go for encryption at rest. if it’s a toddler walking around the house smashing stuff, none of those will do you any good.

    there are people with complex threat models but I doubt they post on lemmy and they def don’t scour the classifieds for used Thinkpads. the idea that there are threat actors out there infecting random devices and then see what they catch is… def possible, but highly unlikely.

    you’re perfectly safe using a 2nd hand enterprise-class laptop, like a Thinkpad, Elitebook, or Latitude, wiped clean. those are tough and resilient devices built for road warriors for everyday, heavy use. the good thing is, they get periodically swapped out for new models, so they can be had for cheap, and a huge majority of those haven’t seen a lick of any significant use.

    those devices are worlds apart from the laptops you’re advocating buying (I assume you mean the consumer-class models) and definitely way cheaper, like a couple times over, while being infinitely expandable and serviceable with cheap, widely available and cross-generation compatible parts.

    the final part is compartmentalisation and fungibility of devices. keep the minimum stuff you need on there, assume they will break, get lost or stolen, so encryption is mandatory, and have a tried and tested backup and restore procedure in place.

    I’ve noted the product families specifically and what I wrote applies to them only, not every used device everywhere.