Target FireWire mode security

[HateEternal]

When I got my G5 I booted my iBook into target FireWire mode and transfered all my files off.

I didn't think about it but after a while I realized that it didn't require me to authenticate to get access to the files. While this isn't that big of deal to me, I was just supprised that I had such rights. I realize if I had chosen to encrypt my files they would have been secure but still it seems kind of weird that there isn't another security measure in place.

Just thought I would make the statement and see what other people thought about it.

 

[fryke]

You could also enable the OpenFirmware password prompt at boot-time, so no-one can even activate target-disk mode without the password. Sure, there's even a way around _that_, but like with all security stuff, in the end it's a mix between convenience and security. If you really want no-one to ever see what you've saved onto a harddisk, you best burn it at a very high level of temperature after shooting it with a gun several times. Less convenience, but good security.

 

[scruffy]

If you have control of a computer, and can choose how it boots, all the files on it are yours if you want them anyway.

You could boot off a CD you control, you could boot into single user mode, or you could just open up the laptop and pull the disk right out.

The whole point of target disk mode is that the OS on the disk doesn't boot - it's entirely a feature of open firmware - so there's no OS running to actually perform the password verification anyway. Open firmware doesn't know about netinfo, or password hashes. It doesn't even know about filesystems - you could boot in target disk mode with an unformatted disk.

You can set an open firmware password if you want, which would help somewhat by stopping people from booting the computer into target disk, single user, or off a CD. There are documented weaknesses with open firmware passwords, but it raises the bar a little.