Trying to understand what the kill switches really accomplish

There is no ultimate security. There are more or less sophisticated attacks and more or less probable security incidents. When someone motivated and with resources wants your information, they get your information, ex. by installing eavesdropping device to your window or just hacking phones of your family or your housemates. Or they could sell you hacked mouse or keyboard…

The thing is that kill switches are tool to protect wide range of but not all the range of attacks or leaks. When you talk about something very secret, all parties should not bring any electronic devices, because internal hardware microphone with storage could be installed in advance weeks before. Detection device should be used to scan clothes, etc. And surroundings should be secure.

The value in privacy and security tools is to use them properly. This requires transparency and clarity. Transparency and clarity are things which Purism lacks sometimes - Librem 13 had disabled and neutralized ME, but Librem 14 has just disabled ME (no neutralization). Such technical difference with huge security and privacy threat implications should be communicated heavily even that the probability of ME related attacks is low. Why? Because big part of Librem 13 marketing was based on ME attacks. And because Purism is security and privacy tech company, so it should inform about such technological differences even if looks like bad marketing. Another thing is Purism bad docs (now they are better).

Another thing is Librem 13 and 14 kill switches - do ALL of them disconnect electrical circuit? They do not. Purism explained kill switches in such a way that electrical circuit is disconnected or people got it that it is about electrical circuit, but this is not true for all Librem 13 and 14 kill switches. Cam&mic kill switch on Librem 13 and 14 disconnects microphone from sound chip, but electrical circuit is connected. Clarity failed here and this caused forum posts when people though that kill switch does not work.

Another things is hardware compatibility and specs. On one hand Purism has blogpost about right to repair, on the other hand there is no documentation (or info in the blogpost) about hardware specifics - what RAM frequencies should be used in what configurations in Librem laptops? What is the max size (inches / mm) of SSD and RAM in Librem products? There is info in forums - but when such info must be communicated in forums, there was failure in official communication channels.

One company who do not fear marketing implications around security and privacy topics is Trezor. They produce cryptocurrency hardware wallets with open-source software and open-source hardware and they are very transparent about how they work, when and how they are useful and when security incident happens they write about it extensively. Their documentation is very good and teaches users about the inner workings of their product in simple terms.

The business approach of Trezor is simple and effective - they are transparent so real security professionals know that “they are no marketing bullshit security scammers (exaggeration)” and then the security professionals can recommend the product to ordinary people. Ordinary people are happy because they read documentation written for ordinary people. The difficult security knowledge about tools and their secure use is transformed to knowledge for ordinary people in documentation, blogs and product itself. Experts wants such things too. It is just that once someone learned wheres-hows then it does not need good UX, but company expands, more people come without the learned wheres-hows.

Purism does that job with the Pureboot verification screen (nice notes, recommendations and default next actions), but that approach should be used in documentation and everywhere. Ex. there is no updated guide or documentation how to update Pureboot / Coreboot. Yes, there is blogpost and docs links to that blogpost, but proper docs should contain just steps to do the job. Blogs come and go, docs stay.

Hopefully Purism will be more transparent, clear and simple about products and their proper use.

2 Likes