A Mechanism to Combat Phishing

Hacker News

Share card

A Mechanism to Combat Phishing

This is a diagram of a proposed mechanism to combat phishing and other computer attacks: https://m.imgur.com/a/MLOVR1y The fundamental problem: computers require two-way communication to usefully interact with many networked resources such as the internet. This opens the door to the injection of malicious instructions. Once a device is compromised, it can be used as a jumping off point to attack other networked devices. Proposed solution: One-way data transfer has long been possible through devices such as data diodes. Embedding a one-way device between 2 CPUs prevents a compromised CPU from being used against the other "secured" CPU. If a switching mechanism for peripheral devices such as mice, keyboards, and monitors was connected to a multi-CPU device with such a one-way data connection, the average user could simply alternate between a "secured" CPU connected to secure resources (e.g. internal business databases) and the "insecure" CPU to access public resources such as the internet. If their device was compromised by phishing or some other attack, it would be isolated and unable to be used as a jumping off point to attack deeper into the network. Long-term vision: eventually this design could be applied more broadly, for example to mobile devices. A secured network consisting of a small number of trusted entities (e.g. banks, government websites) could be accessed via the secure side, and general internet browsing could be done on the insecure side. Tradeoffs: this would cause a performance hit to all devices implementing this design, as you would require 2 CPUs to achieve the same effect as 1 in a traditional design. Ideally one CPU could be optimized for performance and the other for security, but this is a detail and design decision outside the scope of this proposal. Thank you for your time and I appreciate any feedback.