6 ms·

Get two yubikeys. Set up LUKS full disk encryption the usual way on Ubuntu. Install yubikey-luks and yubikey-personalization-gui. Set up yubikeys for HMAC chall

by danjoc 9y ago

Get two yubikeys. Set up LUKS full disk encryption the usual way on Ubuntu. Install yubikey-luks and yubikey-personalization-gui. Set up yubikeys for HMAC challenge response on a free slot. Enroll both keys using yubikey luks. Clear slot 0, leaving you with an encrypted brick unless you have one of two yubikeys. Mail one key to your destination. Leave the other key at home. Travel, pickup key, use it to access device at destination. Before you return home, unenroll the key. Once you arrive home, use the home key to re-enroll the travel key. Repeat as necessary.

albertgoeswoof 9y ago
Ok but there are major downsides with this: 1. If I change my plans I have to go back home or go to my original destination to pick up a key to decrypt 2. I might get there before my yubikey arrives 3. An adversary might look at my machine, and know there is data on there (in the chrome book case it just looks like a new machine), they could then detain me indefinitely or travel with me to my destination and force me to decrypt So it's not practical for casual use IMO
- danjoc 9y ago
  You won't reach alberts-hacker-cloud.com behind the great firewall. The warning message you get from the internet police won't be a pleasant experience either. But try it and learn the hard way. Let the fear and dread wash over when you realize how far away from home you are, and how utterly alone you are in a foreign system.
  - yorwba 9y ago
    Have you ever actually been to China? The great firewall acts as a blacklist, not a whitelist. If you don't publicly announce the server you are going to use, you'll be able to access it. If the traffic pattern looks suspicious, you might have to deal with randomly dropped connections or throttling, but with the right internet provider or one of the working VPNs, those aren't an issue either. If it comes to the point where the police gets involved, no level of crypto is going to help you anyway. You'd better try to contact your country's embassy so they can get you out.

by danjoc 9y ago

albertgoeswoof 9y ago

Ok but there are major downsides with this: 1. If I change my plans I have to go back home or go to my original destination to pick up a key to decrypt 2. I might get there before my yubikey arrives 3. An adversary might look at my machine, and know there is data on there (in the chrome book case it just looks like a new machine), they could then detain me indefinitely or travel with me to my destination and force me to decrypt So it's not practical for casual use IMO

danjoc 9y ago
You won't reach alberts-hacker-cloud.com behind the great firewall. The warning message you get from the internet police won't be a pleasant experience either. But try it and learn the hard way. Let the fear and dread wash over when you realize how far away from home you are, and how utterly alone you are in a foreign system.
- yorwba 9y ago
  Have you ever actually been to China? The great firewall acts as a blacklist, not a whitelist. If you don't publicly announce the server you are going to use, you'll be able to access it. If the traffic pattern looks suspicious, you might have to deal with randomly dropped connections or throttling, but with the right internet provider or one of the working VPNs, those aren't an issue either. If it comes to the point where the police gets involved, no level of crypto is going to help you anyway. You'd better try to contact your country's embassy so they can get you out.