Once you put a chromebook into devmode, you can login as the user 'chronos'. chronos does not have a password, and it has full sudo abilities (so you have root

Once you put a chromebook into devmode, you can login as the user 'chronos'. chronos does not have a password, and it has full sudo abilities (so you have root access immediately). Also, verified boot is turned off. Ok, but what much of the (sadly) uninformed commentary around chromebooks and devmode fails to mention is that you can turn it all back on - and still keep devmode. There's a simple script left there for you to set a password for chronos, and the big motd thats printed on the console (but not crosh) tells you about it. Run it, choose your password, and those who have physical access no longer have automatic root (or even chronos) access. Turn verified boot back on, and disable legacy and usb booting. Now you have a machine, still in devmode, thats MORE secure that standard x86 machines. - you can't boot from external media - you can't pass args to the internal bootloader, when booting chromeos's kernel, so no more single-user linux kernel tricks (ie: instant root) - you can't somehow modify the on-board kernel and get past verified boot Nothing's totally unhackable, but this seems reasonably secure to me ...