2 ms·

> Once you have access and either root or pass whatever extra authentication the access requires. How hard would it be to boot a signed kernel with a system re

> Once you have access and either root or pass whatever extra authentication the access requires. How hard would it be to boot a signed kernel with a system ready to give you all the access you want or need? > The extra failure mode here is that someone can copy the key and crack your password offline on their own time. but what i was arguing about was once i could copy your encrypted key i could likely use it right away with TPM. > At that point a camera catching your password should also be a potential threat. But yeah, if that's something you're realistically worried about then it's not a great solution for you. i feel like everybody should be seeing this as a threat. Don't you look out for someone snooping on your typing when you enter passphrases? i certainly do and avoid it while being watched, especially in public places where cameras are more likely.

viraptor 5y ago
> How hard would it be to boot a signed kernel with a system ready to give you all the access you want or need? Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot). > once i could copy your encrypted key i could likely use it right away with TPM You cannot copy the key once it's moved into the TPM chip. > Don't you look out for someone snooping on your typing when you enter passphrases? No. I'm not secure from targeted snooping anyway, but I'm not typing any non-local passwords usable by people reviewing old camera footage - in most cases access is being 2fa.
- mercora 5y ago
  > Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot). so locked means i can not boot any other system until its unlocked? How do i do this? is there another passphrase involved? do i have to reset the chip before anything else is booted? i am probably not that well informed on this topic. > You cannot copy the key once it's moved into the TPM chip. obviously not! but i can just use it right away without figuring out your password. That is assuming i can fool the system to trust me. It requires the same level of access but in case of the passphrase i am blocked until i solved this. If i use your key immediately to ensure my own keys are trusted i am already done.
  - viraptor 5y ago
    > so locked means i can not boot any other system until its unlocked? https://linuxhint.com/secure-boot-linux/ https://linuxhint.com/secure-boot-linux/ / https://wiki.ubuntu.com/UEFI/SecureBoot https://wiki.ubuntu.com/UEFI/SecureBoot UEFI with your own keys in TPM (same tech involved) allows you to run only your signed bootloader and kernel. So no external media, replacing the disk, or tricks like init=/bin/sh will work. You can only boot into the signed system. From there you have the usual user account controls.

viraptor 5y ago

> How hard would it be to boot a signed kernel with a system ready to give you all the access you want or need? Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot). > once i could copy your encrypted key i could likely use it right away with TPM You cannot copy the key once it's moved into the TPM chip. > Don't you look out for someone snooping on your typing when you enter passphrases? No. I'm not secure from targeted snooping anyway, but I'm not typing any non-local passwords usable by people reviewing old camera footage - in most cases access is being 2fa.

mercora 5y ago
> Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot). so locked means i can not boot any other system until its unlocked? How do i do this? is there another passphrase involved? do i have to reset the chip before anything else is booted? i am probably not that well informed on this topic. > You cannot copy the key once it's moved into the TPM chip. obviously not! but i can just use it right away without figuring out your password. That is assuming i can fool the system to trust me. It requires the same level of access but in case of the passphrase i am blocked until i solved this. If i use your key immediately to ensure my own keys are trusted i am already done.
- viraptor 5y ago
  > so locked means i can not boot any other system until its unlocked? https://linuxhint.com/secure-boot-linux/ https://linuxhint.com/secure-boot-linux/ / https://wiki.ubuntu.com/UEFI/SecureBoot https://wiki.ubuntu.com/UEFI/SecureBoot UEFI with your own keys in TPM (same tech involved) allows you to run only your signed bootloader and kernel. So no external media, replacing the disk, or tricks like init=/bin/sh will work. You can only boot into the signed system. From there you have the usual user account controls.