4 ms·

Yeah, I have that on my servers in case somebody tries to hack them. There is a secret to logging to my machines and if you miss it the machine self destructs i

Yeah, I have that on my servers in case somebody tries to hack them. There is a secret to logging to my machines and if you miss it the machine self destructs in a reversible way. Can't give more information but it is pretty easy to boot it again. One thing of note here, don't put LUKS header on any kind of flash (like SSD) or SMR HDD.

zionic 5y ago
>One thing of note here, don't put LUKS header on any kind of flash (like SSD) or SMR HDD. Why not?
- Anunayj 5y ago
  I'm guessing it is because it's harder to securely wipe SSD/flash drives [0]. Anyway I'm no expert on these topics. [0]: https://wiki.archlinux.org/title/Securely_wipe_disk#Flash_memory https://wiki.archlinux.org/title/Securely_wipe_disk#Flash_me...
- lmilcin 5y ago
  SSDs and drive-managed SMR HDDs do not immediately delete the data. If the system is interrupted after data is deleted there is a good chance you can still get it back. On a normal HDD you still have to wipe the data (ie. physically overwrite it half a dozen times). But this is not possible to execute reliably on SSD or drive-managed SMR HDD.
  - megous 5y ago
    You can reset the SSD's internal encryption key via hdparm, too, once you're done "deleting" luks header. It takes somewhat longer time, but if the SSD firmware is not completely stupid, it will be the equivalent of deleting the LUKS header and running TRIM on the whole device afterwards.
quesera 5y ago
> self destructs in a reversible way Reversibility is not a feature of destruction, lexically-speaking. A better description might be "locked". More importantly in this case: if you are able to reverse it, you can be compelled to reverse it. This is no different than having a secret passphrase.
- dane-pgp 5y ago
  > if you are able to reverse it, you can be compelled to reverse it. An interesting way of strengthening such a system is to split the recovery code between multiple people in multiple jurisdictions. Convincing them to hand over their piece of the key could require various levels of proof-of-free-will, ranging from "Hey, I need those numbers on that piece of paper I gave you" (asked on a video call, in a public park) to "I've booked a flight and I'll meet you at the agreed place next Monday at the standard time". These approaches can be combined with a protocol of "If I use the duress phrase, then give me a fake key and then send a message to the other members of the group / the public / the media that I've been compromised". Of course this sort of system assumes you are part of a wider organisation or at least have friends you can trust to implement all this opsec securely, without adding to your risk profile, but for some people this will be viable.

zionic 5y ago

>One thing of note here, don't put LUKS header on any kind of flash (like SSD) or SMR HDD. Why not?

Anunayj 5y ago
I'm guessing it is because it's harder to securely wipe SSD/flash drives [0]. Anyway I'm no expert on these topics. [0]: https://wiki.archlinux.org/title/Securely_wipe_disk#Flash_memory https://wiki.archlinux.org/title/Securely_wipe_disk#Flash_me...
lmilcin 5y ago
SSDs and drive-managed SMR HDDs do not immediately delete the data. If the system is interrupted after data is deleted there is a good chance you can still get it back. On a normal HDD you still have to wipe the data (ie. physically overwrite it half a dozen times). But this is not possible to execute reliably on SSD or drive-managed SMR HDD.
- megous 5y ago
  You can reset the SSD's internal encryption key via hdparm, too, once you're done "deleting" luks header. It takes somewhat longer time, but if the SSD firmware is not completely stupid, it will be the equivalent of deleting the LUKS header and running TRIM on the whole device afterwards.

quesera 5y ago

> self destructs in a reversible way Reversibility is not a feature of destruction, lexically-speaking. A better description might be "locked". More importantly in this case: if you are able to reverse it, you can be compelled to reverse it. This is no different than having a secret passphrase.

dane-pgp 5y ago
> if you are able to reverse it, you can be compelled to reverse it. An interesting way of strengthening such a system is to split the recovery code between multiple people in multiple jurisdictions. Convincing them to hand over their piece of the key could require various levels of proof-of-free-will, ranging from "Hey, I need those numbers on that piece of paper I gave you" (asked on a video call, in a public park) to "I've booked a flight and I'll meet you at the agreed place next Monday at the standard time". These approaches can be combined with a protocol of "If I use the duress phrase, then give me a fake key and then send a message to the other members of the group / the public / the media that I've been compromised". Of course this sort of system assumes you are part of a wider organisation or at least have friends you can trust to implement all this opsec securely, without adding to your risk profile, but for some people this will be viable.