4 ms·

While cool/interesting, i'm failing to understand the attack your protecting against here in the context of just prompting for an unlock PIN. Particularly if t

While cool/interesting, i'm failing to understand the attack your protecting against here in the context of just prompting for an unlock PIN. Particularly if that unlock pin is for a FIDO key or whatever which can also be removed. I mean, if someone steals your backpack, or stops you at the border, breaks into your house, whatever, they are getting the boot image too, right? Furthermore, are all your machines AMD Pro or equivilant (with the encrypted RAM enabled)? Because the disk encryption key is probably just sitting unencrypted in system RAM otherwise, and is susceptible to people freezing the ram and removing it to another machine to extract the keys.

adrian_b 3y ago
The attacks "evil maid" described by a poster above are impossible. Even with physical access, the computer does not have any boot loader or kernel or any other executable that could be altered. The attack described in the thread title also does not work, because the computer cannot boot. Even after booting from their own device, attackers cannot do anything useful. Reading the encrypted SSD will not provide any information and writing it will be detected later. The SSD does not have any non-encrypted sector. Obviously I do not keep the USB key with the computer, especially when the computer is not with me. It is never put in the computer backpack. Of course, if someone would watch me to discover how I start the computer and then they would capture me with all my belongings and then they would do a thorough search they might find the key and they might torture me to get the passphrase. Nevertheless, against this kind of threats, there are no computer solutions. The only thing that would work would be the use of armed guards. On the other hand, my method is not vulnerable to trivial attacks that could be done without my knowledge, like the one described in the thread title.
- wkat4242 3y ago
  Sounds like a great option. Would be nice if there was an install wizard that could configure that. Ps I wonder what inconspicuous usb drive you use?
  - adrian_b 3y ago
    I use various Corsair or Kingston USB flash drives, with sturdy fully metallic cases, and which are just a little larger than a USB connector, i.e. they just have an ear that remains outside the connector when inserted, to allow for their extraction. An example: https://media.kingston.com/kingston/key-features/ktc-keyfeatures-usb-dtmc3g2-1-lg.jpg https://media.kingston.com/kingston/key-features/ktc-keyfeat... I have also used MicroSD cards together with a very small USB adapter, which is also only a little greater than the USB connector.

adrian_b 3y ago

The attacks "evil maid" described by a poster above are impossible. Even with physical access, the computer does not have any boot loader or kernel or any other executable that could be altered. The attack described in the thread title also does not work, because the computer cannot boot. Even after booting from their own device, attackers cannot do anything useful. Reading the encrypted SSD will not provide any information and writing it will be detected later. The SSD does not have any non-encrypted sector. Obviously I do not keep the USB key with the computer, especially when the computer is not with me. It is never put in the computer backpack. Of course, if someone would watch me to discover how I start the computer and then they would capture me with all my belongings and then they would do a thorough search they might find the key and they might torture me to get the passphrase. Nevertheless, against this kind of threats, there are no computer solutions. The only thing that would work would be the use of armed guards. On the other hand, my method is not vulnerable to trivial attacks that could be done without my knowledge, like the one described in the thread title.

wkat4242 3y ago
Sounds like a great option. Would be nice if there was an install wizard that could configure that. Ps I wonder what inconspicuous usb drive you use?
- adrian_b 3y ago
  I use various Corsair or Kingston USB flash drives, with sturdy fully metallic cases, and which are just a little larger than a USB connector, i.e. they just have an ear that remains outside the connector when inserted, to allow for their extraction. An example: https://media.kingston.com/kingston/key-features/ktc-keyfeatures-usb-dtmc3g2-1-lg.jpg https://media.kingston.com/kingston/key-features/ktc-keyfeat... I have also used MicroSD cards together with a very small USB adapter, which is also only a little greater than the USB connector.