6 ms·
Functionally, how could anything be better than a static password?
by RockRobotRock 3y ago
Functionally, how could anything be better than a static password?
- Ayesh 3y agoI meant the long static passwords Yubikeys "type" when you touch the button when plugged in. It's just a static long text that has no context.
- RockRobotRock 3y agoSorry, I know what you mean. I'm saying anything like challenge-response would still be a password functionally if you're decrypting a static file.
- wannacboatmovie 3y agoBitLocker and LUKS both support TPM for key storage which VeraCrypt does not. The TPM acts as a second factor (assume PIN is required); if you pulled the disk out and placed it another PC you cannot brute force the plaintext password, even using the $5 wrench method.
- hexfish 3y agoI would be very careful with placing my trust in TPM: https://www.secura.com/blog/tpm-sniffing-attacks-against-non-bitlocker-targets https://www.secura.com/blog/tpm-sniffing-attacks-against-non....
- KAMSPioneer 3y agoYour parent comment said he was assuming a PIN was used to seal the TPM, and the attacking the link would have failed if the TPM had a PIN set, no? I agree though that using a TPM without a PIN gives little in the way of data protection. Not nothing, but little.
- nuker 3y agoSniffing the bus can be defeated by using encrypted comms. It is disabled by Windows for some reason, but it works as designed in other secure boot implementations. I hope :)
- pmontra 3y ago> even using the $5 wrench method I understand the XKCD reference but I don't understand why it does not apply to this case. Does that mean that you can't move your disk to a new machine of yours?
- alias_neo 3y agoBecause if you took the disk, even if you $5-wrenched the pin out of someone, you don't have the TPM hardware to make use of it. As for the second question, I suppose it depends on the implementation; I suspect there is a way to migrate and transfer the keys for the device for the person who already has access to all of the factors. If I use a Yubikey and LUKS for example, I can re-use the Yubikey if I move the disk to another machine. I'm not sure how this would work for integrated TPMs and Bitlocker (I don't use Windows), but I believe they have recovery key-files you could use.
- pmontra 3y agoIf there is no way to transfer the disk to another machine, it's not a disk I want to use. I think that there are very few use cases for losing all the data when a machine dies. And if there is a procedure to let me move the disk to a new machine, somebody can wrench me until I perform that procedure for them.
- dwattttt 3y agoFor Bitlocker (and I imagine other tools which support TPM keying), a recovery password is generated in addition to the TPM unlock key. If the motherboard goes kaput you dig out the long key to unlock it, assuming you kept it somewhere safe (speaking as someone who has had to dig through a pile of old USBs to get access back to a disk).
- robertlagrant 3y agoSounds as though this is where the $5 wrench would work just fine.
- EVa5I7bHFq9mnYK 3y agodoes that mean if morherboard goes kaput, so does all my data? I have 7 layers of backup, but still interesting to know.
- wannacboatmovie 3y agoNo, it typically generates a recovery key which you can keep offline (or discard and live dangerously).
- EVa5I7bHFq9mnYK 3y agook, so the $5 wrench method can be used to extract the recovery key.
- taway1237 3y agoYou typically print it and store it in a safe place (like your home cabinet). It's something like 256bit random number, no way to recall it, especially while being subjected to the $5 wrench method.
- EVa5I7bHFq9mnYK 3y agoNo need to recall 256 bits, just which cabinet.