3 ms·
> I can use those static passwords as an encryption key, but I'd need something better. I use static password plus a keyfile. Since the keyfile can be anything
by aeyes 3y ago
> I can use those static passwords as an encryption key, but I'd need something better.
I use static password plus a keyfile. Since the keyfile can be anything you can use something innocent looking which you just have laying around on the machine, like a picture.
- sangnoir 3y ago> you can use something innocent looking which you just have laying around on the machine, like a picture. This works well on a file you decrypt often. What can happen with infrequently used files is that many years pass, you upgrade computers and/or operating systems, remember to copy your encrypted volumes. When you try to decrypt your volume, you remember the passcode, but forget which "innocuous" file you used as a keyfile, even after you boot up your old computer you had handed down to your cousin.
- aeyes 3y agoWell, the same happens to me with passwords which I don't use for a long time. You can use any file, even something you can quickly download from the Internet. Like the Windows 3.11 file manager icon or your favorite Linux torrent. Only the first 1024 bytes are used so be careful with file types which have a big header.
- somat 3y agoIf you can make a key file You can put it on a removable sd card and make a keydrive. This introduces a nice air gap to the key, only needing to be broken when unlocking the drive. There are better ways, often the the key can be stored on a hardware token(yubi key etc... ). which presumably offers additional security guarantees around copying the key. but a keydrive is a very easy way to start. Off tangent(I doubt you will be using openbsd), but the openbsd encryption layer offers some nice features around using keydrives, http://www.openbsd.org/faq/faq14.html#softraidFDE http://www.openbsd.org/faq/faq14.html#softraidFDE