3 ms·

I love this idea but I'd be worried that I would lose something that small. OK the filesystem is encrypted but there are going to be private keys and other sens

I love this idea but I'd be worried that I would lose something that small. OK the filesystem is encrypted but there are going to be private keys and other sensitive data on there which I really don't want to give someone unlimited time to crack... I don't carry sensitive data around every day on a regular usb stick either. Not to mention you're going to freak out a lot of laypeople when you reboot their computer and it comes back up in Hackerman mode. Though if you could get it to play West Side Lane after it booted up then yeah this would be totally worth it.

James_K 3y ago
This is such an odd thing to be worried about. Do you really think there are people who go around looking for random USBs on the floor hoping that they contain sensitive data? Unless someone is specifically following you around and looking for this, I doubt they would bother. I also think anyone smart enough to crack the encryption on that thing is probably also smart enough not to plug random USBs into their computer.
prmoustache 3y ago
It is not much different than losing your smartphone or having it stolen.
GTP 3y ago
If you don't trust encryption, I'm honestly curious to hear how you handle your sensitive data. My own opinion is that you're being too paranoid, but it would be interesting to hear back from you.
- safety1st 3y ago
  I trust encryption, but I don't necessarily trust myself to configure everything correctly. I am aware of how complex the topic is and could imagine myself for example having a password on something which could be brute forced if my password wasn't strong enough plus the default lockout period for incorrect attempts was too short... or some other scenario I as a non-expert might not anticipate. In addition to encryption there's a physical access component to how a lot of my secrets are stored, no way I would ever transfer them to a phone for example. Some necessary context for this is that I own a small business and it's not large enough to afford a dedicated person or people setting IT policy, but it's large enough that an attacker would have plenty of motivation to go the extra mile in terms of say doing some social engineering to drain our bank account. Maybe the productive line of thinking here is, there is a set of secrets that does need a really high level of paranoia, but most of them don't and those would be OK sitting encrypted on a phone or USB stick. But it's easy to go down the rabbit hole and say if they get access to X and Y pieces of info can they call someone and get a password reset... etc.
  - GTP 3y ago
    I understand your concern. I would just add that, if the main concern for you would be someone finding such a USB key with encrypted private keys and be willing to use a long time to recover them, that's not really an issue: you only need the encryption to be strong enough for you to notice that you lost the USB key and rotate the keys, if such an adversary needs even just a couple days to perform its attack, you still got enough time IMO.
    - safety1st 3y ago
      Good point thanks!
      - GTP 3y ago
        You're welcome

James_K 3y ago

This is such an odd thing to be worried about. Do you really think there are people who go around looking for random USBs on the floor hoping that they contain sensitive data? Unless someone is specifically following you around and looking for this, I doubt they would bother. I also think anyone smart enough to crack the encryption on that thing is probably also smart enough not to plug random USBs into their computer.

prmoustache 3y ago

It is not much different than losing your smartphone or having it stolen.

GTP 3y ago

If you don't trust encryption, I'm honestly curious to hear how you handle your sensitive data. My own opinion is that you're being too paranoid, but it would be interesting to hear back from you.

safety1st 3y ago
I trust encryption, but I don't necessarily trust myself to configure everything correctly. I am aware of how complex the topic is and could imagine myself for example having a password on something which could be brute forced if my password wasn't strong enough plus the default lockout period for incorrect attempts was too short... or some other scenario I as a non-expert might not anticipate. In addition to encryption there's a physical access component to how a lot of my secrets are stored, no way I would ever transfer them to a phone for example. Some necessary context for this is that I own a small business and it's not large enough to afford a dedicated person or people setting IT policy, but it's large enough that an attacker would have plenty of motivation to go the extra mile in terms of say doing some social engineering to drain our bank account. Maybe the productive line of thinking here is, there is a set of secrets that does need a really high level of paranoia, but most of them don't and those would be OK sitting encrypted on a phone or USB stick. But it's easy to go down the rabbit hole and say if they get access to X and Y pieces of info can they call someone and get a password reset... etc.
- GTP 3y ago
  I understand your concern. I would just add that, if the main concern for you would be someone finding such a USB key with encrypted private keys and be willing to use a long time to recover them, that's not really an issue: you only need the encryption to be strong enough for you to notice that you lost the USB key and rotate the keys, if such an adversary needs even just a couple days to perform its attack, you still got enough time IMO.
  - safety1st 3y ago
    Good point thanks!
    - GTP 3y ago
      You're welcome