How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security
blog.lessonslearned.org
blog.lessonslearned.org
verified boot seems like the only advantage here. You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily, and they don't require reliance on Google or the requirement that one uses a neutered OS. (yes, yes, it's secure. It's a users' platform. Development on chrome OS at this point is an act of masochism.)
If secure travel is your thing, stash your data on a cloud provider and pull it later after you arrive at your destination. Go whole-hog and travel without an SSD and buy a cheap one at your destination with cash. Sprinkle in some libreboot for more confidence.
It'll still be cheaper than a 200 dollar chromebook, and you probably won't have to deal with some of the worlds' worst chicklet keyboards.
P.S. don't travel with a yubikey that isn't partnered with another. Would be a bummer to lose.
That's why the author has you setup a new account so that you can segment your burner data from your real life.
Thank you for your help.
ThinkPad caddys are dirt cheap. You can buy third party compatible caddys for under $10. [0]
In terms of a laptop with a reasonable build quality that includes a TPM, pretty much any corporate laptop will suffice. X220's command a premium because they're ThinkPads.
If you look at other options, something like the Dell E6220, which is from the same generation as the X220, can be purchased used for around $100. [1]
They don't support coreboot, but they're otherwise reliable machines. The Dell UEFI implementation supports only allowing signed updates and SecureBoot. Depending on your threat model this might be enough for you.
> You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily
You'll have to buy something older than the E6220 mentioned above, but the Dell E6400 is available for $40. [2] That will have an integrated TPM.
[0] http://www.ebay.com/itm/Lenovo-Thinkpad-X220-X220i-Hard-Driv...
[1] http://www.ebay.com/itm/Dell-Latitude-E6220-13-3-Intel-Core-...
[2] http://www.ebay.com/itm/Dell-Latitude-E6400-Laptop-Core-2-Du...
They are old, but they are well equipped and I love their keyboard feel, plus TPM and all that jazz.
Their specs are pretty low-end nowadays, but I find that devs have too varied a range of preferences and tasks to judge what they need too readily.
If you're sitting in a huge IDE or photoshop or otherwise have a strong need for heavy lifting and high resolution during your travels, however, these cheapy business-grade laptops from yesteryear are probably a poor choice.
But I sit in emacs and IRC most of the time with music on -- they are perfect for that.
Get a dealer account and you get 20-40% off the listed prices. I applied and got the account in about a week or two.
"Grade A" refurbs are in really good shape.
Cheapest X220 (Grade A) right now is $153.60 ($192.00 list).
Additionally, once Developer Mode is enabled, you must hit Ctrl+D to move past the warning screen every time. It is incredibly easy to inadvertently hit Enter or Spacebar, and then have the Chromebook wipe itself and restore to factory settings. I've done it inadvertently myself, and have heard multiple reports of a developer's spouse/child accidentally clicking it, too. Unless a Border Patrol agent knew exactly what they were doing, I'd be willing to bet they'd accidentally wipe it as well.
Finally, while I'm aware that disabling Secure Boot in theory opens you up to an Evil Maid attack, what is the likelihood that border patrol/customs would have a malicious OS on hand, and the know-how to flash it? Worst -case scenario, if you suspect they've tampered with the OS, simply hit Spacebar yourself as soon as you get it back, restore Secure Boot, and then start over from scratch!
As an aside, if you are confined to ChromeOS, I highly recommend Caret as an editor. It's a FOSS, Sublime clone chrome app that works swimmingly on Chromebooks.
So an inadvertent wipe is really just an inconvenience of 30-60 minutes, and if it's a border patrol or TSA agent you can then have fun acting all indignant at how they broke your device and you lost so much work and your boss is gonna kill you and you want to talk to their supervisor right now.
The lack of hardware security is a consideration, but frankly if your device is handled by a malicious actor outside of your control, you're kinda screwed anyways.
This protection is not just against "evil maids" but any attack that modified the disk in the past. E.g., if the system is compromisd due to a software fault, nothing can persist on disk undetected (like ZFS/bcachefs/BtrFS checksummi preventa bit-rot from being undetected)
In doesn't show up in Chrome Extensions search as easily as I would hope.
Yes, they work.
No, they don't capture shortcuts like 'ctrl+W' which are handled by ChromeOS.
Installing a chroot isn't that difficult, in fact it was actually kind of fun and started me on an incredible tech exploration journey that currently has me learning software development using Vim on a command line only linux distribution. I never would have imagined such a thing a year ago. It is weird thinking having a $140 refurbished acer c720 may have led me on a completely different, exciting life path.
I mentioned above that I think Caret is a great Sublime clone, but I also like having the real SublimeText, with its awesome add-on packages, Git integration, etc. The article's recommendation that you must stick with Android-enabled Chromebooks limits your options, and the only reason the recommendation exists is that he needs some way of getting access to the developer tools--gcc, etc. A crouton chroot gets you there the same way, and I'd argue it's better since the programs are running natively rather than through an emulated Android layer.
Maybe a separate Linux install such as GalliumOS can really be called full access Linux environment?
Been a few years since I used a chromebook w/crouton, but that wasn't my recollection. In fact I recall a fork of crouton that supported Fedora explicitly stating that it installs via docker.
It may not be as secure, but it's hella convenient (still use 2FA). ChromeOS boot is < 5 seconds, and I just stay there for web browsing / netflix. Dropping into crouton is another < 5s when I need to do dev work, or play steam games.
Everything important on the laptop is backed up to some cloud service or another, but it's expensive enough that I'd be distraught if I lost it (plus they stopped selling them).
I'd be more worried about somebody straight up stealing the laptop than any other security risks I may be running by running in dev mode.
I love the idea of natively developing in ChromeOS, but at this point it just seems like more hassle and fighting the system than it's worth.
Instead, I just have my Chromebook and a VPC on Google Cloud that I SSH into for work. Theoretically I wouldn't be able to work if I didn't have internet access, but I've never actually run into that problem. I still have dev mode off, but I don't think turning it on is a huge risk.
Steam games though? I didn't know you could do that.
[0]: https://gist.github.com/christianbundy/ba62890a7c2f8128bcbb
Re: Steam games, yup it's powerful enough to run most indie games that support linux (which is an increasing number, recently). The biggest constraints are GPU and disk space. I've had a few good runs of FTL (Faster than Light) on long-haul flights.
You just gotta make sure you keep an eye on the battery, since if it dies you accidentally wipe the system :/
> It's pretty neat to consider the possibility of pre-travel "power washing" (resetting everything clean to factory settings) on an inexpensive Chromebook and later securely restore over the air once at my destination. ... the engineering challenge here was to find something powerful enough to comfortably use exclusively for several days of coding, writing, and presenting, but also cheap enough that should it get lost/stolen/damaged, I wouldn't lose too much sleep. ... I could treat it as a burner and move on.
Edit; I've been using a de-chromed chromebook for over a year as my primary dev machine and really like it. I developed and launched one side project with it. The model I have (Acer C720) is a dual core Centrino, 2GB of ram, and I upgraded the m2 sata to 120GB. For Python/PHP/Ruby, it's great. I would not do Java development on this set up though. Java IDEs eat battery life and I imagine jvm startup time is a burden on this, although I haven't even installed Java to find out.
Edit 2: to clarify, this is not about removing chromeos, but to use chromeos for it's security features. The article goes over using Termux to get a basic development/work environment setup on chromeos. Plus a lot other helpful tips.
I offered my experience de-chroming as an example, I really like the platform. Apologies if that was confusing.
Ok, but as the article states, they did not de-ChromeOS it because they wanted TPM and Verified Boot and FIDO-certified U2F security key so that they didn't defeat the whole purpose of buying a Chromebook.
FTA: “As far as Debian/Ubuntu (and crouton), that's fine as far as it goes, but then you don't end up with a Chromebook, just a cheap mini-notebook with flaky drivers. The whole point of this exercise is to retain the hardened posture of the platform and have a flexible, safe development environment without depending on the crutch of privileged access.”
https://github.com/Yubico/libu2f-host/blob/master/70-u2f.rul...
> I've come to fully appreciate Google's Chrome OS design. The architecture benefited from a modern view of threat modeling and real-world attacks.
This linked in the article explains what he means https://www.chromium.org/chromium-os/chromiumos-design-docs/....
We all know you can put Chromebooks into dev mode and load Ubuntu, in fact I thought it was necessary to get the most out of Chromebooks. If it turns out that Chromebooks can make decent dev environments without nuking and installing Ubuntu or whatever and if they can run Android apps then Chromebook suddenly become a very interesting value proposition.
How is this not "you won't catch me, I'll just throw myself off a bridge"?
Also, termux has ~600 packages. Debian has 50,000. Besides the basics, you're liable to need packages you just don't have in termux, which makes it a serviceable environment in a pinch, but not one where you want to do your work on.
I hear ya. But he was fairly particularly and upfront about his scope.
how are people willing to live with this? I would be furious if I had to lose all my state and (for all intents and purposes) restart my machine multiple times in two weeks.
And if this "borking" happens right before or during a presentation (the author was writing about using this setup for giving talks on), this would be very embarassing for me and extremely annoying for the audience.
A work/presentaion machine has to be rock solid for me. No compromises, no workarounds and most certainly no "completely borked". Just pure solid.
In one case it was a hard kill and I lost one ssh window that had been open for a week. In the other, the Termux gui came up and I never dropped my session (the ssh process never died). I'm not yet familiar enough with the Termux internals to understand that. As far as the Chrome OS stability, it's been one of the most stable machines I own, and I say that as a long-time MBP & Librem owner. 99% of the reboots were intentional as I reinstalled the whole build from Powerwash to Erlang hello world, to make sure I got the details right for the post (and to help troubleshoot some minor install roadbumps a couple of my reviewers experienced).
On the presentations, I joined multiple Hangouts & BlueJeans (WebRTC) video client calls with zero trouble. Signal and Wire voice worked like a champ too.
So while I certainly understand some of the comments here, for _my_ use case — a reliable $160 multi-week travel/burner dev notebook with strong security, I'm more than satisfied. And of course it's not in the same league as my $2K++ MBP. I would never try to run a big JDK app, but for offline Go and Python work, it fits my bill.
I've them crash once every few years after I'm done setting them up, usually it goes down because I run out of power or want to update the kernel. There's no good reason some GUI should die because of waking up from sleep.
Does that actually exist?
I've got three machines that I use regularly.
1) Mid-2010 MacBook Pro, with RAM and SSD upgrades. This is my main machine at home. It has never had to be wiped and reinstalled, and it gets rebooted about once a month.
2) Late-2013 MacBook Pro. This is my work machine and the story is similar to my home machine. It's never needed a reinstall and gets rebooted about once a month as well.
3) Lenovo ThinkPad x131e (Intel). This is my travel computer, serving a similar purpose as the Chromebook mentioned in this article (minus presenting stuff). I'm running OpenSUSE Tumbleweed on this - frequent updates lead to frequent reboots. There's also all the associated weirdness that comes with running a rolling release Linux on a machine that requires proprietary WiFi drivers (they tend to lag by a couple of days). When I ran OpenSUSE Leap it was almost as solid as the Macs.
I'd call the Macs "pure solid" machines, or as close as I can reasonably get. The ThinkPad is decent and the weirdness with it is really my fault.
Like everything else, your experience may vary.
Despite using Arch Linux, and weekly "upgrade everything".
I know it isn't everyone's experience, but I was exceedingly choosey about the hardware that went into my machine, so that I could do this.
The only problem I've had in the last two years, was an incompatibility between ocaml and fish shell, which eliminated my PATH. Unfortunate, but an issue on the ocaml side of things. A big problem, for certain, but two years of bleeding edge updates, and that's it.
But it ever does, I'll probably adopt and adapt one of the solutions from this thread [0].
[0] https://www.reddit.com/r/archlinux/comments/4zrsc3/keep_your...
Fun story: for $REASONS, I have an Arch system with root on btrfs and /boot on ext4, and it doesn't usually have the boot partition mounted (it's a poorly done mutiboot issue). I recently discovered that this means if I forget to mount boot before updating I get stuck with no loaded drivers to mount /boot :) Thankfully kexec worked, but I'd like to not need to do that:)
That said, multiple times a week is very silly. Once a month would probably top out my personal tolerance for similar bugs.
Over the years I have given quite a few presentations to customers and at public talks. None of my machines ever let me down.
Alas, they also have price tags more on par with a Macbook.
You do realize the Dell XPS 13 has QHD as an option?
[1]: https://en.wikipedia.org/wiki/Graphics_display_resolution#QH...
I use dell xps 13 for half a year and I have 3200x1800 resolution. When buying a xps you have two screens to choose from.
AFAICT the reason than even expensive 11" laptops generally don't run higher resolutions is that at that size you can't tell the difference.
Back then, if a Chromebook's local storage filled up, it would factory-reset itself. Is this still the case? This is one big thing keeping me from trying this again (which I'm very tempted to do so after reading this article). Investing in setting up a dev environment like this is fun, but only the first time around...
It is so close to being usable. It is such a user friendly operating system, it just falls short on a few significant fronts.
1. Developer mode should be friendlier to use (no horrible noises on boot, no delayed boot time).
2. It needs support for electron-based/alike apps to run natively in browser windows without crouton. E.g. vscode.
I've seen Google Authenticator do this (for Google accounts), or the Blizzard Authenticator. I would guess that Duo has a product for this.
I still think it's a second factor. Only a third party might have access to the factor too, like SMS codes/3DSecure.
Its true that push2factor have some disadvantages, but it has one really strong advantage above pure TOTP: phishing dosnt work as the 2factor is send directly to the site and cant be mitmed at your terminal. Read about it.
I'm using it to poke at languages I'd normally never have the time to experiment with.
I'm on the train for about an hour every day, and I wouldn't feel comfortable with a "real" laptop - too likely to be stolen. But for $169? Not such a big loss.
I'm also really excited about how rock-solid this thing is, as a way to hand a kid a computer that can really teach them programming.
I got a Lenovo 14" IdeaPad N42-20 and desktop to replace my 256gb MacBook Pro.
It turned out to be a bad idea, mostly because the screen is terrible. It's the same resolution as the Samsung 3 mentioned in the article.
It also seems so small compared to a 15". Side-by-side windows isn't very nice, either.
I find myself working less because I don't feel like sitting at my desk or using the Chromebook.
I'm planning on buying a MacBook pro again but I'll keep my Chromebook for something I can use haphazardly.
Termux is really useful, giving you an almost complete linux environment in Android phones and tablets. You can install it via Google Play, no need for root or any modification to your device. Add an external keyboard and you can work on the go.
There are some good web ones (Cloud9) out there and even a few Android based ones (AIDE). You won't be running any Windows or Linux IDEs though (because Chrome OS is not either of those.)
One potential solution is a USB hub, or even a USB extension cable you keep plugged in.
Well, it's possible to temporarily unlock firmware write protection and replace Google key with your own and run self-signed kernels and arbitrary distribution securely. But indeed, I haven't heard of anyone actually going through the effort to do so.
What threat does the chromebook protect against that isn't fixed by FDE?
Chromebooks use kernel signing to prevent this. The problem is, Google doesn't give you keys to your hardware so you have to replace them yourself or use devmode which disables kernel verification.
Another possible solution is to keep the kernel on an external, physically secured pendrive and never forget to press CTRL-U during boot (to stop a hypothetical attack involving a malicious kernel installed to the internal flash which exfiltrates your FDE passphrase or something like that).
1. If I change my plans I have to go back home or go to my original destination to pick up a key to decrypt 2. I might get there before my yubikey arrives 3. An adversary might look at my machine, and know there is data on there (in the chrome book case it just looks like a new machine), they could then detain me indefinitely or travel with me to my destination and force me to decrypt
So it's not practical for casual use IMO
If it comes to the point where the police gets involved, no level of crypto is going to help you anyway. You'd better try to contact your country's embassy so they can get you out.
Works the same as my $18 Yubi key but the little cover over the USB prongs keeps falling off...
Hmm, I'm not sure about that. I went the Crouton route on my $169 Chromebook, and now I have both ChromeOS and Ubuntu. Plus I can switch between them quickly. And if I understand Crouton, the chroot is actually using the same kernel and drivers as ChromeOS. I haven't had any driver issues. And it's easy to set up encryption for your chroot. I think it's a good solution.
- persistent state is discouraged, but not disallowed. in fact, when the browser is exploited, any/all internal state necessarily must be be accessable and modifiable. i'm taking an educated guess that persistent browser internal state is less guarded against exploitation than external inputs.
- once pwned, most of your important data can probably be captured and accounts taken over before you ever decide to reboot. it's a PITA to have to reboot before accessing anything sensitive; no one should have to think/remember to do that. (maybe if chromeos were serious about preventing persistent threats, they'd force a reboot every night?)
- yes, it's defense-in-depth, but security is a game of trade-offs, where convenience often trumps technical security mechanisms in terms of increasing security overall.
I enable dev mode, but I appreciate the "stateless" sentiment in terms of encouraging data backup. i think I end up backing up my data (git push, etc.) more often than I would on a non-chromeos laptop, because it "feels" like more a necessity; especially after my 2 yr-old son hit the spacebar during that god-awful dev-mode bootup warning screen, and proceeded to factory-reset my chromebook.
I had computers that failed before, and usually I could manage to repair them somehow, most often by using a linux liveUSB, but with this chromebook, I've tried many things but I could not do anything. No access to BIOS, not bootable USB, nothing. Complete black box.
So I'm not sure I'll buy an other chromebook anytime soon.
Why not get a used MacBook Air off Ebay for ~$400? Top notch OS, great support, sturdy design, great battery life...
I get that people have nebulous concerns about Google's privacy policy, but he mentions specifically at the beginning of the article that he was interested in the ChromeOS security model. There are very few systems that have a model that matches that for the threats they consider most problematic.
I would love it if Android apps could somehow replicate the dev tools of a standard full-featured OS one day. I'm definitely a fan of ChromeOS.
2) I think he was willing to do so because he knew not everyone has money to burn.
3) At the price point he settled on he could treat a loss as a burner. And $200 and you might not be as forgiving about a loss.
I worked with Google to port it to ChromeOS when ChromeOS grew certificate provider support.
It was super hackable and most people bought it installed hackintosh on it and with a near perfect hardware compatibility with OS X Snow Leopard. A few friends of mine went to Africa for a few months with Dell Mini 9 and were able to freelance their with a fully functional yet super affordable hackintosh Mac. I wish Dell can have another of those netbook lines with compatible hardwares.
[1] https://en.wikipedia.org/wiki/Dell_Inspiron_Mini_Series#9_Se...
He's suggesting they are secretly filming you, logging your keystrokes, and rerouting your mic audio. That is a very bold claim that should be backed up or retracted.
Can't imagine what recording webcams would do- but I suppose it might be effective for something.
Because there's no actual evidence to support it.
I would love and probably use Chrome OS as main device if it looked like this: https://i.stack.imgur.com/9MCqo.png
I ended up liking the "Caret" editor - it's a Chrome App.
Even if you aren't worried about state level inspection, this setup allows you to put the laptop in your checked baggage and not worry that your data has been intercepted by criminal enterprises in the case of rerouted bags or theft. This is a big boon for many business travelers as they are more worried about IP protection than privacy from governmental interlopers.
gcc is out. you have to install clang, but that doesn't work for everything.
I lost my key a couple of weeks ago and was surprised how easy it was to get back into my accounts with just my phone. There is no point in using something like that if providers allow you to failover to more conventional authentication methods without any hassle; the keys are useless. They are not going to add manual verification for a couple of people who lost their YubiKey.
YubiKey is useful for instances when you want to grant somebody access to something with just a key. I don't see it going beyond that anytime soon.
https://lastpass.com/support.php?cmd=showfaq&id=2546
Even for providers that do provide seamless failover, the inevitable "we see you requested an account recovery" email would serve as useful canary to know you're being targeted.
That was the whole point of my comment. It is up to the vendor and vendors do a horrible job.
> the inevitable "we see you requested an account recovery" email would serve as useful canary
There is nothing useful here. They are allowing you to bypass a secure key with a dumb email confirmation.
Your idea of a 'useful canary' is great; until you get rooted at 5 AM on a Monday morning and that email disappears before you wake up.
Anecdotally, someone got my steam account credentials. I discovered this when they tried to change my password. Fortunately I had Steam's two-factor enabled and got the notification (2-factor is required to change steam account passwords), which alerted me to change my password. They actually tried the account recovery option and I got an email notification about that as well.
So in situations like that such notifications can be quite useful. But yeah, if they've compromised your most critical accounts/devices then YubiKey isn't going to save you. I don't think that's a knock against it.
Regarding your questions, yes it is running linux as Chrome OS is based on Gentoo. But it is not running any traditional linux distro. In order to provide a linux/unix environment, the author installs termux. But this app is for command line programs. The quake screenshot has nothing to do with termux, it was installed from the Play store. Therefore I'd say it's not possible to run Steam on it.