Hacker News Reader

Hacker News

Comment by viraptor | Hacker News Reader

Parent Full thread

viraptor

> once i have access to the computer the keys are somewhat free to use

Once you have access and either root or pass whatever extra authentication the access requires.

> storing the key encrypted on a drive where its only accessible using a passphrase

The extra failure mode here is that someone can copy the key and crack your password offline on their own time.

> using something that was touched and left a mark and some glue.

At that point a camera catching your password should also be a potential threat. But yeah, if that's something you're realistically worried about then it's not a great solution for you.

View on HN

> Once you have access and either root or pass whatever extra authentication the access requires.

How hard would it be to boot a signed kernel with a system ready to give you all the access you want or need?

> The extra failure mode here is that someone can copy the key and crack your password offline on their own time.

but what i was arguing about was once i could copy your encrypted key i could likely use it right away with TPM.

> At that point a camera catching your password should also be a potential threat. But yeah, if that's something you're realistically worried about then it's not a great solution for you.

i feel like everybody should be seeing this as a threat. Don't you look out for someone snooping on your typing when you enter passphrases? i certainly do and avoid it while being watched, especially in public places where cameras are more likely.

> How hard would it be to boot a signed kernel with a system ready to give you all the access you want or need?

Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot).

> once i could copy your encrypted key i could likely use it right away with TPM

You cannot copy the key once it's moved into the TPM chip.

> Don't you look out for someone snooping on your typing when you enter passphrases?

No. I'm not secure from targeted snooping anyway, but I'm not typing any non-local passwords usable by people reviewing old camera footage - in most cases access is being 2fa.

> Depends on the config. From trivial (old BIOS, no protection) to ~impossible (locked uefi doing secure boot).

so locked means i can not boot any other system until its unlocked? How do i do this? is there another passphrase involved? do i have to reset the chip before anything else is booted? i am probably not that well informed on this topic.

> You cannot copy the key once it's moved into the TPM chip.

obviously not! but i can just use it right away without figuring out your password. That is assuming i can fool the system to trust me. It requires the same level of access but in case of the passphrase i am blocked until i solved this. If i use your key immediately to ensure my own keys are trusted i am already done.

> so locked means i can not boot any other system until its unlocked?

https://linuxhint.com/secure-boot-linux/ / https://wiki.ubuntu.com/UEFI/SecureBoot

UEFI with your own keys in TPM (same tech involved) allows you to run only your signed bootloader and kernel. So no external media, replacing the disk, or tricks like init=/bin/sh will work. You can only boot into the signed system. From there you have the usual user account controls.

Reply on news.ycombinator.com