𝒍𝒆𝒎𝒂𝒏𝒏

Hey! Please contact me at my primary Fedi account: @lemann@lemmy.dbzer0.com

https://lemmy.one/u/lemann@lemmy.dbzer0.com

  • 2 Posts
  • 35 Comments
Joined 2 years ago
cake
Cake day: June 6th, 2023

help-circle


  • Flash drive hidden under the carpet and connected via a USB extension, holding the decryption keys - threat model is a robber making off with the hard drives and gear, where the data just needs to be useless or inaccessible to others.

    There’s a script in the initramfs which looks for the flash drive, and passes the decryption key on it to cryptsetup, which then kicks off the rest of the boot mounting the filesystems underneath the luks

    I could technically remove the flash drive after boot as the system is on a UPS, but I like the ability to reboot remotely without too much hassle.

    What I’d like to do in future would be to implement something more robust with a hardware device requiring 2FA. I’m not familiar with low level hardware security at all though, so the current setup will do fine for the time being!






  • Really like this!

    Only one additional thing that came to mind - get a phone with lots of storage! My two previous Android devices died as a result of EMMC failure, and they had a pretty small onboard capacity (16GB, and 32GB)… my current device is 64GB and I now keep most of my data on a 512GB sd card.

    Lots of empty storage space allows the EMMC firmware to perform wear levelling as needed, prolonging the life of this non-replaceable component. Most well-designed Android devices also run a “TRIM” on the internal EMMC storage when the device is idle, a kind of self-maintenance procedure that allows the firmware to keep track of how much space is unoccupied.

    For Android users who are curious about the details (or have rooted devices and want to run a trim manually) see here