Terrorism arises in defense to oppression.

Technical point: that isn’t exhaustively true. Terrorism can be, and sometimes is, committed against vulnerable parties by more privileged ones.

Progress report 1

• I’m ruling out HMAC-SHA1, because:
  • Plain vanilla HMAC-SHA1 uses a shared secret. I don’t want the PC to have a copy of the credential. It may also be susceptible to MITM/relay attacks.
  • Rolling-code HMAC-SHA1 only partially solves the problems of ordinary HMAC-SHA1.
  • Encrypted rolling code HMAC-SHA1 solves those problems, but I haven’t found a reliable source for using it with LUKS.
• If using systemd, pick FIDO2:
  • It avoids the flaws of HMAC-SHA1.
  • It’s supported natively in systemd so should be “future-proof”.
  • It’s a more widely-supported standard, than OpenPGP, with more HST vendors to choose from, including cheaper options than NitroKey or Yubikey. This could be useful in environments where each sysadmin (or colleague! or family member!) needs an HST.
  • It’s compatible with QubesOS.
• Otherwise, OpenPGP:
  • Like FIDO2, it solves the HMAC-SHA1 flaws.
  • However:
    • smartcard-key-luks seems to be unmainted both on GitHub and on GitLab.
    • Unlocking LUKS with OpenPGP isn’t well-documented for non-Debian-based distros.
• TBD: Clevis/Tang:
  • Permits remote/network-based unlocking.

Thank you for this! That thread is helpful in itself, and also links to other relevant resources - including by Lennart Poettering (controversial guy, but the canonical source on systemd).

ChromeOS uses a Linux kernel, so one could say desktop Linux usage is >12%.

A young 'un! Macintosh, surely.

their setup required a couple large antennas that the victim would need to stand in between. Not impossible, but you’d notice with each side being half a meter away.

So yes, it’s a technical risk, but not one that I’d bother putting much effort into avoiding. And the being able to use the key via NFC is probably worth the risk.

This was my conclusion, too, but I didn’t want to prejudice the discussion. Thanks for corroborating.

IMO, using a Faraday pouch isn’t “much effort”, and is therefore worth doing if the HST is being carried in unfamiliar/non-secure locations.

OS X (obsolete & unsupported since 2018) has more users than macOS?!

Also, where did you get those stats? https://gs.statcounter.com/os-market-share/all/north-america has different numbers to yours.

Link to stats: https://gs.statcounter.com/os-market-share/desktop/north-america

Interesting point. Would realistic human-edited (“Photoshopped”) content have to be labelled? That could be a good thing!

(Might cause embarrassment for fashion magazines unless they stop doing it.)

Even if you can [exploit NFC] at 1m, thats close enough that it can just be stolen from you.

Stealing the HST should not give the user a false sense of security. Not so dangerous.

Silently exfiltrating the private key (or data for a replay attack), OTOH, would leave the user with a false sense of security. Dangerous.

your link to rfidgate appears broken

Wfm. Here’s an archive link.

Thanks! I didn’t know they were normally made of composites.

Looks like there are some ways (1, 2) to reuse/recycle the latter, but I agree wood would be better for this.

Aren’t turbine blades usually aluminium? How is wood more “recyclable” than that?

This coverage has a better headline: Trump blames Minnesota governor for cyberattacks against the state. Cites no evidence.

Funding restrictions and denialism, plus starting a war against a cyberattack-capable nation, made infrastructure attacks inevitable.

Security researchers have been publicly raising the alarm about SCADA vulnerabilities for 20+ years.

If it’s a server for self hosting you definitely don’t want anything that requires interaction at boot.

Depends on use-case. If you only plan to boot it when you’re physically present, it’s fine.

i believe a much better secure layer is something similar to what Novacustoms, Purism attempt to do: verify if somebody else not you try to access the laptop.

You’re thinking of Heads, which I agree is ideal for supported motherboards.

tang

Thanks. TIL about Clevis/Tang.

I can only see three ways to get FOSS firmware on your printer:

1. If someone reverse engineers the firmware to create a FOSS version.
2. If the Software Freedom Conservancy, who recently raised funds to tackle Bambu Labs’s license violations, finds a violation in BL firmware and succeeds in legally compelling BL to release the corresponding source code.
3. If you sell your BL printer and replace it with one that already has FOSS firmware.

I read them before writing my OP. I’m still not sure what you’re getting at.

I would be grateful if you could say what you mean, instead of initiating an oblique guessing game.

Yes. Here are some common self-hosting scenarios:

• Home server containing family files: scans, photos, device backups, …
• Office server containing business files: sensitive documents, device backups, …
• Web or email server containing websites, Fediverse instances, emails, etc

In all those cases, full disk encryption (FDE) is a sensible precaution to protect the data in case the server is physically stolen.

Linux is probably the most common OS kernel for self-hosting. On Linux, LUKS (Linux Unified Key Setup) is probably the best FDE system. It’s mature and reliable. But anyone self-hosting a Linux server with LUKS FDE is faced with the question of where to store the keys.

Hardware security tokens (HSTs) are widely considered a safer place for keys than SSDs, HDDs, or USB storage. They follow the smartcard principle: a private key can be written to an HST but not read from it (security vulnerabilities excepted). Instead, they implement cryptographic algorithms to prove possession of the private key. So, anyone self-hosting a Linux server with LUKS FDE should strongly consider storing their private key(s) on an HST.

However, there is more than one way to do that. Hence the question in my OP.

I agree about needing a backup hardware token (or paper recovery key) to restore access if the primary hardware token is lost or broken.

Also agree about requiring a passphrase.

Any specific recommendations on protocol or setup steps?

Which of the 4 recipes I posted are you referring to as “this”?