Authenticated Boot and Disk Encryption on Linux

Re:Authenticated Boot and Disk Encryption on Linux by LeifCarrotson on Thursday September 23, 2021 @08:52AM (#28628391)

This or the 'glitter nail-polish' pseudo-holographic identifiers both ignore that if you have a physically identical laptop save cosmetics, you can swap in the motherboard and hard disk from the replacement unit. Externally, it's identical, internally it's all compromised.

[ Parent | on HN ]

Re:Authenticated Boot and Disk Encryption on Linux by dane-pgp on Thursday September 23, 2021 @11:19AM (#28630445)

Presumably the laptop could be designed such that opening the case would separate some contacts in a circuit, which in turn would clear some important secret value from memory.

If you have a separate authentication device, it could warn you that this had happened, to prevent the attack of someone opening the case to add a circuit which broadcasts your key presses, for example.

This still only reduces the problem from keeping your laptop with you at all times to keeping your authentication device with you at all times, though.

[ Parent | on HN ]

Re:Authenticated Boot and Disk Encryption on Linux by fomine3 on Thursday September 23, 2021 @10:31PM (#28638006)

I believe this is what TPM lock solves, but possibly not perfect.

[ Parent | on HN ]

Re:Authenticated Boot and Disk Encryption on Linux by miloignis on Thursday September 23, 2021 @11:19AM (#28630444)

If you put the nail polish on the screws or seams, you could make it where you couldn't take apart the laptop to replace the motherboard without damaging them, right?

[ Parent | on HN ]

Re:Authenticated Boot and Disk Encryption on Linux by KingMachiavelli on Friday September 24, 2021 @07:08AM (#28640848)

If we fixed everything else then this wouldn't be hard to solve.

Have the machine generate a TOTP which you compare to the same code generated on a phone/second device.

To prevent or at least make nearly impossible a MITM of this, the TOTP is calculated by the TPM and only while the network card(s) are off.

[ Parent | on HN ]

Re:Authenticated Boot and Disk Encryption on Linux by egberts1 on Thursday September 23, 2021 @09:08AM (#28628544)

We haven’t found a l33t who can swap an macOS motherboard in 15 minutes.

[ Parent | on HN ]

Re:Authenticated Boot and Disk Encryption on Linux by NavinF on Thursday September 23, 2021 @12:34PM (#28631498)

Hmm it took me 2 hours when I had to do this a few years ago, but I'm pretty sure I could do it in 15 minutes if I practiced a few times and had 3 drills with two torx and one phillips driver bits.

Swapping the SSD and adding a keylogger to the ribbon cable would be a lot faster too, maybe 5 minutes with practice.

[ Parent | on HN ]