News for hackers. Stuff that matters.

A comment on Improving the security of your SSH private key files. Parent comment

Re:Improving the security of your SSH private key files by claudius on Saturday May 25, 2013 @03:31AM (#5766629)
There is unfortunately relatively little you can do to thwart such an attack, apart from keeping your notebook with you at all/most times.

Though using a USB key for /boot might be an idea, it is a little less clunky than a ThinkPad and since I suspend to RAM most of the time, it could even be practical. Hm.

[ Parent | on HN ]
Re:Improving the security of your SSH private key files by pak on Saturday May 25, 2013 @02:41PM (#5768279)
Can't TPM be used for this? It could verify your /boot with keys external to the disk itself. I'm not sure if somebody has actually built a solution that uses it yet.

https://en.wikipedia.org/wiki/Trusted_Platform_Module

[ Parent | on HN ]
Re:Improving the security of your SSH private key files by snuxoll on Saturday May 25, 2013 @06:37PM (#5769140)
Sure it can, as can its evolution in the form of UEFI's Secure Boot, the problem is everyone wants to label these as technologies to enable lock-in instead of technologies to provide a trusted boot chain to ensure your system isn't compromised.
[ Parent | on HN ]
Re:Improving the security of your SSH private key files by claudius on Saturday May 25, 2013 @03:18PM (#5768470)
It could (the same goes for Secure Boot, in some sense). But the three-letter agencies from whom you want to protect yourself here likely have backdoor keys</paranoia>.
[ Parent | on HN ]