Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

blog.lessonslearned.org

Post reply on HN
Print view View original

21–30 of 179 posts

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#21

Post by sliken »

fredley wrote: post #2

I tried using a Chromebook as a dev machine several years ago - before Android apps. The chroot situation worked well enough, but the dev-mode boot was a deal-breaker. Back then, if a Chromebook's local storage filled up, it would factory-reset itself. Is this still the case? This is one big thing keeping me from trying this again (which I'm very tempted to do so after reading this article). Investing in setting up a…

What's the problem? I switched my asus chromebox to dev mode and installed ubuntu and didn't notice anything. I think there was some small tweak to get rid of the warning and hit f1 to continue or whatever it was.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#22

Post by serf »

So, be inconvenienced in every aspects important to a dev but gain a bit of confidence in your machine (as long as you trust Big-G)?

verified boot seems like the only advantage here. You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily, and they don't require reliance on Google or the requirement that one uses a neutered OS. (yes, yes, it's secure. It's a users' platform. Development on chrome OS at this point is an act of masochism.)

If secure travel is your thing, stash your data on a cloud provider and pull it later after you arrive at your destination. Go whole-hog and travel without an SSD and buy a cheap one at your destination with cash. Sprinkle in some libreboot for more confidence.

It'll still be cheaper than a 200 dollar chromebook, and you probably won't have to deal with some of the worlds' worst chicklet keyboards.

P.S. don't travel with a yubikey that isn't partnered with another. Would be a bummer to lose.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#23

Post by keganunderwood »

serf wrote: post #22

So, be inconvenienced in every aspects important to a dev but gain a bit of confidence in your machine (as long as you trust Big-G)? verified boot seems like the only advantage here. You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily, and they don't require reliance on Google or the requirement that one uses a neutered OS. (yes, yes, it's secure. It's a users' platform. Development on chrome…

I am not saying you're wrong but I'd like some advice on what to buy. The x220 I've never seen dip below $100 with 4GB RAM and a hard disk or at least a caddy.

Thank you for your help.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#27

Post by microtonal »

igravious wrote: post #15
le-mark wrote: post #10

This blog post details using a chromebook as a temporary device, such that you can travel with a blank machine, and provision at your destination with the data and apps you may need: > It's pretty neat to consider the possibility of pre-travel "power washing" (resetting everything clean to factory settings) on an inexpensive Chromebook and later securely restore over the air once at my destination. ... the engineerin…

> Edit; I've been using a de-chromed chromebook for over a year […] Ok, but as the article states, they did not de-ChromeOS it because they wanted TPM and Verified Boot and FIDO-certified U2F security key so that they didn't defeat the whole purpose of buying a Chromebook. FTA: “As far as Debian/Ubuntu (and crouton), that's fine as far as it goes, but then you don't end up with a Chromebook, just a cheap mini-noteboo…

U2F keys also work on plain Linux with Chrome or Chromium. Though you may have to add some udev rules:

https://github.com/Yubico/libu2f-host/blob/master/70-u2f.rul...

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#28

Post by ekianjo »

keganunderwood wrote: post #23
serf wrote: post #22

So, be inconvenienced in every aspects important to a dev but gain a bit of confidence in your machine (as long as you trust Big-G)? verified boot seems like the only advantage here. You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily, and they don't require reliance on Google or the requirement that one uses a neutered OS. (yes, yes, it's secure. It's a users' platform. Development on chrome…

I am not saying you're wrong but I'd like some advice on what to buy. The x220 I've never seen dip below $100 with 4GB RAM and a hard disk or at least a caddy. Thank you for your help.

You can fInd x220 in not very good condition for 100 to 150 usd. And even a x201 is ok for development purposes.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#29

Post by kogepathic »

keganunderwood wrote: post #23
serf wrote: post #22

So, be inconvenienced in every aspects important to a dev but gain a bit of confidence in your machine (as long as you trust Big-G)? verified boot seems like the only advantage here. You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily, and they don't require reliance on Google or the requirement that one uses a neutered OS. (yes, yes, it's secure. It's a users' platform. Development on chrome…

I am not saying you're wrong but I'd like some advice on what to buy. The x220 I've never seen dip below $100 with 4GB RAM and a hard disk or at least a caddy. Thank you for your help.

> The x220 I've never seen dip below $100 with 4GB RAM and a hard disk or at least a caddy.

ThinkPad caddys are dirt cheap. You can buy third party compatible caddys for under $10. [0]

In terms of a laptop with a reasonable build quality that includes a TPM, pretty much any corporate laptop will suffice. X220's command a premium because they're ThinkPads.

If you look at other options, something like the Dell E6220, which is from the same generation as the X220, can be purchased used for around $100. [1]

They don't support coreboot, but they're otherwise reliable machines. The Dell UEFI implementation supports only allowing signed updates and SecureBoot. Depending on your threat model this might be enough for you.

> You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily

You'll have to buy something older than the E6220 mentioned above, but the Dell E6400 is available for $40. [2] That will have an integrated TPM.

[0] http://www.ebay.com/itm/Lenovo-Thinkpad-X220-X220i-Hard-Driv...

[1] http://www.ebay.com/itm/Dell-Latitude-E6220-13-3-Intel-Core-...

[2] http://www.ebay.com/itm/Dell-Latitude-E6400-Laptop-Core-2-Du...

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#30

Post by soniman »

mkohlmyr wrote: post #12

I used my CB30 as a dev machine for a little while, both using cloud environments (koding, codeanywhere) and using vscode under crouton. It is so close to being usable. It is such a user friendly operating system, it just falls short on a few significant fronts. 1. Developer mode should be friendlier to use (no horrible noises on boot, no delayed boot time). 2. It needs support for electron-based/alike apps to run na…

You probably know this but ctrl-d avoids the delay and the noises.
Post reply on HN