Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

blog.lessonslearned.org

Post reply on HN
Print view View original

101–110 of 179 posts

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#101

Post by geofft »

AdmiralAsshat wrote: post #91

I'm not sure how much extra "security" you're really getting out of staying strictly within ChromeOS. Yes, Secure Boot is disabled. However, the ChromeOS partition is still encrypted, and you can manually encrypt any of your crouton chroot environments, so someone looking at the thing still wouldn't be able to peek into the contents. If you're asked, "Why is this in Developer Mode?", you can answer, "I'm a developer.…

I think I am misunderstanding you, but isn't paragraph 2 an argument for staying in normal Chrome OS (as this article suggests) instead of enabling developer mode?

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#103

Post by leggomylibro »

AdmiralAsshat wrote: post #91

I'm not sure how much extra "security" you're really getting out of staying strictly within ChromeOS. Yes, Secure Boot is disabled. However, the ChromeOS partition is still encrypted, and you can manually encrypt any of your crouton chroot environments, so someone looking at the thing still wouldn't be able to peek into the contents. If you're asked, "Why is this in Developer Mode?", you can answer, "I'm a developer.…

That is a good point, but also a feature in my view. I see my chromebook as a mobile workstation, so more or less everything on it is backed up in a git repository, cloud storage, that sort of thing. ChromeOS automatically restores extensions and installed Android apps, and I usually keep builds of software I use in crouton on separate external flash storage; 16-32GB of internal storage isn't that much when you have to build from sources because ARM binaries are still fairly rare.

So an inadvertent wipe is really just an inconvenience of 30-60 minutes, and if it's a border patrol or TSA agent you can then have fun acting all indignant at how they broke your device and you lost so much work and your boss is gonna kill you and you want to talk to their supervisor right now.

The lack of hardware security is a consideration, but frankly if your device is handled by a malicious actor outside of your control, you're kinda screwed anyways.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#104

Post by bergie »

andmarios wrote: post #100

As a side point about Termux, Android 7 finally stopped hijacking the control+space combination, so you can use emacs efficiently. Termux is really useful, giving you an almost complete linux environment in Android phones and tablets. You can install it via Google Play, no need for root or any modification to your device. Add an external keyboard and you can work on the go.

Termux is pretty awesome. I used it for most of my work when working on a Pixel C.

http://bergie.iki.fi/blog/working-on-android-2017/

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#105

Post by AdmiralAsshat »

geofft wrote: post #101
AdmiralAsshat wrote: post #91

I'm not sure how much extra "security" you're really getting out of staying strictly within ChromeOS. Yes, Secure Boot is disabled. However, the ChromeOS partition is still encrypted, and you can manually encrypt any of your crouton chroot environments, so someone looking at the thing still wouldn't be able to peek into the contents. If you're asked, "Why is this in Developer Mode?", you can answer, "I'm a developer.…

I think I am misunderstanding you, but isn't paragraph 2 an argument for staying in normal Chrome OS (as this article suggests) instead of enabling developer mode?

It is an inconvenience and a danger, yes. But the tradeoff with having crouton is having full access to a Linux environment, with all of the tools and programs that enables. Short of System76/Entroware/Dell XPS Developer Editions, the fact remains that moddable, Intel-series chromebooks are some of the best preconfigured Linux laptops you can buy, once you peel back the ChromeOS layer.

I mentioned above that I think Caret is a great Sublime clone, but I also like having the real SublimeText, with its awesome add-on packages, Git integration, etc. The article's recommendation that you must stick with Android-enabled Chromebooks limits your options, and the only reason the recommendation exists is that he needs some way of getting access to the developer tools--gcc, etc. A crouton chroot gets you there the same way, and I'd argue it's better since the programs are running natively rather than through an emulated Android layer.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#106

Post by 392c91e8165b »

datguacdoh wrote: post #77
devy wrote: post #57

One of the BIGGEST drawbacks using a Chromebook with 11.6 inch screen that nobody here talks about yet, is the grainy and crappy 1366 x 768 screen resolution! I've been a long time Macs guy anything inferior than RetinaDisplay will considerably straining my eyes before I am used to it. Dell XPS 13 included.

If you're going to compare to a Mac, it's better to look at the higher end Chromebooks like the Pixel 2, HP Chromebook 13, and Samsung Chromebook Pro. They all have screens with pixel density and quality that's on par with the 15" MacBook Pro I have.

Interesting. (But the Pixel 2 was discontinued 11 months ago, and there is no replacement, i.e., no Pixel 3.)

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#107

Post by concede_pluto »

falcolas wrote: post #59
cjsuk wrote: post #31

Yubikeys tend to wear out your USB ports after a bit I found, at least on my X201 and the X61 that preceded it.

Any port used frequently will wear out - they have limited life spans due to the moving parts. I see it with my external display ports pretty frequently. One potential solution is a USB hub, or even a USB extension cable you keep plugged in.

I seem to remember reading that NASA would use short sacrificial extension cables so that ground tests would certify the jacks they'd be flying but not wear them out.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#109

Post by igravious »

madez wrote: post #64
igravious wrote: post #15

Earlier quoted context omitted.

> Edit; I've been using a de-chromed chromebook for over a year […] Ok, but as the article states, they did not de-ChromeOS it because they wanted TPM and Verified Boot and FIDO-certified U2F security key so that they didn't defeat the whole purpose of buying a Chromebook. FTA: “As far as Debian/Ubuntu (and crouton), that's fine as far as it goes, but then you don't end up with a Chromebook, just a cheap mini-noteboo…

You can have verified boot, and use the TPM and the U2F security key without the chrome os on a chromebook.

Totally agreed, but given the engineering efforts that Google have gone through to make the hardware and software stack work in harmony and given Google employees use Chromebooks the author of the article wants to set up a working dev environment by adding to Chrome rather than nuking it and coming up with a semi-custom solution. My first comment was to point this out.

We all know you can put Chromebooks into dev mode and load Ubuntu, in fact I thought it was necessary to get the most out of Chromebooks. If it turns out that Chromebooks can make decent dev environments without nuking and installing Ubuntu or whatever and if they can run Android apps then Chromebook suddenly become a very interesting value proposition.

Post reply on HN