How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

Post by albertgoeswoof » Thu, Jul 27, 2017, 10:13 PM UTC

korzun wrote: post #129

scottLobster wrote: post #69

Earlier quoted context omitted.

Depends on the provider. From some quick Googling Lastpass at least requires email verification before disabling Yubikey support. https://lastpass.com/support.php?cmd=showfaq&id=2546 Even for providers that do provide seamless failover, the inevitable "we see you requested an account recovery" email would serve as useful canary to know you're being targeted.

> Depends on the provider That was the whole point of my comment. It is up to the vendor and vendors do a horrible job. > the inevitable "we see you requested an account recovery" email would serve as useful canary There is nothing useful here. They are allowing you to bypass a secure key with a dumb email confirmation. Your idea of a 'useful canary' is great; until you get rooted at 5 AM on a Monday morning and that…

Post by chiefalchemist » Thu, Jul 27, 2017, 10:16 PM UTC

andrepd wrote: post #128

microcolonel wrote: post #122

Earlier quoted context omitted.

It might be better to give your data to someone who has to tell you how they're spying on you, than to somebody who legally shouldn't be able to but does so anyway.

It's a false alternative. Encrypt your hard drive with a key on a thumb drive on your person. Problem solved: nobody can read your hard drive unless they physically get your key as well.

Post by math0ne » Thu, Jul 27, 2017, 10:25 PM UTC

Post by chiefalchemist » Thu, Jul 27, 2017, 10:34 PM UTC

free_everybody wrote: post #120

kasey_junk wrote: post #119

Earlier quoted context omitted.

a) because he was impressed by the ChromeOS security model? b) because he got cloud sync/restore seamlessly out of the box? c) because thats twice as expensive for a used item? I get that people have nebulous concerns about Google's privacy policy, but he mentions specifically at the beginning of the article that he was interested in the ChromeOS security model. There are very few systems that have a model that match…

Those reasons are understandable. I guess I'm confused why a software developer needs to save $200 on a travel device with I would love it if Android apps could somehow replicate the dev tools of a standard full-featured OS one day. I'm definitely a fan of ChromeOS.

Post by leggomylibro » Thu, Jul 27, 2017, 11:05 PM UTC

mrisoli wrote: post #125

AdmiralAsshat wrote: post #91

I'm not sure how much extra "security" you're really getting out of staying strictly within ChromeOS. Yes, Secure Boot is disabled. However, the ChromeOS partition is still encrypted, and you can manually encrypt any of your crouton chroot environments, so someone looking at the thing still wouldn't be able to peek into the contents. If you're asked, "Why is this in Developer Mode?", you can answer, "I'm a developer.…

As someone who has an on-off interest in ChromeOS but with little to no knowledge about it, does vim/neovim work? I found some vim version on the chrome web store but it is last updated on 2014 and pinned to 7.4 which was a bit disappointing.