Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

blog.lessonslearned.org

Post reply on HN
Print view View original

141–150 of 179 posts

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#141

Post by tortilla »

keganunderwood wrote: post #23
serf wrote: post #22

So, be inconvenienced in every aspects important to a dev but gain a bit of confidence in your machine (as long as you trust Big-G)? verified boot seems like the only advantage here. You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily, and they don't require reliance on Google or the requirement that one uses a neutered OS. (yes, yes, it's secure. It's a users' platform. Development on chrome…

I am not saying you're wrong but I'd like some advice on what to buy. The x220 I've never seen dip below $100 with 4GB RAM and a hard disk or at least a caddy. Thank you for your help.

https://arrowdirect.com/

Get a dealer account and you get 20-40% off the listed prices. I applied and got the account in about a week or two.

"Grade A" refurbs are in really good shape.

Cheapest X220 (Grade A) right now is $153.60 ($192.00 list).

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#142

Post by scottLobster »

korzun wrote: post #129
scottLobster wrote: post #69

Earlier quoted context omitted.

Depends on the provider. From some quick Googling Lastpass at least requires email verification before disabling Yubikey support. https://lastpass.com/support.php?cmd=showfaq&id=2546 Even for providers that do provide seamless failover, the inevitable "we see you requested an account recovery" email would serve as useful canary to know you're being targeted.

> Depends on the provider That was the whole point of my comment. It is up to the vendor and vendors do a horrible job. > the inevitable "we see you requested an account recovery" email would serve as useful canary There is nothing useful here. They are allowing you to bypass a secure key with a dumb email confirmation. Your idea of a 'useful canary' is great; until you get rooted at 5 AM on a Monday morning and that…

Well I imagine in most people's cases if they've managed to compromise their email then the game is already won.

Anecdotally, someone got my steam account credentials. I discovered this when they tried to change my password. Fortunately I had Steam's two-factor enabled and got the notification (2-factor is required to change steam account passwords), which alerted me to change my password. They actually tried the account recovery option and I got an email notification about that as well.

So in situations like that such notifications can be quite useful. But yeah, if they've compromised your most critical accounts/devices then YubiKey isn't going to save you. I don't think that's a knock against it.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#143

Post by rkeene2 »

AdmiralAsshat wrote: post #91

I'm not sure how much extra "security" you're really getting out of staying strictly within ChromeOS. Yes, Secure Boot is disabled. However, the ChromeOS partition is still encrypted, and you can manually encrypt any of your crouton chroot environments, so someone looking at the thing still wouldn't be able to peek into the contents. If you're asked, "Why is this in Developer Mode?", you can answer, "I'm a developer.…

The drive where the OS lives isn't encrypted. Rather it is verified. It uses do-it-yourself to chain every read from the device to a trusted authority. secure boot is how verifies that the kernel (running do-it-yourself) hasn't been tampered with (e.g., to add more trusted authorities or disable verification).

This protection is not just against "evil maids" but any attack that modified the disk in the past. E.g., if the system is compromisd due to a software fault, nothing can persist on disk undetected (like ZFS/bcachefs/BtrFS checksummi preventa bit-rot from being undetected)

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#144

Post by rkeene2 »

For all of those of you using DOD CACs or USG PIVs (NIST SP 800-73) smartcards there is also CACKey[0] for ChromeOS, of which I am the author.

I worked with Google to port it to ChromeOS when ChromeOS grew certificate provider support.

[0] https://cackey.rkeene.org/

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#145

Post by rkeene2 »

leggomylibro wrote: post #140
mrisoli wrote: post #125

Earlier quoted context omitted.

As someone who has an on-off interest in ChromeOS but with little to no knowledge about it, does vim/neovim work? I found some vim version on the chrome web store but it is last updated on 2014 and pinned to 7.4 which was a bit disappointing.

Yes and no. Yes, they work. No, they don't capture shortcuts like 'ctrl+W' which are handled by ChromeOS.

For some applications, like crosh, pinning the application and then launching it changes the semantics.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#146

Post by danjoc »

albertgoeswoof wrote: post #139
danjoc wrote: post #137

Earlier quoted context omitted.

Get two yubikeys. Set up LUKS full disk encryption the usual way on Ubuntu. Install yubikey-luks and yubikey-personalization-gui. Set up yubikeys for HMAC challenge response on a free slot. Enroll both keys using yubikey luks. Clear slot 0, leaving you with an encrypted brick unless you have one of two yubikeys. Mail one key to your destination. Leave the other key at home. Travel, pickup key, use it to access device…

Ok but there are major downsides with this: 1. If I change my plans I have to go back home or go to my original destination to pick up a key to decrypt 2. I might get there before my yubikey arrives 3. An adversary might look at my machine, and know there is data on there (in the chrome book case it just looks like a new machine), they could then detain me indefinitely or travel with me to my destination and force me…

You won't reach alberts-hacker-cloud.com behind the great firewall. The warning message you get from the internet police won't be a pleasant experience either. But try it and learn the hard way. Let the fear and dread wash over when you realize how far away from home you are, and how utterly alone you are in a foreign system.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#147

Post by outworlder »

andmalc wrote: post #82
serf wrote: post #22

So, be inconvenienced in every aspects important to a dev but gain a bit of confidence in your machine (as long as you trust Big-G)? verified boot seems like the only advantage here. You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily, and they don't require reliance on Google or the requirement that one uses a neutered OS. (yes, yes, it's secure. It's a users' platform. Development on chrome…

Sub $200 Chromebooks with decent keyboards: Dell 11 (2014 & 2015 models), Asus C202SA, and maybe the Lenovo educational models. At higher prices, of course, you have many choices: both Pixels, Lenovo and HP 13" and the Acer 14 for Work (all last year), the new Asus C302SA.

The Dell 13" is regularly discounted.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#148

Post by chasote »

leggomylibro wrote: post #140
mrisoli wrote: post #125

Earlier quoted context omitted.

As someone who has an on-off interest in ChromeOS but with little to no knowledge about it, does vim/neovim work? I found some vim version on the chrome web store but it is last updated on 2014 and pinned to 7.4 which was a bit disappointing.

Yes and no. Yes, they work. No, they don't capture shortcuts like 'ctrl+W' which are handled by ChromeOS.

There is a chrome extension called Crosh Window that keeps the Chrome shortcuts from coming in. That way things like Ctrl-w in Vim still work. edit: this might just be when going through crouton though. I don't really use the crosh shell except to boot up my chroot.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#149

Post by xuejie »

AdmiralAsshat wrote: post #105
geofft wrote: post #101

Earlier quoted context omitted.

I think I am misunderstanding you, but isn't paragraph 2 an argument for staying in normal Chrome OS (as this article suggests) instead of enabling developer mode?

It is an inconvenience and a danger, yes. But the tradeoff with having crouton is having full access to a Linux environment, with all of the tools and programs that enables. Short of System76/Entroware/Dell XPS Developer Editions, the fact remains that moddable, Intel-series chromebooks are some of the best preconfigured Linux laptops you can buy, once you peel back the ChromeOS layer. I mentioned above that I think…

Just being curious here: to me crouton is also a quite limited Linux environment, for example docker is a no go on crouton, so what advantage do you think that has against android-based solution such as termux?

Maybe a separate Linux install such as GalliumOS can really be called full access Linux environment?

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#150

Post by chasote »

AdmiralAsshat wrote: post #91

I'm not sure how much extra "security" you're really getting out of staying strictly within ChromeOS. Yes, Secure Boot is disabled. However, the ChromeOS partition is still encrypted, and you can manually encrypt any of your crouton chroot environments, so someone looking at the thing still wouldn't be able to peek into the contents. If you're asked, "Why is this in Developer Mode?", you can answer, "I'm a developer.…

I see the security argument come up often but have never once heard an anecdote of someone having a security breach or whatever people are scared of happening because their chromebook was in developer mode.

Installing a chroot isn't that difficult, in fact it was actually kind of fun and started me on an incredible tech exploration journey that currently has me learning software development using Vim on a command line only linux distribution. I never would have imagined such a thing a year ago. It is weird thinking having a $140 refurbished acer c720 may have led me on a completely different, exciting life path.

Post reply on HN