Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
1–10 of 62 posts
Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
#2Simpler version is to encrypt root partition and have kernel with boot loader on separate sd card or usb flash drive.
Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
#3How easy is it for somebody to get your PGP key off a yubikey if they stole it? In particular since physical devices can be fuzzed, etc, it might be worse than an encrypted keychain on device for some people?
Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
#4Simpler version is to encrypt root partition and have kernel with boot loader on separate sd card or usb flash drive.
I used to run this until I couldn't ignore that it was pointless because it offloads the attack vector to something I can easily lose, have taken or replaced.
Or someone could come in an pop in a drive with their own kernel.
Nevermind the reality that I'd never completely follow through with the security measures needed on a personal machine. I'd just be giving myself an active role in my home's security theater.
I just encrypt my home folder and don't trust machines/networks for important things.
Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
#5When's the Part 2 gonna be published?
Will there be a blog post about using gpg-agent as a ssh-agent? :)
BTW, Androids openkeychain supports fully yubikey neo, this is a great addition to using the pass(1) on from mobile with yubikey neo.
https://github.com/zeapo/Android-Password-Store http://www.openkeychain.org/
Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
#6When's the Part 2 gonna be published? Will there be a blog post about using gpg-agent as a ssh-agent? :) BTW, Androids openkeychain supports fully yubikey neo, this is a great addition to using the pass(1) on from mobile with yubikey neo. https://github.com/zeapo/Android-Password-Store http://www.openkeychain.org/
[deleted]
Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
#7When's the Part 2 gonna be published? Will there be a blog post about using gpg-agent as a ssh-agent? :) BTW, Androids openkeychain supports fully yubikey neo, this is a great addition to using the pass(1) on from mobile with yubikey neo. https://github.com/zeapo/Android-Password-Store http://www.openkeychain.org/
For a little while, I used a YubiKey NEO-n as an OpenPGP smartcard, with gpg-agent running as an ssh-agent (so that my SSH key was only present on my smartcard).
While great in theory, the authentication time made it totally impractical to connect to multiple servers at once.
I know this doesn't invalidate the general idea of using gpg-agent as ssh-agent -- just an anecdote.
Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
#8Obligatory xkcd:
https://xkcd.com/538/
Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
#9When's the Part 2 gonna be published? Will there be a blog post about using gpg-agent as a ssh-agent? :) BTW, Androids openkeychain supports fully yubikey neo, this is a great addition to using the pass(1) on from mobile with yubikey neo. https://github.com/zeapo/Android-Password-Store http://www.openkeychain.org/
For a little while, I used a YubiKey NEO-n as an OpenPGP smartcard, with gpg-agent running as an ssh-agent (so that my SSH key was only present on my smartcard). While great in theory, the authentication time made it totally impractical to connect to multiple servers at once. I know this doesn't invalidate the general idea of using gpg-agent as ssh-agent -- just an anecdote.
Can you elaborate on 'authentication time made it totally impractical' ?
Does this mean it was slow? I'm using gpg-agent on osx with a neo-n to ssh into boxes and it's not noticeably slow.
Re: Secure yourself, Part 1: Air-gapped computer, GPG and smartcards
#10This guide doesn't take into account side-channel attacks.[0]