31–40 of 62 posts
This guide doesn't take into account side-channel attacks.[0] [0] http://en.wikipedia.org/wiki/Side-channel_attack
Let's get a superconducting Faraday cage for this tutorial.
[0]http://i.imgur.com/kdNOe5u.jpg (founder of thepiratebay.org)
[1]http://security.stackexchange.com/a/82374 (Snowden)
How easy is it for somebody to get your PGP key off a yubikey if they stole it? In particular since physical devices can be fuzzed, etc, it might be worse than an encrypted keychain on device for some people?
I don't know how difficult it would be to obtain the key from the device. However, if you have a strong passphrase on the key itself, then even if an attacker obtained the key, there would not be a lot to worry about. Just revoke it and move on. They'll likely never guess the passphrase.
How easy is it for somebody to get your PGP key off a yubikey if they stole it? In particular since physical devices can be fuzzed, etc, it might be worse than an encrypted keychain on device for some people?
You can read about the security features of the chip at NXP's website[1] to get a sense for what they're designed to defend against, but despite the very real possibility of a successful key retrieval attack on the card, in general it would be MUCH easier for an attacker to obtain your on-disk keychain files and figure out the password. Particularly if they don't want you to be aware the key has been compromised.
[1] http://www.nxp.com/products/identification_and_security/auth...
The holy grail for security, to me, will be something (an OS with it elegantly integrated for example) that the user has to try hard not to use, but doesn't feel like they're having an O'Reilly encryption book rammed down their gullet either.
I've read so many different multi-factor authentication schemes, and they're often brilliant, but I've yet to come across one that would pass the "my grandpa could use it" usability test. The holy grail for security, to me, will be something (an OS with it elegantly integrated for example) that the user has to try hard not to use, but doesn't feel like they're having an O'Reilly encryption book rammed down their gull…
A good walk through, and of course a sad reminder that even simple public key cryptography still has crap tooling. There should be some kind of x-prize for making tools that lets anyone communucate securely withiut walking through what looks like a 1999 gentoo install.
The airgapped computer loads propriety Chinese blobs to boot and is pulling it's encryption software over the network via HTTP.
