Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

blog.lessonslearned.org

Post reply on HN
Print view View original

171–179 of 179 posts

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#171

Post by rdslw »

homakov wrote: post #79
Aissen wrote: post #52

Earlier quoted context omitted.

Agreed. I said "TOTP app" where I should have said "2FA app". I still think it's a second factor. Only a third party might have access to the factor too, like SMS codes/3DSecure.

Yeah it's a mess when you recommend duo/authy not clear TOTP or internal system. It's a second factor but not the one that's worth implementing: basic link to email has same security and costs $0

Its not that simple.

Its true that push2factor have some disadvantages, but it has one really strong advantage above pure TOTP: phishing dosnt work as the 2factor is send directly to the site and cant be mitmed at your terminal. Read about it.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#173

Post by homakov »

rdslw wrote: post #171
homakov wrote: post #79

Earlier quoted context omitted.

Yeah it's a mess when you recommend duo/authy not clear TOTP or internal system. It's a second factor but not the one that's worth implementing: basic link to email has same security and costs $0

Its not that simple. Its true that push2factor have some disadvantages, but it has one really strong advantage above pure TOTP: phishing dosnt work as the 2factor is send directly to the site and cant be mitmed at your terminal. Read about it.

What stops phishing? The attacker triggers push request, victim accepts - everything is the same?

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#174

Post by x220 »

atopuzov wrote: post #3

I love my C201, also not very expensive. I opted for the 4Gb version. My first setup was chromeos + crouton then I moved to linux on a sd card. I noticed I never boot into chromeos anymore so I got rid of it.

What is your battery life, never using ChromeOS?

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#175

Post by [deleted] »

themacguffinman wrote: post #158
albertgoeswoof wrote: post #130

Earlier quoted context omitted.

Why is that so hard to believe? Personalized ads are huge right now, if you could listen in to people's conversations you can use the data to improve your ad conversion rate. If there's ROI in recording and doing the data collection you can bet they have at least experimented with it. Can't imagine what recording webcams would do- but I suppose it might be effective for something.

> Why is that so hard to believe? Because there's no actual evidence to support it.

[deleted]

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#176

Post by johnsmith21006 »

serf wrote: post #22

So, be inconvenienced in every aspects important to a dev but gain a bit of confidence in your machine (as long as you trust Big-G)? verified boot seems like the only advantage here. You can buy an ebay business-grade laptop with TPM for 40 bucks USD readily, and they don't require reliance on Google or the requirement that one uses a neutered OS. (yes, yes, it's secure. It's a users' platform. Development on chrome…

You can get a Acer 14 refurb for under $200 which is a good dev machine using Crouton with ChromeOS. Nothing else is going to be able to touch this. Sounds like you are just not up to date what is now possible with Chromebooks.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#177

Post by johnsmith21006 »

devy wrote: post #55
chx wrote: post #24

In March, we have seen reports of Android Studio possibly coming to Chrome OS. Android Studio would mean IntelliJ IDEA and the entire family of IntelliJ IDEs. That would make this an even better idea.

Is it not currently possible to install any GUI-based IDEs into Chrome OS?

Yes it is using Crouton.

Re: How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

#178

Post by yjftsjthsd-h »

shakna wrote: post #169
yjftsjthsd-h wrote: post #162

Earlier quoted context omitted.

If you upgrade Arch without rebooting, don't you get messed up by losing unloaded kernel modules (because Arch doesn't keep old kernels)?

Hasn't been an issue yet. But it ever does, I'll probably adopt and adapt one of the solutions from this thread [0]. [0] https://www.reddit.com/r/archlinux/comments/4zrsc3/keep_your...

Oh, excellent; thank you. I mentioned it because this has bitten me, so I'll want to use that fix.

Fun story: for $REASONS, I have an Arch system with root on btrfs and /boot on ext4, and it doesn't usually have the boot partition mounted (it's a poorly done mutiboot issue). I recently discovered that this means if I forget to mount boot before updating I get stuck with no loaded drivers to mount /boot :) Thankfully kexec worked, but I'd like to not need to do that:)

Post reply on HN