How Chrome OS, Termux, YubiKey and Duo Mobile make for great usable security

I'm not sure how much extra "security" you're really getting out of staying strictly within ChromeOS. Yes, Secure Boot is disabled. However, the ChromeOS partition is still encrypted, and you can manually encrypt any of your crouton chroot environments, so someone looking at the thing still wouldn't be able to peek into the contents. If you're asked, "Why is this in Developer Mode?", you can answer, "I'm a developer."

Additionally, once Developer Mode is enabled, you must hit Ctrl+D to move past the warning screen every time. It is incredibly easy to inadvertently hit Enter or Spacebar, and then have the Chromebook wipe itself and restore to factory settings. I've done it inadvertently myself, and have heard multiple reports of a developer's spouse/child accidentally clicking it, too. Unless a Border Patrol agent knew exactly what they were doing, I'd be willing to bet they'd accidentally wipe it as well.

Finally, while I'm aware that disabling Secure Boot in theory opens you up to an Evil Maid attack, what is the likelihood that border patrol/customs would have a malicious OS on hand, and the know-how to flash it? Worst -case scenario, if you suspect they've tampered with the OS, simply hit Spacebar yourself as soon as you get it back, restore Secure Boot, and then start over from scratch!

As an aside, if you are confined to ChromeOS, I highly recommend Caret as an editor. It's a FOSS, Sublime clone chrome app that works swimmingly on Chromebooks.

1366 x 768 can look quite sharp on an 11". You were probably just looking at a bad screen.

AFAICT the reason than even expensive 11" laptops generally don't run higher resolutions is that at that size you can't tell the difference.

Awesome link, thanks! Docker is actually the one thing I was never able to get working properly in my chroot!

Re: Steam games, yup it's powerful enough to run most indie games that support linux (which is an increasing number, recently). The biggest constraints are GPU and disk space. I've had a few good runs of FTL (Faster than Light) on long-haul flights.

You just gotta make sure you keep an eye on the battery, since if it dies you accidentally wipe the system :/

You can get pretty close.

I've got three machines that I use regularly.

1) Mid-2010 MacBook Pro, with RAM and SSD upgrades. This is my main machine at home. It has never had to be wiped and reinstalled, and it gets rebooted about once a month.

2) Late-2013 MacBook Pro. This is my work machine and the story is similar to my home machine. It's never needed a reinstall and gets rebooted about once a month as well.

3) Lenovo ThinkPad x131e (Intel). This is my travel computer, serving a similar purpose as the Chromebook mentioned in this article (minus presenting stuff). I'm running OpenSUSE Tumbleweed on this - frequent updates lead to frequent reboots. There's also all the associated weirdness that comes with running a rolling release Linux on a machine that requires proprietary WiFi drivers (they tend to lag by a couple of days). When I ran OpenSUSE Leap it was almost as solid as the Macs.

I'd call the Macs "pure solid" machines, or as close as I can reasonably get. The ThinkPad is decent and the weirdness with it is really my fault.

Like everything else, your experience may vary.

The chromeos security model praised in this article seems quite too conservative for devs to me, considering the inconvenience trade-offs:

- persistent state is discouraged, but not disallowed. in fact, when the browser is exploited, any/all internal state necessarily must be be accessable and modifiable. i'm taking an educated guess that persistent browser internal state is less guarded against exploitation than external inputs.

- once pwned, most of your important data can probably be captured and accounts taken over before you ever decide to reboot. it's a PITA to have to reboot before accessing anything sensitive; no one should have to think/remember to do that. (maybe if chromeos were serious about preventing persistent threats, they'd force a reboot every night?)

- yes, it's defense-in-depth, but security is a game of trade-offs, where convenience often trumps technical security mechanisms in terms of increasing security overall.

I enable dev mode, but I appreciate the "stateless" sentiment in terms of encouraging data backup. i think I end up backing up my data (git push, etc.) more often than I would on a non-chromeos laptop, because it "feels" like more a necessity; especially after my 2 yr-old son hit the spacebar during that god-awful dev-mode bootup warning screen, and proceeded to factory-reset my chromebook.