Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yup, encrypt every time.

Otherwise, they may be able to snag your SSH RSA keys off of the hard drive, and if you've password protected it, they can try to brute force it.

Also, it helps safeguard against border patrol wanting to access your data while traveling.



Store your keys on a hardware token to reduce the chances of this happening (Nitrokey, Yubikey, OpenPGP smart card, etc.)


They'd backdoor your machine instead. Same result.


Same result? With something like a Yubikey you can't (excepting any vulnerabilities) extract the private key data even with the admin PIN codes. Based on your PIN caching preferences an attacker may be able to sign/encrypt/decrypt data with your keys (suggest setting force PIN for sign and low TTL for pin caching in gpg-agent) but they won't be able to exfiltrate your private keys.


the way I read about Yubikey is that it is for websites, accounts, etc. Can you use it to log into your actual OS?


The Yubikey NEO (and the 4, but the 4 is more closed-source than the NEO) is basically a Javacard smartcard with OpenPGP and PIV (x.509) applets with standard interfaces. I have my GPG auth/sign/encrypt subkeys on it (master/certification key stays offline), and with gpg-agent it will present your GPG auth key as SSH credentials.

There are Yubikey-specific PAM modules you can use as a second factor for logging in locally, and there are probably ways to use standard smartcard authentication for login purposes as well but I don't have experience with that. I mainly use it for remote SSH login purposes.


You can. The Yubikey can store a hash value in its second slot to act as a hardware token. I used to use mine with PAM so I couldn't get into my user account without it: https://developers.yubico.com/yubico-pam/


Yes, with a bit of setup and depending on your OS.

My problem with hardware tokens is simply that I lose them.


I keep mine on my car keys. Problem solved.


Then you (inevitably, Murphy's ...) lose your car keys. Now you have two problems. :p


Or stow a backup of your (yubikey) hardware in an encrypted (hopefully, zero-knowledge based) cloud service and restore when lost.


They can still bruteforce your disk.


They can still bruteforce you.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: