posted in Selfhosted
Unlocking LUKS with NitroKey/Yubikey: FIDO2, HMAC-SHA1, or OpenPGP?
Crossposted from https://thebrainbin.org/m/linux@lemmy.ml/t/1840283
Which approach do you think is better, and why?
Or do you think there is an even better way to use a hardware security token to unlock drives having LUKS full disk encryption?
thebrainbin.orgUnlocking LUKS with NitroKey/Yubikey: FIDO2, HMAC-SHA1, or OpenPGP? - Linux - the/brain/binWhich approach do you think is better, and why? ...Replying to @modem_down@thebrainbin.org
i use a yubikey and still have the ability to type my LUKs password in. Yubikey is just more convenience: plug in and it auto type the password field. On Fedora this means it populates the field with asterisks. Still, i think using password is the best method.
With that said, i believe a much better secure layer is something similar to what Novacustoms, Purism attempt to do: verify if somebody else not you try to access the laptop. So far i know of only Dasharo boot and the stuff from Purism that can do these…
So the layout is: Boot verification -> LUKs-> your data
Or if you have the juices and powers: Boot verification -> LUKS -> QuebeOS dom0 -> choose your Quebess.
Replying to @mazzilius_marsti@lemmy.world
i believe a much better secure layer is something similar to what Novacustoms, Purism attempt to do: verify if somebody else not you try to access the laptop.
You're thinking of Heads, which I agree is ideal for supported motherboards.