Skip to content

Instantly share code, notes, and snippets.

@ptman

ptman/fde-tips.mdwn

Created December 4, 2011 13:52
Show Gist options
  • Save ptman/1430250 to your computer and use it in GitHub Desktop.
Save ptman/1430250 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
fde-tips.mdwn

Advanced hints for a good FDE setup:

  • use a CD-R to boot (even better: a Pocket CD-R as you can carry them around more easily, but they are harder to come by nowadays)
  • CD-Rs have digits and characters carved/lasered/whatevered into their inner ring close to the center which are probably unique to every disc: memorize those and always check them in case someone tries to slip you a fake CD-ROM
  • under Linux, you have to boot the kernel from the CD, but that means you have to burn a new one after every kernel upgrade. to circumvent that, use the kexec program and work it into the boot scripts so that the boot CD boots the updated kernel from the decrypted harddrive (yes, it means you have to enter your password twice for each bootstrap -- you'll get used to it).
  • buy a clean, cheap keyboard and glue it shut so that no hardware keylogger or microphone can be implanted into it; switch keyboards if you have a Model M
  • use a disk password with maximum entropy, i.e. if you algorithm is 256 bits wide, generate 256 or more random bits and convert them into a form that can be typed on a keyboard (I use XXEnc which gives passwords 43 chars wide)
  • change your disk passwords every time you re-install your distro to restore system integrity
  • put something over your keyboard while typing the password to protect against cameras
  • Debian boot scripts make it possible to key in your password using the power button using input-events, though I only did this once and I have to admit that it is quite paranoid even for my standards.
  • to protect against BIOS rootkits, take out the Flash chip, cut off the Write Enable pin, put it back in, and seal it off with epoxy glue so everyone trying to Flash it will have to destroy your motherboard.
  • if you're really paranoid disassemble audit the BIOS code beforehand
  • always shut down your machine when leaving the house for more than 5 minutes
  • always lock the desktop/workstation when walking away from it, esp. when answering the door. NO EXCEPTIONS!
  • write and setup a dead man's daemon; it is possible to add a manually triggered sudden death primer that will kill the machine if not deactivated within twenty minutes for when the police busts down your door.
  • always remember that encryption algorithms have shelf life, so if you confess to a murder on your hard drive, and someone gets an encrypted image, all they have to do is wait.
  • at some point in the future, encryption will inevitably become illegal, so you'll have to switch to data carriers which are small enough to be easily hidden; however, the government will make them illegal eventually as well, so when you stockpile a certain gun type after the next shooting spree, consider stockpiling a few microSD cards as well.
  • I personally think plausible deniability setups are useless: if you live somewhere where encryption is illegal, you are living in a place where the police will find other ways to get clear text (i.e. they will have it tortured out of you). You can still use one if it makes you sleep better at night.
  • Disable Firewire if you have it. Firewire devices have access to the entire memory and can be used to own your box immediately. Gluing the ports shut would be the safest, but I think deactivating them in the BIOS should suffice (correct me if I'm wrong here). (credit: mycall)
  • Similar problems exist for USB devices under Linux all OSes with USB support due to the trusting nature of the USB kernel drivers architecture, but I don't know enough here to give a solution. Just not plugging in untrusted USB devices while having a display or a shell open would probably help already. Here's an article with more details on USB HID attacks.
  • Realize that there are forensic Uninterrupted Power Supply (USP) devices, i.e. maintain screen locking discipline because I don't see how else to counter this. (credit: anonmouse/mindbender)
  • Cold boot attacks are hard to defend against by anything other than gluing your memory into the banks with epoxy.
  • Be careful when setting up data-destroying booby-traps (physical AND software); things like these piss of judges more than you might think, and in some jurisdictions this is even illegal.

Additions/thoughts/comments are welcome.

P.S.: Save the above list to your hard drive in case I delete it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment