Slashdot Mirror

← Back to Stories (view on slashdot.org)

Purism Launches First Security Key with Tamper-Evident Protection for Laptops (puri.sm)

Posted by EditorDavid on from the something-you-have dept.

An anonymous reader quotes Softpedia: Purism announced Thursday that its highly anticipated Librem Key security key is now available for purchase as the first and only OpenPGP-based smart card to offer a Heads-firmware-integrated tamper-evident boot process for laptops. Developed in partnership with Nitrokey, a company known for manufacturing open-source USB keys that enable secure encryption and signing of data for laptops, Purism's Librem Key is dedicated to Librem laptop users, allowing them to store up to 4096-bit RSA keys and up to 512-bit ECC keys on the security key, as well as to securely generate new keys directly on the device. Librem Key integrates with the secure boot process of the latest Librem 13 and 15 laptops...

Designed to let Librem laptop users see if someone has tampered with the software on their computers when it boots, Librem Key leverages the Heads-enabled TPM (Trusted Platform Module) chip in new Librem 13 and Librem 15 laptops. According to Purism, when inserted, the security key will blink green to show users that the laptop hasn't been tampered with, so they can continue from where they left off, and blinks red when tampering has occurred.
Purism's web site explains: With so many attacks on password logins, most security experts these days recommend adding a second form of authentication (often referred to as "2FA" or "multi-factor authentication") in addition to your password so that if your password gets compromised the attacker still has to compromise your second factor.

USB security tokens work well as this second factor because they are "something you have" instead of "something you know" like a password is, and because they are portable enough you can just keep them in your pocket, purse, or keychain and use them only when you need to login to a secure site.

27 comments

  1. Good. My screenplay must be protected! by elrous0 · · Score: 1

    Now Ninja Force: The Awakening will be safe from prying eyes!

    --
    SJW: Someone who has run out of real oppression, and has to fake it.
    1. Re: Good. My screenplay must be protected! by Anonymous Coward · · Score: 0

      The summary is too long and uni retesting to read :(

    2. Re:Good. My screenplay must be protected! by Anonymous Coward · · Score: 0

      Where's my $5 wrench.,..

    3. Re:Good. My screenplay must be protected! by spth · · Score: 2

      I have yet to see the $5 wench that can defeat this tamper-evident protection? How would one use it?

      You have a $5 wench that can be used to hit someone until they tell you the password, without them noticing that anything is happening?

    4. Re:Good. My screenplay must be protected! by Anonymous Coward · · Score: 1

      "You have a $5 wench that can be used to hit someone..."

      You really aren't supposed to use your wenches that way.

  2. They are also easy to lose by Anonymous Coward · · Score: 1

    these will probably do more harm than good, as if you lose it you are SOL. This is likely to be a much more common occurence than someone trying to compromise your machine.

  3. The "Russian hackers" excuse by Anonymous Coward · · Score: 0

    will be harder to justify.

    1. Re:The "Russian hackers" excuse by spth · · Score: 2

      This won't protect against "Russian hackers" that attack over the network, possibly doing something to your stuff on an encrypted partition while it is mounted.

      It is meant to protect against those planting a keylogger or some other malware in your /boot partition while they have physical access to the device

      Yes, that is a quite narrow scenario between the attach on the running OS and the planting of hardware malware in your device. But the first can be patched against, and the latter tends to leave evidence, unless prepared very well. So this security key really helps close a gap. If this would work out-of-the-box with any brand laptop with a suitable TPM and an ordinary Debian or OpenBSD, I would get such a key (and I hope that this becomes a possibility in the future).

    2. Re:The "Russian hackers" excuse by Anonymous Coward · · Score: 0

      won't protect against vulnerabilities in tpm either... odds are pretty good that some already exists, and are already known (or were straight-up designed by) certain government entities.

    3. Re:The "Russian hackers" excuse by spth · · Score: 1

      But the key still raises the bar significantly. Even if there are bugs in the TPM that can be exploited, far less people would know about them or be able to use them for an attack.

      There are far more potential attackers that could do an attack on an unprotected /boot partition.

  4. RSA keys? Is this a joke? by Anonymous Coward · · Score: 0

    You mean the NSA's tentacle RSA? That RSA?

    How about a proper modern key? One that came out as a response to all the breaches and the NSA leaks.

  5. Easy DOS by Anonymous Coward · · Score: 0

    Just need to change a bit to have a denial of service attack in which nobody want to use the laptop anymore.
    Wonderfull for off-site interventions.

    passphrase : denying

    1. Re:Easy DOS by spth · · Score: 1

      So what? Whoever can change that bit can already do a DOS by taking or breaking the laptop, or erasing the OS.

      I would consider it quite useful to be able to detect manipulations in /boot; I hope this stuff becomes available for use with third-party laptops, too.

  6. Designed to... by bagofbeans · · Score: 1

    Designed to let Librem laptop users see if someone has tampered

    I'd prefer Guaranteed to, not Designed to.

  7. I thought it was by bobstreo · · Score: 1

    something you have, AND something you know.

    I'd guess there would be a market to make the green light on the key turn on regardless of the state of the system.

  8. But it's evil when Microsoft does it. by Anonymous Coward · · Score: 0

    Enjoy getting securely CoC'd by your Linux distro.

  9. Thanks for the advertisement by Anonymous Coward · · Score: 0

    Great ad - thanks!

  10. Completely useless by N_Piper · · Score: 1

    Do you know why all the other keys don't have the "COMPLETE USB PLUG" that Nitrokey are so proud of? Because they are completely encapsulated in plastic, the boot process may be tamper evident but the key isn't (and conspicuously Purism and Nitrokey never make that claim) crack it open slap a rubber ducky in the shell glue it closed and you are screwed.

    1. Re:Completely useless by spth · · Score: 1

      The key not being tamper-evident doesn't make it "Completely useless". The key is small; it can be put on a key ring or into a wallet, both of which (assuming a normal person's way of handling their keys and wallet) make tampering hard.

      The laptop, on the other hand is rather bulky, which makes preventing tampering hard.

      When travelling (or just leaving the house), one will often want to leave a laptop behind (in one's own home, in a hotel room, etc). But one would the key.

  11. Tamper-evident boot process by najajomo · · Score: 1

    What I don't understand is why they don't produce a laptop with the OS stored on a ROM that is rendered read-only with a switch.

    1. Re:Tamper-evident boot process by spth · · Score: 1

      The switch would not provide tamper-evidence: Anyone with physical access to the laptop could make changes to the OS that would not be noticed.

      That doesn't mean that such a switch would be useless; it just would protect against a different kind of attack compared to the one the security key protects against.

    2. Re:Tamper-evident boot process by Anonymous Coward · · Score: 0

      What I don't understand is why they don't produce a laptop with the OS stored on a ROM that is rendered read-only with a switch.

      ROM is already read-only (by definition).

    3. Re:Tamper-evident boot process by najajomo · · Score: 1

      > ROM is already read-only (by definition).

      You set the switch ro r/w to update and then back to read-only for normal use.

    4. Re:Tamper-evident boot process by Anonymous Coward · · Score: 0

      That's called a hard drive.

  12. This company has been a fraud since day 1 by Anonymous Coward · · Score: 0

    The very name contradicts itself. Purism advertises itself as a company that is pure in the sense they ship only free software as in the FSF definition of free software and then proceeds to lie about pretty much everything. The original laptop "design" included an NVIDIA graphics chip for example and claimed to be the first 100% free laptop. They actually tried to imply that other companies weren't already doing the same thing and well- actually doing something. Purism has basically taken credit for and manipulated people left and right. There are much better companies to support that are actually doing stuff and putting out hardware that actually works.

    And it doesn't even work properly... like basic functionality.
    https://twitter.com/mattl/status/1012867824971407361

    1. Re:This company has been a fraud since day 1 by spth · · Score: 1

      Well, I don't have a Purism laptop, and haven't followed their work closely enough to judge.

      But if the report from twitter is true, it is even more reason to hope that this security key (and software) will become available for use with other laptops.

      I intend to get a new laptop in early 2019; it probably won't be a Purism one (I'll probably be looking for a 14'' Ryzen 2700U). Having such a key could be useful. But it would have to work with Debian with little extra effort (even better if it also works with OpenBSD).

  13. Reminds me of IronKey by Anonymous Coward · · Score: 0

    At least IronKey mostly worked, but it was very expensive. I think someone should try sawing these open or nitric-acid decapping and if they're data is recoverable without tripping any self-zeroing feature. TBH this thing particular product like a vaporware scam.