Slashdot Mirror
Purism Launches First Security Key with Tamper-Evident Protection for Laptops (puri.sm)
An anonymous reader quotes Softpedia:
Purism announced Thursday that its highly anticipated Librem Key security key is now available for purchase as the first and only OpenPGP-based smart card to offer a Heads-firmware-integrated tamper-evident boot process for laptops. Developed in partnership with Nitrokey, a company known for manufacturing open-source USB keys that enable secure encryption and signing of data for laptops, Purism's Librem Key is dedicated to Librem laptop users, allowing them to store up to 4096-bit RSA keys and up to 512-bit ECC keys on the security key, as well as to securely generate new keys directly on the device. Librem Key integrates with the secure boot process of the latest Librem 13 and 15 laptops...
Designed to let Librem laptop users see if someone has tampered with the software on their computers when it boots, Librem Key leverages the Heads-enabled TPM (Trusted Platform Module) chip in new Librem 13 and Librem 15 laptops. According to Purism, when inserted, the security key will blink green to show users that the laptop hasn't been tampered with, so they can continue from where they left off, and blinks red when tampering has occurred.
Purism's web site explains: With so many attacks on password logins, most security experts these days recommend adding a second form of authentication (often referred to as "2FA" or "multi-factor authentication") in addition to your password so that if your password gets compromised the attacker still has to compromise your second factor.
USB security tokens work well as this second factor because they are "something you have" instead of "something you know" like a password is, and because they are portable enough you can just keep them in your pocket, purse, or keychain and use them only when you need to login to a secure site.
Designed to let Librem laptop users see if someone has tampered with the software on their computers when it boots, Librem Key leverages the Heads-enabled TPM (Trusted Platform Module) chip in new Librem 13 and Librem 15 laptops. According to Purism, when inserted, the security key will blink green to show users that the laptop hasn't been tampered with, so they can continue from where they left off, and blinks red when tampering has occurred.
Purism's web site explains: With so many attacks on password logins, most security experts these days recommend adding a second form of authentication (often referred to as "2FA" or "multi-factor authentication") in addition to your password so that if your password gets compromised the attacker still has to compromise your second factor.
USB security tokens work well as this second factor because they are "something you have" instead of "something you know" like a password is, and because they are portable enough you can just keep them in your pocket, purse, or keychain and use them only when you need to login to a secure site.
Now Ninja Force: The Awakening will be safe from prying eyes!
SJW: Someone who has run out of real oppression, and has to fake it.
these will probably do more harm than good, as if you lose it you are SOL. This is likely to be a much more common occurence than someone trying to compromise your machine.
I'd prefer Guaranteed to, not Designed to.
something you have, AND something you know.
I'd guess there would be a market to make the green light on the key turn on regardless of the state of the system.
So what? Whoever can change that bit can already do a DOS by taking or breaking the laptop, or erasing the OS.
I would consider it quite useful to be able to detect manipulations in /boot; I hope this stuff becomes available for use with third-party laptops, too.
This won't protect against "Russian hackers" that attack over the network, possibly doing something to your stuff on an encrypted partition while it is mounted.
It is meant to protect against those planting a keylogger or some other malware in your /boot partition while they have physical access to the device
Yes, that is a quite narrow scenario between the attach on the running OS and the planting of hardware malware in your device. But the first can be patched against, and the latter tends to leave evidence, unless prepared very well. So this security key really helps close a gap. If this would work out-of-the-box with any brand laptop with a suitable TPM and an ordinary Debian or OpenBSD, I would get such a key (and I hope that this becomes a possibility in the future).
Do you know why all the other keys don't have the "COMPLETE USB PLUG" that Nitrokey are so proud of? Because they are completely encapsulated in plastic, the boot process may be tamper evident but the key isn't (and conspicuously Purism and Nitrokey never make that claim) crack it open slap a rubber ducky in the shell glue it closed and you are screwed.
What I don't understand is why they don't produce a laptop with the OS stored on a ROM that is rendered read-only with a switch.
But the key still raises the bar significantly. Even if there are bugs in the TPM that can be exploited, far less people would know about them or be able to use them for an attack.
There are far more potential attackers that could do an attack on an unprotected /boot partition.
Well, I don't have a Purism laptop, and haven't followed their work closely enough to judge.
But if the report from twitter is true, it is even more reason to hope that this security key (and software) will become available for use with other laptops.
I intend to get a new laptop in early 2019; it probably won't be a Purism one (I'll probably be looking for a 14'' Ryzen 2700U). Having such a key could be useful. But it would have to work with Debian with little extra effort (even better if it also works with OpenBSD).