Calculator Manipulator

  • 3 Posts
  • 619 Comments
Joined 6 years ago
cake
Cake day: April 16th, 2019

help-circle


















  • Yes, failing to safeguard keys is fatal, but that applies to everything. But if fs you’re storing keys on is behind luks and they’re readable by root only - you’re as safe enough. There’re also LSMs like selinux that can increase the complexity of attack.

    I don’t know about nitrokey specifically, but TPM is an option (not good enough, imo) and a simple luks encrypted usb. You could get some convenience by storing the key to unlock it somewhere on the encrypted root.

    In general - you cannot stop a targeted attack no matter what, but staying safe from all the automated ones is doable.