Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Apparently using full-disk encryption is not enough to secure a computer, because the /boot partition is not encrypted, and could be modified to include a keylogger.

I have read about different counter-measures, but the only one that didn't sound too complicated and I actually understood was moving the /boot partition to a USB pendrive which I should carry with me all the time and use it to boot.

So how do I do that? I'm using Fedora 17, 18, and Ubuntu 12.04.

Any other suggestions?

share|improve this question
1  
I'm curious to what kinda threat you believe you'd face to need to have that kind of security –  Journeyman Geek Jun 6 '13 at 9:22
    
@JourneymanGeek With the popularization of cryptocurrencies, we are gonna need to raise the bar in security sooner or later: Tale of an evil roommate. Specialized hardware might end up being the solution, but in the meantime we have to find other ways to protect people. –  ChocoDeveloper Jun 6 '13 at 12:15
add comment

1 Answer

Moving /boot to a removable medium works as long as you do not forget to carry it with you when you leave the computer. I think most people will forget this at least a few times.

A better protection against an *evil maid` would be:

  • A BIOS password
  • A required smartcard which also opens the doors (in other words, if you forget the card you can not leave the office).
  • Good physical security (optionally tying in the pass cards).
  • And ofc. not having sensitive data at all on the computer.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.