Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Apparently using full-disk encryption is not enough to secure a computer, because the /boot partition is not encrypted, and could be modified to include a keylogger.

I have read about different counter-measures, but the only one that didn't sound too complicated and I actually understood was moving the /boot partition to a USB pendrive which I should carry with me all the time and use it to boot.

So how do I do that? I'm using Fedora 17, 18, and Ubuntu 12.04.

Any other suggestions?

share|improve this question
1  
I'm curious to what kinda threat you believe you'd face to need to have that kind of security – Journeyman Geek Jun 6 '13 at 9:22
1  
@JourneymanGeek With the popularization of cryptocurrencies, we are gonna need to raise the bar in security sooner or later: Tale of an evil roommate. Specialized hardware might end up being the solution, but in the meantime we have to find other ways to protect people. – ChocoDeveloper Jun 6 '13 at 12:15

Moving /boot to a removable medium works as long as you do not forget to carry it with you when you leave the computer. I think most people will forget this at least a few times.

A better protection against an *evil maid` would be:

  • A BIOS password
  • A required smartcard which also opens the doors (in other words, if you forget the card you can not leave the office).
  • Good physical security (optionally tying in the pass cards).
  • And ofc. not having sensitive data at all on the computer.
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .