- Apr 3, 2016
So potentially you boot up a corrupted system and with that decrypt your sensitive data or log into sensitive accounts?
Did you know you can have more than one Luks decryption password? So you can generate this ultralong, hard to write code (say, the C64 rev3 ROM assembly in hex, but leave out the last bit) and put it in your deadman's chest.I like LUKS. It is comfy and easy to use. I encrypted my root and my swap with LUKS. Not my boot.
sudo apt-get install moreutils && man vipe # it's a small perl script (no need for moreutils, just download the code).I just encrypt one file with ALL my sensitive data in it. I have a script that is basically a combination of gpg and grep. I supply my password via a pipe so it's not visible via ps. it also has incredibly ropey feature to edit by decrypting to a temp file, launching vi, then deleting the file. then I do a recursive grep of my entire filesystem for a unique string in my file to ensure temp file is actually gone. actually I think you showed me how to decrypt to a ram fs and I do that now. I would have preferred to pipe to and from vi but I couldn't figure that out. I think my system is completely ropey and I know several vulnerabilities but it seems better for me than an encrypted fs.
I run vi with -norc so no backup file.Did you know you can have more than one Luks decryption password? So you can generate this ultralong, hard to write code (say, the C64 rev3 ROM assembly in hex, but leave out the last bit) and put it in your deadman's chest.
sudo apt-get install moreutils && man vipe # it's a small perl script (no need for moreutils, just download the code).
vipe picks up on the EDITOR and VISUAL variables, so you can use those to get it to open Vim. And you definitively may want to set TMPDIR, like so:
But, you may want to modify vipe to not rely on this and always take tempfiles from /dev/shm and remove the editor selection part or you'll usually get nano as default editor instead of vi.
use it like so:
cat /secret/file.txt |vipe > /secret/file.new
see also quickedit: https://unix.stackexchange.com/questions/282366/how-to-invoke-vim-editor-and-pipe-output-to-bash
And if you use a swap partition then you need to encrypt that too.I split off my /home and /var folders because those tend to grow much faster than the rest of linux, and there are easily understood ways of cleaning them up, Generally the only way of cleaning stuff up from the rest of the root filesystem is by uninstalling stuff and then you have to watch out for dependencies. So I only encrypt my home partition, which contains all of the stuff I'm worried about, everything else is just standard linux stuff and mainly stuff that's freely available on the internet. I guess logs could be considered worth protecting, so you could consider encrypting your /var partition too. And if you ever park stuff in /root or /opt then your mileage may vary.
I do not have porn, but if I did then it would be in my home folder in my root partition and thus encrypted by default. Though I would probably store it in an encrypted folder so the back-ups would be encrypted as well. This would increase the chance of losing it but porn is sensitive content with low value so that seems fitting.
Why should somewhone got there porn stored on his own Computer these days? Expecally in a time where you can easily find them on the Internet by just using Google ?