'(·) on Twitter

You’re unable to view this Tweet because this account owner limits who can view their Tweets. Learn more

Nov 16, 2016

Replying to

check out GRUB_ENABLE_CRYPTODISK; in short, you can encrypt everything but grub and it's more practical than /boot-on-stick

1

Replying to

and

an attacker with write access can still edit my grub, but it requires more knowledge and has a smaller attack surface

1

Replying to

and

I've had trouble with boot sticks in the past because I forgot to put them in during initramfs updates, too many moving parts

1

Replying to

and

but with only grub on the stick, it only breaks if I don't take care during incompatible grub updates, of which there are few

1

Replying to

how could I persuade you to write down how to set that up? cc

1

Replying to

and

just google GRUB_ENABLE_CRYPTODISK I think - my only twist on it is that I put a keyfile in the initramfs

5:49 PM · Nov 16, 2016Twitter Web Client

Conversation