- Encrypted Home Directories in Ubuntu Jaunty
- How eCryptfs Works
- Mounting Encrypted Home Using a LiveCD.
If my encrypted data is accessible from a LiveCD, what protection do I have?
The answer is "two things":
- your login passphrase
- your mount passphrase (which is encrypted in your ~/.ecryptfs/wrapped-passphrase file)
Inevitably, however, your login passphrase will be weaker than your mount passphrase, which is a randomly generated 128-bit string.
What can I do about this?
- Something you have (the wrapped-passphrase file)
- Something you know (your system login passphrase)
I was able to do this in a couple of simple steps.
- I added a line to my /etc/fstab to ensure that my PCMCIA CompactFlash card reader gets mounted on system boot to the same mountpoint everytime. Very important! Something like:
/dev/sdb1 /media/pcmcia ext3 defaults 0 0
- I moved my ~/.ecryptfs/wrapped-passphrase file to /media/pcmcia. For fun, you might consider changing the name of the file to something more obfuscating, like ".trash" or something random like ".ee47d044~".
- Create a symlink to that file, into its proper location:
ln -s /media/pcmcia/.ee47d044~ $HOME/.ecryptfs/wrapped-passphrase
Big thanks to Matt Trudel who first suggested this idea to me!
Isn't there another authentication type?
Okay, so there's another form of authentication that's potentially even stronger than the first two I mentioned... Something you are.
We're talking about biometrics here.
Now unfortunately, strong biometric input devices are not currently available for the masses on most portable computers. At this point, eCryptfs does not yet support biometric tokens. However, the design of eCryptfs supports arbitrary PKCS-11 tokens, so it would not take too much effort at all to extend the encrypted-home and encrypted-private conveniences to use biometric calculators as well.
What about fingerprint readers?
I'm sorry, but fingerprint readers are security theatre. The prevailing opinion from security professionals is that fingerprints are perhaps a good replacement for usernames. However, they're really not a good replacement for passwords.
Consider your laptop... How many fingerprints of yours are there on your laptop right now? As such, it's about as secret as your username. You don't leave your password on your spacebar, or on your beer bottle :-)
See the Criticisms section of this wikipedia entry (although it's about Microsoft Fingerprint Readers), it still applies: