Thanks for the suggestions. My idea is a little different from simply running a portable SkySigner binary from a USB drive. I am building a bootable SkySigner USB OS so the computer starts in a separa...
A bootable USB OS makes much more sense than a portable binary, nice. Tails is a good reference for exactly what you describe: unplugging the stick triggers an emergency shutdown, and the data in RAM is securely erased against cold boot attacks. Worth reading how they do it.
A few things that help on that path:
- Keep the system partition read-only, and the vault in its own encrypted partition (LUKS), mounted only when needed.
- No swap, no hibernation, and lock key buffers in memory (mlock) so they never hit the disk.
- Tails also warns that pulling the stick can break persistent storage, so keep vault writes short and atomic.
What are the startup problems: UEFI and Secure Boot, or drivers on different PCs?
A few things that help on that path:
- Keep the system partition read-only, and the vault in its own encrypted partition (LUKS), mounted only when needed.
- No swap, no hibernation, and lock key buffers in memory (mlock) so they never hit the disk.
- Tails also warns that pulling the stick can break persistent storage, so keep vault writes short and atomic.
What are the startup problems: UEFI and Secure Boot, or drivers on different PCs?
1❤️1