Depends on the implementation of encrypted /boot. If the bootloader itself is loaded from the host disk[1], your adversary could always just overwrite /boot and GRUB with something that is actually unencrypted and just pretends to ask for the password. I guess ideally the system should authenticate itself to the user somehow.
Maybe by presenting its own user-facing password from a list of one time passwords.
(Of course all this is moot if the bad guy reflashes your bios to execute everything in a hostile VM or does other shenanigans that physical access enables... but this requires slightly more sophistication/effort).
[1] I can't tell from the article which device this guy installs GRUB on. Of course allowing direct boot from USB will have the downside of making it easier for your adversary to run his own tools.
Hmmm, with all due respect, it sounds to me like a solution to a non-problem, actually making it worse.
I mean - speaking of laptops - if you put a password protection on BIOS after having "forced" the boot from the internal disk/device you are IMHO a tadbit safer than "forcing" USB boot.
Of course some laptop BIOS passwords can be worked around and of course some Operating Systems can also be "tricked" during booting, but with some care these can be patched or avoided, but allowing (actually "forcing") USB booting represents - as I see it - a much "wider" attack surface.
On the other hand, you lose your keys and you cannot use the laptop while waiting on the porch for the locksmith to arrive...
5 comments
[ 3.3 ms ] story [ 31.0 ms ] threadArch guys have documented the setup on their wiki: https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_...
(Of course all this is moot if the bad guy reflashes your bios to execute everything in a hostile VM or does other shenanigans that physical access enables... but this requires slightly more sophistication/effort).
[1] I can't tell from the article which device this guy installs GRUB on. Of course allowing direct boot from USB will have the downside of making it easier for your adversary to run his own tools.