security/hakurei.app
security/hakurei.app
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

clarify recommendation

Browse Source
This commit is contained in:
Daniel Micay 2021-04-01 13:47:44 -04:00
parent 553d293bdc
commit eb35b4ba62
1 changed files with 7 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
static/faq.html
View File

@ -396,15 +396,13 @@
owner profile without rebooting due to it encrypting the sensitive system-wide
operating system data.</p>
<p>Our recommendation for a high security setup is to use the owner profile
only for managing other profiles. Using a secondary profile for regular usage
allows you to make use of the device without decrypting the data in your
regular usage profile. It also allows putting it at rest without rebooting the
device. Even if you use the same passphrase for multiple profiles, each of
those profiles still ends up with a unique key encryption key and a compromise
of the OS while one of them is active won't leak the passphrase. The advantage
to using separate passphrases is in case an attacker records you entering
it.</p>
<p>Using a secondary profile for regular usage allows you to make use of the
device without decrypting the data in your regular usage profile. It also
allows putting it at rest without rebooting the device. Even if you use the
same passphrase for multiple profiles, each of those profiles still ends up
with a unique key encryption key and a compromise of the OS while one of them
is active won't leak the passphrase. The advantage to using separate
passphrases is in case an attacker records you entering it.</p>
<p>File data is encrypted with AES-256-XTS and file names with AES-256-CTS. A
unique key is derived using HKDF-SHA512 for each regular file, directory and