How Chrome OS, Termux, YubiKey & Duo Mobile make for great usable security. A travel Chromebook for modern development, online and offline.
Backstory
In the last year while talking to respected security-focused engineers & developers, I've come to fully appreciate Google's Chrome OS design. The architecture benefited from a modern view of threat modeling and real-world attacks. For example, Trusted Platform Module (TPM) hardware chips are built into every Chromebook and deeply incorporated into the OS. The design documents go into some detail on the specific protections that TPM provides, particularly around critical encryption functions.
I also learned that Chromebook is the daily driver for many of Google's own senior developers and security engineers. In short, the combination of the underlying Chromebook hardware with the OS architecture makes for a pretty compelling secure development environment.
Fast forward to March. In the past, I'd never given much thought to bringing my notebook with me while on travel -- it was just something I did as a matter of course. Now, though, with the changing landscape of airline restrictions and seemingly ad hoc draconian rules for what can and can't be brought on board, I've had to seriously reconsider my routine. There is zero chance I am willing to bag check my beloved Macbook Pro or Purism Librem, especially given carriers' long history of indifference to ground crews playing hacky-sack with luggage. Who can forget United Breaks Guitars? And let's not even get into brazen theft.
It's pretty neat to consider the possibility of pre-travel "power washing" (resetting everything clean to factory settings) on an inexpensive Chromebook and later securely restore over the air once at my destination.
...
Hardware
Samsung Chromebook 3 ($169 on Amazon)
FIDO-certified U2F security key. I recommend the YubiKey U2F blue key ($17 on Amazon)
The Termux Secret Sauce
This is the killer app that makes flexible dev shell access possible as an unprivileged user. Termux is a terrific project developed & led by Fredrik Fornwall and has been under active development for the past two years (https://github.com/termux/termux-app). It runs in non-root userspace and provides a chroot-like option to present a conventional linux filesystem. In most respects it feels like a modern Debian-based distro, with the latest i686 stable versions of widely used development & system tools development & system tools including:
apache 2.4
bash 4.4
clang 4.0.1
erlang 19.3
git 2.13
gnupg 2.1
golang 1.8.3
libgcc 4.9
libsodium 1.0.13
lighttpd 1.4
llvm 4.0
lua 5.3
mariadb 10.2
mosh 1.3
nginx 1.12
nmap 7.50
nodejs 6.11
python 2.7.13 & 3.6.1
redis 3.2.9
ruby 2.4.1
sqlite 3.19
sslscan 1.11
tcpdump 4.8
tor 0.3.0.9
transmission 2.92
Read more: https://blog.lessonslearned.org/building-a-more-secure-development-chromebook/
