is it possible to create a login “key” out of a USB drive?

Question

I was recently thinking about keeping my computer secure from physical access, and i decided that the safest way to keep my data under lock and key, was to do just that: Create a lock and key out of a USB drive. My idea is this: A USB drive would act as a "Key" preventing login unless it was inserted. Is this possible, and can it be done for a reasonable price? if so, how could i manage that, and what sort of programs should i look into? i am running Mac OSX Mountain Lion if it is of any consequence.

Answer 1

I don't think he is referring the USB-key solution as a sole authentication method, but as an addition to the normal username-password authentication.

There are two methods I can think of, in order to implement this:
1. Encrypt the entire hard drive, and put the key-file on a USB drive.
2. Leave disk unencrypted and use the USB drive for a login purpose only.

Let's review:
1. Use truecrypt or dm-crypt (or their Mac OS X equivalents) in order to encrypt the entire hard drive using a key-file and storing it on a USB drive. The obvious and major drawback: losing the USB drive will cause the loss of the entire filesystem.
2. Use solutions like pam_usb (http://pamusb.org/)

Do not forget to take in account remote login considerations!

Answer 2

I know there is a program called Predator which does this for computers running Windows, however I am not aware of any software that is available for OS X.

You can see Predator in action here.

Answer 3

Yes you can get Smart Card USB devices (first relevant result I found on Google), they sometimes combine a smart card reader and chip in one package for ease of use.

This will show up as a Smart Card to the OS. You can set up all major operating systems (I don't know how to do it for OS X, but I know it supports it) that on removal of the smart card it will lock the computer and the computer will not be unlockable until the card is re-inserted or a administrative password is entered.

---

After re-reading your question I realize you wanted to re-use a existing USB flash drive as the key for the operating system. I do not know if that is posabile.

Also it would be very unsafe to do this due to the fact whatever "file" the security software put on the USB key to uniquely identify it, a person with knowledge of how the security software you are using works could clone the USB key without your permission without much difficulty (heck it may be as simple as dd if=/dev/sdb of=/dev/sdc)