Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was recently thinking about keeping my computer secure from physical access, and i decided that the safest way to keep my data under lock and key, was to do just that: Create a lock and key out of a USB drive. My idea is this: A USB drive would act as a "Key" preventing login unless it was inserted. Is this possible, and can it be done for a reasonable price? if so, how could i manage that, and what sort of programs should i look into? i am running Mac OSX Mountain Lion if it is of any consequence.

share|improve this question

3 Answers 3

up vote 6 down vote accepted

I don't think he is referring the USB-key solution as a sole authentication method, but as an addition to the normal username-password authentication.

There are two methods I can think of, in order to implement this:
1. Encrypt the entire hard drive, and put the key-file on a USB drive.
2. Leave disk unencrypted and use the USB drive for a login purpose only.

Let's review:
1. Use truecrypt or dm-crypt (or their Mac OS X equivalents) in order to encrypt the entire hard drive using a key-file and storing it on a USB drive. The obvious and major drawback: losing the USB drive will cause the loss of the entire filesystem.
2. Use solutions like pam_usb (http://pamusb.org/)

Do not forget to take in account remote login considerations!

share|improve this answer

Yes you can get Smart Card USB devices (first relevant result I found on Google), they sometimes combine a smart card reader and chip in one package for ease of use.

This will show up as a Smart Card to the OS. You can set up all major operating systems (I don't know how to do it for OS X, but I know it supports it) that on removal of the smart card it will lock the computer and the computer will not be unlockable until the card is re-inserted or a administrative password is entered.


After re-reading your question I realize you wanted to re-use a existing USB flash drive as the key for the operating system. I do not know if that is posabile.

Also it would be very unsafe to do this due to the fact whatever "file" the security software put on the USB key to uniquely identify it, a person with knowledge of how the security software you are using works could clone the USB key without your permission without much difficulty (heck it may be as simple as dd if=/dev/sdb of=/dev/sdc)

share|improve this answer
1  
re: cloning is there some kind of device-ID on USB mass storage devices that he could check against instead? –  pjz Oct 3 '12 at 18:23
    
Yes it could check that, but then all the atacker needs to do is get the same model USB drive as you. I am 90% sure USB flash drives do not include a serial number on them, and if they do, it is possible (I don't know how likely) that a clone with dd may copy the serial number too. –  Scott Chamberlain Oct 3 '12 at 18:35

I know there is a program called Predator which does this for computers running Windows, however I am not aware of any software that is available for OS X.

You can see Predator in action here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.