Somewhat relevant: https://thebrainbin.org/m/linux@lemmy.ml/t/1858588

It would probably be a better use of time for those people to vote and lobby their legislatures for decent privacy protections in law.

Yet another example of why US citizens would benefit from GDPR-equivalent privacy laws.

If you want GrapheneOS without funding Google, why not get a secondhand Pixel?

Thanks. What’s your source for that list? I think you’re right that those measurements are factors in the final “bot score”, but I expect there are many other measurements also factored in.

If you look at my OP, though, you’ll see my browser passed the checks but was still blocked, which Cloudflare said shouldn’t happen.

It pops up on which page?

I can’t see it on either of the pages mentioned in my OP:

• https://developers.cloudflare.com/cloudflare-challenges/troubleshooting/challenge-solve-issues/
• https://browser-compat.turnstile.workers.dev

I’m getting this issue in Chromium.

Like you, I’ve encountered it especially often in the last 3 weeks or so. Thanks for confirming it’s not just me!

Do you have a link to that feedback form, by any chance?

I eventually managed to find contact details for the webmaster for the site on which I most recently encountered this. Hopefully they’ll fix it in their Cloudflare configuration.

Failing that, I’ll try User-Agent spoofing. Failing that, another ISP, or VPN.

Cloudflare is already wrongly flagging this Linux box as a bot when it connects from an ordinary domestic ISP.

Surely it would be more likely to flag it if it was connecting from a VPN exit node.

No VPN present in this particular case.

This reminds me I need to have another look at Ledger, Beancount, et al. More info at https://plaintextaccounting.org

Nice. It would be good to put the distro name beneath each logo, for people who don’t recognise the logos.

“Have an evil megacorp’s gaslighting robot invade your safe space instead!”

Progress report 1

• I’m ruling out HMAC-SHA1, because:
  • Plain vanilla HMAC-SHA1 uses a shared secret. I don’t want the PC/server to have a copy of the credential. May also be susceptible to MITM/relay attacks.
  • Rolling-code HMAC-SHA1 only partially solves those problems.
  • Encrypted rolling code HMAC-SHA1 solves those problems, but I haven’t found a reliable source for using it with LUKS.
• If using systemd, pick FIDO2:
  • Avoids flaws of HMAC-SHA1.
  • Native support in systemd, so “future-proof”.
  • Wider support than OpenPGP. More HST vendors to choose from, including cheaper options than NitroKey or Yubikey: useful if each sysadmin (or colleague, or relative) needs an HST.
  • Compatible with QubesOS.
• Otherwise, OpenPGP:
  • Like FIDO2, solves HMAC-SHA1 flaws.
  • However:
    • smartcard-key-luks seems unmaintained on GitHub and on GitLab.
    • LUKS with OpenPGP isn’t well-documented for non-Debian-based distros.
• TBD: Clevis/Tang:
  • Remote/network-based unlocking.

If it’s a server for self hosting you definitely don’t want anything that requires interaction at boot.

Depends on use-case. If you only plan to boot it when you’re physically present, it’s fine.

i believe a much better secure layer is something similar to what Novacustoms, Purism attempt to do: verify if somebody else not you try to access the laptop.

You’re thinking of Heads, which I agree is ideal for supported motherboards.

tang

Thanks. TIL about Clevis/Tang.

I read them before writing my OP. I’m still not sure what you’re getting at.

I would be grateful if you could say what you mean, instead of initiating an oblique guessing game.

Yes. Here are some common self-hosting scenarios:

• Home server containing family files: scans, photos, device backups, …
• Office server containing business files: sensitive documents, device backups, …
• Web or email server containing websites, Fediverse instances, emails, etc

In all those cases, full disk encryption (FDE) is a sensible precaution to protect the data in case the server is physically stolen.

Linux is probably the most common OS kernel for self-hosting. On Linux, LUKS (Linux Unified Key Setup) is probably the best FDE system. It’s mature and reliable. But anyone self-hosting a Linux server with LUKS FDE is faced with the question of where to store the keys.

Hardware security tokens (HSTs) are widely considered a safer place for keys than SSDs, HDDs, or USB storage. They follow the smartcard principle: a private key can be written to an HST but not read from it (security vulnerabilities excepted). Instead, they implement cryptographic algorithms to prove possession of the private key. So, anyone self-hosting a Linux server with LUKS FDE should strongly consider storing their private key(s) on an HST.

However, there is more than one way to do that. Hence the question in my OP.

Which of the 4 recipes I posted are you referring to as “this”?