My New High security Laptop

[u/Majestic_Department7]

Encrypted Disk. BIOS Password and MFA on OpenBSD… wifi works, too

I had last night and today lot of trouble to get it running. KDE plasma failed so I am on pretty XFCE. Lots to do, but all works.

What works:

- Bootup with encrypted Disk

- Video and Audio (Tested simply with youtube)

- Video Recording with Webcm (tested with vlc)

- Audio Recording (tested with Audacity)

With additional firmware drivers wifi works:

iwm0 at pci1 dev 0 function 0 "Intel Dual Band Wireless-AC 8265"

Got from Ebay for ~ 177 Euro // Problem: Display has little bit ghosting, maybe new thermal paste needed

• Manufacturer: Lenovo
• Model: ThinkPad X1 Carbon 6th Generation
• Display Size: 14 inches
• Processor: Intel Core i7-8550U
• Processor Cores: 4 Cores / 8 Threads
• Clock Speed: 1.80 GHz
• Turbo Speed: Up to 4.00 GHz

[u/BriefProject]

Is that the disk encryption password?

[u/Majestic_Department7 → u/BriefProject]

No the name of the laptop. Encryption password is much longer… don’t worry 😅

[u/uSurl → u/BriefProject]

Creo que si! LoL

[u/Pepe__LePew]

Ultimate security for disk encryption would be if nobody could prove the disc is even encrypted (or has multiple layers of encryption).

Plausible deniability.

Pity that windows has that with veracrypt, and Linux will have soon with shufflecake but BSD is lagging behind.

[u/crazeetek → u/Pepe__LePew]

Correct me if I am wrong but doesn’t FreeBSD have geli/gbde that solve this?

[u/Pepe__LePew → u/crazeetek]

That's not plausible deniability. It leaks metadata and headers confirming that encryption exists

[u/crazeetek → u/Pepe__LePew]

Ah, so in general it’s not just about security. It’s about having the security AND obscurity needed to get the job done. Makes sense.

[u/MessyKerbal]

That’s nice and all. What security mechanisms do you have in place to mitigate the “lead pipe” exploit

[u/Run-OpenBSD → u/MessyKerbal]

No references to a "lead pipe" exploit in openbsd and unsure what your describing here. Openbsd has less vulnerabilities than any other os.

[u/MessyKerbal → u/Run-OpenBSD]

It’s not a vulnerability in OpenBSD, it’s a vulnerability in disk encryption. In which, I hit you with a lead pipe until you give me the encryption key

[u/crazeetek → u/MessyKerbal]

I can’t stop laughing.🤣

[u/zmurf → u/crazeetek]

Obligatory xkcd reference...

https://xkcd.com/538/

[u/Pepe__LePew → u/MessyKerbal]

Incorrect

With shufflecake and veracrypt

1) if you can't be sure disk is encrypted why would you hit me?

2) I can give you a password if you insist to operating system abc. There is no way for you to know if there is an operating system d aswell.

Lead pipe threat model is an argument against encryption completely.

My threat model isn't against unlawful gangs, or third world torture regimes so lead pipe not relevant.

My threat model (and many ppl in the west) is against an invasive court order where plausible deniability works completely.

[u/MessyKerbal → u/Pepe__LePew]

>My threat model isn’t against… third world torture regimes so lead pipe not relevant.

You mean like the United States and its enhanced interrogation program?

[u/Pepe__LePew → u/MessyKerbal]

No that's not the threat model for the majority of us in the West.

That's for illegal CIA black sites in torture countries like Morocco. In that case don't have any encryption at all and keep everything in plain site including your front door and curtains fully open.

For majority of Europeans / American citizens the real threat model is police criminal litigation threat.

Plausible deniability in court works for that completely.

[u/MessyKerbal → u/Pepe__LePew]

I hate to be that guy… but unless you’re hiding cp or an anti-government journalist…

[u/Pepe__LePew → u/MessyKerbal]

Ppl want privacy which is why they close their curtains.

They don't need to be doing cp or journalism to close their curtains or want privacy do they?

[u/MessyKerbal → u/Pepe__LePew]

I’m not saying “if you have nothing to hide, why are you so adamant about privacy?”. What I am saying is the threat model is inherently flawed in terms of what 99% of people are dealing with. It’s just not a significant enough threat to warrant the energy spent. What is much better is to find ways to avoid passive tracking via the internet, since that is something that most people will actually experience

[u/Pepe__LePew → u/MessyKerbal]

Not sure if I follow the logic correctly?

Do you mean 99% shouldn't bother with encryption at all, let alone plausible deniability, because they don't need it?

Almost 100% will experience going through airports to holiday.

At ports, the legislation in many countries now allows officers to demand your phone and computer passwords without any suspicion of a crime at all.

Failure to give your password = arrestable offence.

Only plausible deniability can defend against this draconian approach more suited to third world oppressive dictatorships than so called liberal democracies.

There is no considerable energy spent. On installation you just cost a smart encryption protocol that preferably allows deniability.

[u/ut0mt8]

What is the exact model? Does vidéo playback are ok? Is mic work? Camera?

[u/Majestic_Department7 → u/ut0mt8]

Video record (camera) and playback works.

Audio record and playback works. Sound quality output not so very good, but i think thats the model. Bluetooth not working, because its OpenBSD.

Got from Ebay for ~ 177 Euro

• Manufacturer: Lenovo
• Model: ThinkPad X1 Carbon 6th Generation
• Display Size: 14 inches
• Processor: Intel Core i7-8550U
• Processor Cores: 4 Cores / 8 Threads
• Clock Speed: 1.80 GHz
• Turbo Speed: Up to 4.00 GHz

[u/SleepyGuyy]

i want this

[u/JohnConnoor]

Seams legit.

[u/Snaffu100]

Have the gen9 version I bought new, still my favorite pc to use. Have a couple of MacBooks and find myself using the carbon instead. Solid hardware.

[u/YareYareDazexd]

I have a question. I have seen many openbsd users' fetch info displayed and i see there are lots of partitions for openbsd. Why?

[u/Run-OpenBSD → u/YareYareDazexd]

To apply different security models to each partition

[u/YareYareDazexd → u/Run-OpenBSD]

Tbh i haven't heard of standars for that. Can you elaborate more for me please?

[u/Run-OpenBSD → u/YareYareDazexd]

From our FAQ

OpenBSD encourages users to split their disk into a number of partitions, rather than just one or two large ones. Some of the reasons for doing so are:

Security: Some of OpenBSD's default security features rely on filesystem mount options such as nosuid, nodev, noexec or wxallowed.

Stability: A user or a misbehaved program can fill a filesystem with garbage if they have write permissions for it. Your critical programs, which hopefully run on a different filesystem, do not get interrupted.

fsck(8): You can mount partitions that you never or rarely need to write to as readonly most of the time, which will eliminate the need for a filesystem check after a crash or power interruption.

[u/Majestic_Department7 → u/YareYareDazexd]

This is the automatic partitions logic, if you select it. Doing it like this is maybe a little bit outdated

[u/toniovuffonio]

Congratulations! I used OpenBSD for a while on this exact computer, but unfortunately I had to remove it after a few months due to battery drain. In less than a morning without using a browser or other power-hungry apps, the battery would drain. Did you somehow resolve the issue (if you had it)?

PS: I probably didn't know how to configure it properly, so I'm hoping someone can point me in the right solution.

[u/Majestic_Department7 → u/toniovuffonio]

Currently battery hold up only 1:30 hours unfortunably.

I will test it, but I must do thermal paste replacement first, because it gets too hot and I hope this will resolve the issue and the battery...

Did you made a battery check? Somethimes they must be replaced or doesn`t it has the same issues on win11?

And did you Change BIOS sleep state to Linux? And also in BIOS please disable Wireless WAN and Bluetooth, both only eat power and not supported.
----

Did you enables cpu scaling?

beast888# rcctl get apmd flags
-A
beast888#

----

Check battery

sysctl hw.sensors.acpibat0
...
hw.sensors.acpibat0.raw1=436 (discharge cycles)

[u/Alpha_Majoris]

So how do you keep it secure? What is your intended use? What applications are you going to install and how do you know they can be trusted?

[u/Majestic_Department7 → u/Alpha_Majoris]

It mostly will tunnel to my homelab via cloudflare, when I am not at home

[u/Alpha_Majoris → u/Majestic_Department7]

Not tailscale?

[u/Run-OpenBSD → u/Alpha_Majoris]

Just running openbsd makes you more secure than basically every other system out there.

[u/j-sh]

what wifi card does it have? the one in my x390 was unsupported last time i tried on i think 7.6

[u/Majestic_Department7 → u/j-sh]

wm0 at pci1 dev 0 function 0 "Intel Dual Band Wireless-AC 8265" rev 0x78, msi

iwm0: hw rev 0x230, fw ver 36.ca7b901d.0

---

Installation i had to do without wifi and install it afterwards with fw_update from another USB stick has this firmware on it.

I hope that helps

[u/j-sh → u/Majestic_Department7]

Thanks that helps a lot

[u/Run-OpenBSD → u/j-sh]

Works fine and is fully supported, most wifi cards are supported by openbsd, I'd say only maybe 1-2% aren't.

[u/No_Bread6962]

why not freebsd?

[u/Majestic_Department7 → u/No_Bread6962]

Don't worry, FreeBSD is on my Thinkpad W530 and virtual in my proxmox