Additional security

[Andrzej Andrzej]

I know that these two proposals may seem paranoid about security, so they could be at least optional and not default. I would like to have them enabled.

1. When decrypting the drive and entering the password after eg 4 incorrect passwords, the data could start to be erased. Maybe this is not an amazing option because the drive is encrypted but it is always an additional security measure in case of unauthorized attempt to access the computer.

2.Automatic screen lock every x minutes. I'm not talking here about a screen saver that works in a situation of inactivity. I am talking here about a tool that for example every 60 minutes would automatically block the screen with password. It may seem that this option does not make sense because there is a screen saver. Keep in mind that the screen saver will not work when someone pulls us away from the computer by force and use computer. If my option was implemented in Qubes OS then even in this situation it would be difficult to use the computer because after x minutes the computer would want the password even in the case of continuous user activity.

[qtpie]

'Andrzej Andrzej' via qubes-devel:

> I know that these two proposals may seem paranoid about security, so they could be at least optional and not default. I would like to have them enabled.
>
> 1. When decrypting the drive and entering the password after eg 4 incorrect passwords, the data could start to be erased. Maybe this is not an amazing option because the drive is encrypted but it is always an additional security measure in case of unauthorized attempt to access the computer.
>

I would expect this to be part of cryptsetup, but its not? Read here for
an idea how to set this up yourself:
https://unix.stackexchange.com/questions/204669/automatically-shred-luks-partition-upon-x-failed-decryption-attempts#204681

> 2.Automatic screen lock every x minutes. I'm not talking here about a screen saver that works in a situation of inactivity. I am talking here about a tool that for example every 60 minutes would automatically block the screen with password. It may seem that this option does not make sense because there is a screen saver. Keep in mind that the screen saver will not work when someone pulls us away from the computer by force and use computer. If my option was implemented in Qubes OS then even in this situation it would be difficult to use the computer because after x minutes the computer would want the password even in the case of continuous user activity.
>

This is definitely not for everybody as you say, but really easy to
setup yourself by adding a cronjob for xflock4 in dom0.

[qtpie]

'Andrzej Andrzej' via qubes-devel:

> I know that these two proposals may seem paranoid about security, so they could be at least optional and not default. I would like to have them enabled.
>
> 1. When decrypting the drive and entering the password after eg 4 incorrect passwords, the data could start to be erased. Maybe this is not an amazing option because the drive is encrypted but it is always an additional security measure in case of unauthorized attempt to access the computer.
>
> 2.Automatic screen lock every x minutes. I'm not talking here about a screen saver that works in a situation of inactivity. I am talking here about a tool that for example every 60 minutes would automatically block the screen with password. It may seem that this option does not make sense because there is a screen saver. Keep in mind that the screen saver will not work when someone pulls us away from the computer by force and use computer. If my option was implemented in Qubes OS then even in this situation it would be difficult to use the computer because after x minutes the computer would want the password even in the case of continuous user activity.
>

These are valid concerns, but as you say not for everybody. But you can
set this up yourself, especially the second one. About the first option
read here:
https://unix.stackexchange.com/questions/204669/automatically-shred-luks-partition-upon-x-failed-decryption-attempts#204681.
They second option you can setup by putting a cronjob for xflock4.

[Andrzej Andrzej]

I know that I can do everything in the system myself and I can even rebuild Qubes OS according to my own vision, but in my opinion, qubes-devel is a group where everybody can submit ideas about the content and functionality of the system and these are my two ideas and probably some people wanted to use it and this two ideas are completely compatible with the idea behind the Qubes OS system

[Andrzej Andrzej]