6

I was recently recommended a set of smart cards that don't feature key backup methods. However they do have a way to import plaintext keys, meaning a key ceremony is the way to go for key redundancy.

This yields very special requirements for a laptop being used for this ceremony for which I'd like to ask for a recommendation.

Requirements:

  • Must feature a removable battery

  • Must feature a (somewhat easily) removable BIOS battery

  • Must feature a removable drive

  • Must be able operate without a persistent storage drive

  • Must be able to boot from a CD / DVD either via USB or internally

  • Must feature at least three USB type A ports

  • Must be able to operate with Linux derivatives

  • Should have as much open-source firmware or security certifications as possible

  • Price should be sub 500 USD if possible

  • Removing the bios battery would require taking apart the whole laptop. Can I post a spirit of the rules, not the letter of the rules answer? a NUC class machine might work very well here, and/or an older machine. – Journeyman Geek Apr 30 '16 at 0:25
  • @JourneymanGeek, the machine doesn't have to be new, as long as you're certain that I can buy it somewhere. However it must be a laptop, because it's easier to securely store (-> vault) a laptop than a NUC with keyboard, monitor and possibly mouse. – SEJPM Apr 30 '16 at 9:08
6

I think the most useful way to answer this question is to start with the hardest part of the answer and work my way down

should have as much open-source firmware or security certifications as possible. As such my starting point would be the coreboot page, since that lists systems which support opensource firmware

I'm picking thinkpads here. I'm familiar with them, and the removable parts are mostly trivial.On this list, the T60 look handy. many of these features are found on newer thinkpads, but its worth considering some of the modern, boneheaded moves lenovo has made. The newer ones have worse keyboards, and of course, you need to find a superfish free version. Go with intel graphics in any case. Further research shows that "Ministry of Freedom" sells somewhat newer models than my initial recommendation of a T60 preflashed and those are worth a look. That said, the features I like about the T60 are true here too.

Lets go down your list. I have an R60, and its the 'cheap' equivilent of an T60 so I have a decent idea what the features are. Being a thinkpad, thinkwiki has a great rundown on the features.

Yes, its an older machine, but I have them running reliably with minor upgrades. They're really nice machines with a low end SSD.

Must feature a removable battery

Two latches and it pops out

Must feature a (somewhat easily) removable BIOS battery

Requires removal of the keyboard and that's about it. 3-4 screws, and you don't even need a service manual to find it. Bit finicky, and I'd recommend a spudger and a small screwdrive (cross head). There's a video here on the process.

Must feature a removable drive

Its an old school thinkpad. One screw, pop out the cover, yank the drive

Must be able operate without a persistent storage drive

R60's USB bootable. I've done it a few times. Maxing out the ram might be an idea.

Must be able to boot from a CD / DVD either via USB or internally

Yup. Onboard, standard ATAPI drive, boots off USB fine.

Must feature at least three USB type A ports

Yes

Must be able to operate with Linux derivatives

As an older machine, compatibility is solid. I'd be reasonably confident even running a full DE on it, though my machines run windows 10 or xubuntu/lubuntu.

Should have as much open-source firmware or security certifications as possible

Price should be sub 500 USD if possible

Ebay prices are significantly below that. Could even buy spares. I strongly recommend maxing out the ram if possible.

These are solid machines, and despite their age hold up well.

| improve this answer | |
  • Maybe a stupid question, but do you link to the T61 entry instead of the T60 entry on purpose? – SEJPM May 22 '16 at 14:19
  • I'd gotten them confused at the time. I'll look at fixing it. – Journeyman Geek May 22 '16 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.