{"action":"created","issue":{"url":"https://api.github.com/repos/QubesOS/qubes-antievilmaid/issues/20","repository_url":"https://api.github.com/repos/QubesOS/qubes-antievilmaid","labels_url":"https://api.github.com/repos/QubesOS/qubes-antievilmaid/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/QubesOS/qubes-antievilmaid/issues/20/comments","events_url":"https://api.github.com/repos/QubesOS/qubes-antievilmaid/issues/20/events","html_url":"https://github.com/QubesOS/qubes-antievilmaid/pull/20","id":251954645,"number":20,"title":"Making AEM resistant against shoulder surfing and video surveillance","user":{"login":"phagara","id":15424041,"avatar_url":"https://avatars1.githubusercontent.com/u/15424041?v=4","gravatar_id":"","url":"https://api.github.com/users/phagara","html_url":"https://github.com/phagara","followers_url":"https://api.github.com/users/phagara/followers","following_url":"https://api.github.com/users/phagara/following{/other_user}","gists_url":"https://api.github.com/users/phagara/gists{/gist_id}","starred_url":"https://api.github.com/users/phagara/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phagara/subscriptions","organizations_url":"https://api.github.com/users/phagara/orgs","repos_url":"https://api.github.com/users/phagara/repos","events_url":"https://api.github.com/users/phagara/events{/privacy}","received_events_url":"https://api.github.com/users/phagara/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":16,"created_at":"2017-08-22T13:20:51Z","updated_at":"2018-02-12T02:39:37Z","closed_at":"2018-02-12T02:24:46Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/QubesOS/qubes-antievilmaid/pulls/20","html_url":"https://github.com/QubesOS/qubes-antievilmaid/pull/20","diff_url":"https://github.com/QubesOS/qubes-antievilmaid/pull/20.diff","patch_url":"https://github.com/QubesOS/qubes-antievilmaid/pull/20.patch"},"body":"Observing the user during early boot should not be sufficient to defeat the protection offered by Anti Evil Maid (AEM). Using time based one-time passwords instead of simple static secret text helps avoid screen observation based attacks. Installation of the improved AEM on removable media along with usage of Linux Unified Key Setup (LUKS) key files deters keyboard observation, as an attacker would also need to seize the boot media. These enhancements are then made even stronger by adding revokable TPM assisted anti-replay protection for AEM secrets.\r\n\r\nSupport for png image static secrets was, after a [brief discussion on qubes-devel mailing list](https://groups.google.com/d/topic/qubes-devel/PsTA-3m0xA0/discussion), dropped. This vastly simplified the resulting code, while the new features introduced in this PR should serve as an adequate replacement.\r\n\r\nThe AEM installation process was simplified by automating some of the previously manual steps. Readme was enhanced with compromise recovery guides.\r\n\r\nhttps://github.com/qubesOS/qubes-issues/issues/1979 should now be resolved, as the multi-factor AEM changes make use of encrypted & TPM-sealed LUKS key files.\r\n\r\nThis pull request is the product of the [Google Summer of Code project for Qubes OS](https://summerofcode.withgoogle.com/projects/#5132236411109376). For progress reports and discussion, please see the associated [qubes-devel mailing list thread](https://groups.google.com/d/topic/qubes-devel/8cAjSyg1msM/discussion) and the earier [pull request against project mentor's fork](https://github.com/rustybird/qubes-antievilmaid/pull/1) (which contains additional comments). The original [project proposal](https://github.com/phagara/gsoc2017-qubes-aem-proposal/releases/tag/user_0c97e0f1) is also still available -- although a bit outdated, as some minor alterations to the proposed implementation details were made during the coding phase of GSoC.\r\n\r\nMany thanks to my mentor, @rustybird, for a lot of insightful comments and help with the final \"few\" touches to make this work ready to be submitted."},"comment":{"url":"https://api.github.com/repos/QubesOS/qubes-antievilmaid/issues/comments/364816749","html_url":"https://github.com/QubesOS/qubes-antievilmaid/pull/20#issuecomment-364816749","issue_url":"https://api.github.com/repos/QubesOS/qubes-antievilmaid/issues/20","id":364816749,"user":{"login":"marmarek","id":726704,"avatar_url":"https://avatars1.githubusercontent.com/u/726704?v=4","gravatar_id":"","url":"https://api.github.com/users/marmarek","html_url":"https://github.com/marmarek","followers_url":"https://api.github.com/users/marmarek/followers","following_url":"https://api.github.com/users/marmarek/following{/other_user}","gists_url":"https://api.github.com/users/marmarek/gists{/gist_id}","starred_url":"https://api.github.com/users/marmarek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marmarek/subscriptions","organizations_url":"https://api.github.com/users/marmarek/orgs","repos_url":"https://api.github.com/users/marmarek/repos","events_url":"https://api.github.com/users/marmarek/events{/privacy}","received_events_url":"https://api.github.com/users/marmarek/received_events","type":"User","site_admin":false},"created_at":"2018-02-12T02:39:37Z","updated_at":"2018-02-12T02:39:37Z","author_association":"OWNER","body":"Thank you, and sorry for extremely long waiting time!\r\n\r\nPackage uploaded to testing repository: https://github.com/QubesOS/updates-status/issues/405\r\n@andrewdavidwong do we want some announcement (on any channel(s))? "}}
{"actor":{"display_login":"marmarek"}}