oddrefresh

PennyOS guide

Security

What protects a PennyOS device, what each layer stops, what it does not, and what to do when a device is lost.

A pocket computer is lost eventually. PennyOS is designed so that the day it happens costs you a device, not your accounts. The layers below stack; each one covers something the others do not.

What the device holds

  • A mirror of your wiki, and caches of mail, news, search results and dossiers.
  • Your notes and journal entries.
  • One SSH key that reaches your server through the gate.

It does not hold an Anthropic login, a mail password or token, search API keys, or the console token. Those stay on the server.

Layer 1: the gate

The device's key runs a fixed list of commands on your server and nothing else. See The gate. Stops: someone with the device getting a shell on your server, reading credentials, or writing anywhere but two inbox folders. Does not stop: reading the wiki or asking Claude through the allowed shapes, if they are past the PIN.

Layer 2: the PIN

Asked at every boot, before the terminal, when Journal opens, and after the quiet spell you choose. Wrong answers wait, doubling from two seconds to a minute. The hash is PBKDF2, in a file only the shell can read. The Beepy's keyboard has no function keys, so nothing on it can switch to another console around the lock.

Stops: someone picking the device up. Does not stop: someone who removes the card, which is what layer 3 is for.

Layer 3: the encrypted card

The data directory is a LUKS2 volume, cipher Adiantum, key derivation argon2id. Adiantum is used because the Pi Zero 2 W has no AES instructions, and it runs three to four times faster there than AES-XTS. The device's SSH private key lives inside the volume, so a pulled card does not yield the key to your server.

  • Set up with sudo tools/encrypt-card.sh, then set a PIN, which becomes the passphrase and removes the temporary keyfile. Until you do, Settings says "key still on the card" and the encryption stops nobody.
  • Use at least six characters with letters and digits. A LUKS passphrase can be attacked offline, and six digits falls in hours where six letters and digits takes years.
  • Forget the PIN and the data is gone.

Optional: the server as a key

Typing the PIN to open the card at every boot is slow, and on a Beepy every wake is a boot. So the server can hold a second random key, enrolled as a second slot on the card. A separate, root-owned boot key on the device, outside the volume, can fetch it through the gate's vaultkey shape and nothing else. At home the card opens by itself once Wi-Fi is up; away, the PIN still works. The shell asks for the PIN at every boot either way.

The trade: a lost device keeps being able to fetch that key while its boot key line is in your server's authorized_keys and it can reach the server. That is the same trade every network-bound disk encryption makes. Remove the line and it ends.

Layer 4: the box

  • SSH on the device takes keys only, for one user, with no root login and no forwarding.
  • The data directory is readable only by the shell's user.
  • The default password is replaced with one nobody knows.
  • Kernel and driver packages are held, so an unattended upgrade cannot change them.

Hosted hubs

Link's hub passes text in plaintext over HTTPS with a short expiry, and the channel id is the credential. If that is not acceptable for what you type, leave Link's monitor off, or run your own hub. See the privacy policy.

If a device is lost

  1. On your server, remove the device's lines from ~/.ssh/authorized_keys: the gated key, and the boot key if you set one up.
  2. Remove the device from your Tailscale tailnet.
  3. In Link, if you have another device paired, unpair to retire the channel.
  4. If you use Gmail with OAuth, the token is on the server, not the device, so nothing needs revoking there. Revoke it anyway if the server may be affected.

Known limits

  • PennyOS is pre-1.0 and has not been independently audited.
  • Passwordless sudo is left on the device's user, as Raspberry Pi OS ships, because updates depend on it. It is reachable only past the PIN or through SSH with a key.
  • Secure delete, on by default, and Wipe free space (Settings > Lock and card) overwrite files inside the encrypted volume. On SD flash that is best effort. The swap file and the system journal sit on the unencrypted root filesystem, outside the volume, and are not covered. Run fstrim after moving data into the volume.

Found a security problem? Use the Contact me button on this page before posting it anywhere.