mortar VS solo1

Bruteforce of such random password is just not plausible and talks about KDF "weakness" is just a distraction. I think most likely it was evil maid attack.

Here are projects which try to mitigate some of evil maid attack risks:

https://github.com/noahbliss/mortar

https://safeboot.dev/

Secure boot and TPM support (à la Mortar: https://github.com/noahbliss/mortar)

There are tools that look to be able to automate it: https://github.com/noahbliss/mortar/blob/master/docs/proxmox-install.md

I just went through the process of setting up new ubuntu VM's using full root disk LUKS encryption and auto-unlock via Proxmox's vTPM2.0 and UEFI ( via this extremely helpful resource https://github.com/noahbliss/mortar )

I have used this project with Debian+proxmox and it's been working great. https://github.com/noahbliss/mortar but I did read the arch wiki a bit which helped my understanding.

There's a project called "mortar" (as in, gluing all these bricks together) that was attempting to simplify this. Though it's lost steam, reading through it's simple bash scripts was a great place to start for me. This guide for Fedora also helped a lot.

There have been a number of attempts to solve this problem, but the most complete appear to be Mortar (a project I head) and safeboot.dev

I highly recommend taking a look at either of these projects if you want be able to improve both your convenience through auto unlocking, and security through broadened scope of audit.

https://github.com/noahbliss/mortar

https://safeboot.dev

Check out mortar. It uses secure boot and TPM along with LUKS. The creator is super helpful and available on the telegram.

A more advanced approach would be something like mortar to chain-load signed stuff.

There seems to be a workable solution out there for 2.0: https://github.com/noahbliss/mortar/blob/master/docs/proxmox-install.md

All phones ask for PIN or pattern in addition to face/fingerprint. Use that.

For the average user this is safe enough. (i.e) keep google/apple password safe. Then all is fine.

> exporting and FAANG lock-in

You don't ever have to even sign into FAANG if you can put up with inconvenience.

- Buy a U2F FIDO key like OPEN SOURCE https://solokeys.com/ or Yubikey etc

Try Solokeys https://solokeys.com v2 is open source USB-C and NFC compatible work with FIDO and web Auth.

Also take a look at solokeys. They are very affordable and support FIDO2 and FIDO U2F -- meaning they have overlapping protocols with Bitwarden, and they certainly work on Google.

Try This

You might want to check out https://solokeys.com/ then. They're pretty new (shipping for about a year) but they do full FOSS firmware & software as well as most hardware being FOSS as well.