I would like to be able to keep my data as secure as possible, so can I make use of the finger print scanner in addition to my password for disk decryption in Qubes? What about using a key file stored on a USB? I know about the yubi key, but hopefully I can use all three.
Thanks.
Don’t waste your time with biometrics.
If you really want to improve your security, you may want to take a look at using a YubiKey or something similar.
You can store a key file on a USB - this is straightforward and well
documented. the same for using a YubiKey or similar.
Using a fingerprint scanner is not straightforward, and not well
documented.
But it reads as if you want to use all three together for disk
encryption, and I don’t think this is possible, because LUKS uses a single
key slot.
What you could do is cascade the devices:
Unlock the machine with your fingerprint.
Password protect the USB device, where the keyfile is stored.
Load the keyfile.
This is quite straightforward, depending on what hardware you have. If
you need help, explain what you have done and where you are stuck.
When working with LUKS there are a number of keyslots you can use. Use
a new slot when you are changing configuration. That way you can
always fall back to original password. Once you are happy, delete the
old key slot.
What I’ve settled for is storing a keyfile on a fingerprint unlocked physical USB.