I picked up a shitty NUC from ewaste and it had a label on it for an AI company

Using that you could set up networking and download the key from somewhere (say a remote KMS that would need user approval before continuing). So you would reduce your problem to being prompted on phone to unlock your desktop.

You could even use some sort of hardware key to prove request came from the physical server. (simplest might be a RP2350 with some key burnt in)

Or you could use something like SGX if it's still available anywhere to prove the same.

I do this with a gateway/router on a PC Engines APU2 that has an internal SSD.

Just ensure GRUB includes the requisite USB modules in its core image, or use grub-mkstandalone to include all modules in core.

Disclosure: I am a co-author of Mandos.

The answer to this type of thing is full disk encryption (FDE). There’s zero reason not to have it on every device at the block level. Especially if you’re going to be processing highly sensitive data.

You can’t even trust disks to actually delete things anyway. So the only way to be sure that information is not leaked is to prevent it from ever being persisted to disk in plaintext.

Stage 2: "For consistency, we'll handle our second and third secrets just like that first secret. Or handle them through our existing configuration management system, with just some minor tweaks."

Stage 3: "If we mess up the credentials for these edge devices, the software update, monitoring and remote management features will break and we'll have to recall the devices. We should be very cautious about making any changes."

Stage 4: "Even with a secret manager, we'd have to protect the credential used to access the secret manager. Not to mention a long-lived credential to bootstrap new devices, or re-image broken devices in the field. The real solution here is Secure Boot and credentials tied into the TPM. If we want to do this, we'll need a team of six full-time developers and our own custom linux distro"

Stage 5: "End-user features and business value are our priority right now, credential rotation is on the schedule for Q3 next year"

This hash of 24 chars is my password for that account. I don't trust any of the online password managers. Is this actually safe or not?

Note: this is not used for any of my professional work

Alternative approach, hang out outside your target location to figure out when/where they throw stuff, and when trash collectors come. Arrive somewhere in between and dumpster dive :)

- getting private numbers of known people (from "call Some Name")

- spam targeting from calendar event creation

- various private info available from dictated notes

Also, serious cloud providers (besides using server-grade hardware) have to follow proper equipment destruction and recycling procedures--Azure datacenters, for instance, used to have an on-site industrial shredder for disks (which were nevertheless hardware encrypted, but any failing storage was destroyed anyway).

In this case, there’s no indication of that and it’s so poorly handled that it radiates a startup winging it where they “didn’t have time” to hire anyone with a clue since the AI gold rush was right there. Given the reported healthcare data this seems like an especially bad choice.