Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you encrypt your laptops?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 155 posts

Re: Ask HN: How do you encrypt your laptops?

#61

Post by Johnny_Brahms »

leejoramo wrote: post #36
Johnny_Brahms wrote: post #11

So, the dawn of SSDs has made hibernation and sleep redundant. I use FDE for my SSD (luks, and whatever good defaults ubuntu gives me). As for the cloud, I store nothing sensitive on there. I used truecrypt, but now I find VeraCrypt easier to use and install. I lost my last installer of truecrypt, and I don't trust the ones floating around. VeraCrypt hasn't been audited yet. This is a bad thing :)

I have been looking for any sort of software review of VeraCrypt or suggestions by security experts that they use and recommend VeraCrypt. I want something more than unknown people in forums saying they use it.

Well then, use something battle tested like cryptsetup then. It is not as nice though.

Re: Ask HN: How do you encrypt your laptops?

#62

Post by gargravarr »

toyg wrote: post #55
jason_slack wrote: post #52

Earlier quoted context omitted.

the way I read about Yubikey is that it is for websites, accounts, etc. Can you use it to log into your actual OS?

Yes, with a bit of setup and depending on your OS. My problem with hardware tokens is simply that I lose them.

I keep mine on my car keys. Problem solved.

Re: Ask HN: How do you encrypt your laptops?

#63

Post by _RPM »

witty_username wrote: post #43
_RPM wrote: post #38

Earlier quoted context omitted.

It reminds me of how I set a boot password in the BIOS on my HP laptop. I now have forgot the admin password in order to remove that "feature". I have no idea how I can fix it. The laptop is bricked. I can't install Linux on it because it is set not to boot from USB or CD/ROM

> I have no idea how I can fix it. Just disconnect the CMOS batteries; you can find tutorials online. Or you can take it to a computer shop, it should be a simple fix.

Where are those located?

Re: Ask HN: How do you encrypt your laptops?

#64

Post by jrruethe »

Johnny_Brahms wrote: post #11

So, the dawn of SSDs has made hibernation and sleep redundant. I use FDE for my SSD (luks, and whatever good defaults ubuntu gives me). As for the cloud, I store nothing sensitive on there. I used truecrypt, but now I find VeraCrypt easier to use and install. I lost my last installer of truecrypt, and I don't trust the ones floating around. VeraCrypt hasn't been audited yet. This is a bad thing :)

Downloads: https://github.com/jrruethe/truecrypt

Verify the GPG key fingerprint and hashes: https://news.ycombinator.com/item?id=7812905

Re: Ask HN: How do you encrypt your laptops?

#65

Post by mkohlmyr »

wepple wrote: post #59
mkohlmyr wrote: post #32

I don't have any files on my personal laptop. I have a USB key or two on my key-ring, and in theory I have an external hard-drive although currently I don't use it. I keep code on a VM and GitHub. In general I don't really have anything I can't lose or have made public. Instead of looking at my laptop as a thing I have to protect I look at it as a thing that will inevitably be lost, damaged or replaced.

What about session tokens to cloud services you likely use?

My primary accounts are not left logged in. I don't let my browser auto-fill passwords. Github for example has two-factor enabled. I somewhat regularly clean my browser data.

If a nation-state wants to "get me", they will. In fact most of us would probably not be able to withstand a targeted attack by a skilled or simply motivated attacker.

I don't expect my hard-drive being encrypted would save me in court. I probably wouldn't ultimately withstand a prolonged beating in defense of it either.

It all comes down to whether your juice is worth the squeeze. I have very little juice (on display), and I don't give anyone much reason to suspect there's more juice out there.

Re: Ask HN: How do you encrypt your laptops?

#66

Post by witty_username »

_RPM wrote: post #63
witty_username wrote: post #43

Earlier quoted context omitted.

> I have no idea how I can fix it. Just disconnect the CMOS batteries; you can find tutorials online. Or you can take it to a computer shop, it should be a simple fix.

Where are those located?

The grey coin-sized CMOS battery is alongside the motherboard.

I suggest you look at the many guides and videos, just search "removing BIOS password".

Re: Ask HN: How do you encrypt your laptops?

#67

Post by exodust »

No encryption here. For performance reasons I don't want encryption throttling my laptop CPU, or causing other issues.

I use the standard Windows logon password, but no encryption of drives.

I use keepass for my password encryption, and I bought Kruptos 2 Pro for whenever I need to encrypt individual files or folders. It works with dropbox, so I more of less have everything covered without needing to encrypt the whole thing.

Re: Ask HN: How do you encrypt your laptops?

#68

Post by ansible »

zeveb wrote: post #22
ansible wrote: post #13

Earlier quoted context omitted.

I don't understand... If you've got the requisite ecryptfs packages installed, you can just run something like: "adduser --encrypt-home newusername" and there you go. It works on top of any filesystem, because it encrypts on a per-file basis.

Yeah, but (last time I installed) that wasn't an option at install time.

So then just don't create your main user account at install time. I'm usually creating an 'admin' user at that point anyway.

The main thing to watch out for is to add new users appropriately to some system groups like sudo, cdrom, audio and such.

Re: Ask HN: How do you encrypt your laptops?

#69

Post by bb88 »

wepple wrote: post #57
de_dave wrote: post #54

Earlier quoted context omitted.

Allegedly it's 256-bit AES and would take thousands of years to brute force. (Allegedly, because of course there's no way for me to easily verify!)

a 256-bit AES key might take eternity, but if it's derived directly from 8-char ASCII the search space is tiny. Somewhat does depend on how it's actually implemented in hardware, however.

Or even better, the key is determined randomly, and the 8 char password decrypts the key.

Re: Ask HN: How do you encrypt your laptops?

#70

Post by jasonpeacock »

robgibbons wrote: post #8
codegeek wrote: post #5

Earlier quoted context omitted.

Thx. I am a relatively new Mac user and didn't realize this existed. Will try this. Any weird issues or edge cases to consider before turning this on ?

Yes. FileVault is awesome, but if your encrypted filesystem ever gets corrupted (which can and does happen), your encrypted data is useless and your volume is toast until it's wiped and re-imaged. Surprisingly I have never had this happen, but more than one friend has reported losing their data due to FS corruption with FileVault enabled. I suppose it can be mitigated with a solid Time Machine/backup routine.

Yep, happened to me and I've never used FileVault again.

I had a TimeMachine backup too but hadn't synced recently and ended up doing a bunch of hackery to recover the un-synced data :(

I much prefer 2FA & revocable certificates on remote accounts so I'm not worried about unauthorized access, and anything else important is encrypted independently.

Post reply on HN