Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you encrypt your laptops?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 155 posts

Re: Ask HN: How do you encrypt your laptops?

#81

Post by jerf »

_RPM wrote: post #77
witty_username wrote: post #66

Earlier quoted context omitted.

The grey coin-sized CMOS battery is alongside the motherboard. I suggest you look at the many guides and videos, just search "removing BIOS password".

That will work for sure? I'd have to really start taking things apart.

Check HP for the service manual for your laptop. This is generally a standard goal the manual will give steps for. Usually all you need is a screwdriver of the right size and a bit of guts to pull apart bits of plastic, though I find my confidence that I'm not destroying anything is greatly enhanced when I'm following the manual and have reasonable confidence all the screws are out properly.

Re: Ask HN: How do you encrypt your laptops?

#82

Post by JaRail »

bb88 wrote: post #69
wepple wrote: post #57

Earlier quoted context omitted.

a 256-bit AES key might take eternity, but if it's derived directly from 8-char ASCII the search space is tiny. Somewhat does depend on how it's actually implemented in hardware, however.

Or even better, the key is determined randomly, and the 8 char password decrypts the key.

The 8 char password does not decrypt the key; it unlocks/retrieves it. The drive will only allow a fixed number of attempts. Once past the 10 or whatever allowed attempts, an attacker needs to brute force the full encryption key. It should be a very similar scheme to what you get with a modern smartphone, such as a new iPhone. (Not one of the older iphones the FBI cracked recently, a new one with a Secure Enclave.)

Re: Ask HN: How do you encrypt your laptops?

#83

Post by coldtea »

kogepathic wrote: post #34
ShaneOG wrote: post #2

I use Mac OS X FileVault2, with a firmware password. It's incredibly easy to set up and should be good enough to protect my data from the majority of thieves. Coupled with encrypted Time Machine backups and Arq[0] I feel relatively ok about losing my machine. [0] https://www.arqbackup.com

Just so you're aware, the firmware password on a Mac can easily be bypassed by anyone with an SPI writer. [1] Using a teensy and a chip clip, someone can clear the password or bypass the password check completely. So, it will keep the honest out, but for someone who knows what they're doing, it will only prove a mild inconvenience. This obviously doesn't help them bypass FDE, but in case they want to steal the laptop…

FDE is not supposed to be an anti-stealing mechanism anyway.

Besides any potential thief wont even know whether you're running FDE or not on the laptop they steal, or whether it would be bricked or not. They can always sell it for its parts (screen, etc) anyway.

Re: Ask HN: How do you encrypt your laptops?

#84

Post by eeZi »

d33 wrote: post #25
de_dave wrote: post #17

I use the standard hardware encryption of my SSD (a Samsung 830 in my 2012-era Dell XPS 13), which requires I enter the passphrase when I turn my machine on. Advantages: - OS neutral - Seemingly as fast as running 'unencrypted' (I assume performance is identical, the only difference being the passphrase is stored in my head rather than the BIOS) Disadvantages: - Limited to an 8-char (!) ASCII passphrase - I've no ide…

That sounds like an annoyance, not encryption to me.

It does actually encrypt your data, and if it's correctly implemented, it's fine. Those drives sell for a few years now and not a single exploit is known.

For most people this is more than enough.

Re: Ask HN: How do you encrypt your laptops?

#85

Post by DanBC »

wepple wrote: post #57
de_dave wrote: post #54

Earlier quoted context omitted.

Allegedly it's 256-bit AES and would take thousands of years to brute force. (Allegedly, because of course there's no way for me to easily verify!)

a 256-bit AES key might take eternity, but if it's derived directly from 8-char ASCII the search space is tiny. Somewhat does depend on how it's actually implemented in hardware, however.

Hopefully not like this: http://www.h-online.com/security/features/Enclosed-but-not-e...

That drive claimed 128 bit AES, but they botched it.

Re: Ask HN: How do you encrypt your laptops?

#87

Post by eeZi »

spilk wrote: post #42
georgestephanis wrote: post #7

Yup, encrypt every time. Otherwise, they may be able to snag your SSH RSA keys off of the hard drive, and if you've password protected it, they can try to brute force it. Also, it helps safeguard against border patrol wanting to access your data while traveling.

Store your keys on a hardware token to reduce the chances of this happening (Nitrokey, Yubikey, OpenPGP smart card, etc.)

They'd backdoor your machine instead. Same result.

Re: Ask HN: How do you encrypt your laptops?

#88

Post by yardie »

Macbook Pro running El Capitan. The firmware is password locked so no one can change the boot disk, the SSD, Samsung 840 Pro, is encrypted with FileVault2.

I also have guest access enableD to entice the unauthorised user to login and connect to the internet. Where I can lock or nuke the laptop using iCloud.

One thing I missed about the old OpenFirmware Macs was that you could personalise a message into the firmware boot screen like, "Call me: +1 305 555 222 for a reward!" The current FileVault login page has no such option.

Re: Ask HN: How do you encrypt your laptops?

#90

Post by t3ra »

Guest98123 wrote: post #41
t3ra wrote: post #29

Earlier quoted context omitted.

Does this affect performance? Esp for things like photoshop?

I use Photoshop daily, and play some Steam games once in a while. My laptop is an ultrabook with a SSD. I can't see any impact on performance. If there is an impact, I'd need to setup benchmarks to identify it.

Oh that sounds cool.. Have u tried any other fork of truecrypt?
Post reply on HN