Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you encrypt your laptops?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 155 posts

Re: Ask HN: How do you encrypt your laptops?

#91

Post by hackney »

I own a Motion Computing R12 windows 7 pro tablet. It comes with WinMagic's SecureDoc Disk Encryption. I have not needed it simply because it is not used in a corp. work environment nor do I travel a lot. I login with my fingerprint for simplicities sake. My desktop is also windows 7 pro and both it and my tablet have just login passswords. I did buy a yubikey nano for my desktop which I use with password safe for all my logins. For my desktop I would probably use DiskCryptor. My android phone is encrypted however.

If you do not have tons of sensitive data to hide I see no reason to encrypt at present.

Re: Ask HN: How do you encrypt your laptops?

#92

Post by hackney »

acd wrote: post #37

I run Bitlocker on my Windows 10 machine it causes some issues with multibooting. Does anyone have a good multiboot disk encryption setup? On Linux I sometime use LUKS disk encryption. For adhoc disk container file disk encryption I use Veracrypt which is the successor of Truecrypt.

DiskCryptor https://diskcryptor.net/wiki/Main_Page

Full compatibility with third party boot loaders (LILO, GRUB, etc.). Encryption of system and bootable partitions with pre-boot authentication. Option to place boot loader on external media and to authenticate using the key media. Support for key files. Full support for external storage devices. Option to create encrypted CD and DVD disks. Full support for encryption of external USB storage devices. Automatic mounting of disk partitions and external storage devices. Support for hotkeys and optional command-line interface (CLI). DiskCryptor supports FAT12, FAT16, FAT32, NTFS and exFAT file systems.

Re: Ask HN: How do you encrypt your laptops?

#93

Post by jaeh »

gargravarr wrote: post #62
toyg wrote: post #55

Earlier quoted context omitted.

Yes, with a bit of setup and depending on your OS. My problem with hardware tokens is simply that I lose them.

I keep mine on my car keys. Problem solved.

Then you (inevitably, Murphy's ...) lose your car keys. Now you have two problems. :p

Re: Ask HN: How do you encrypt your laptops?

#94

Post by Razengan »

yardie wrote: post #88

Macbook Pro running El Capitan. The firmware is password locked so no one can change the boot disk, the SSD, Samsung 840 Pro, is encrypted with FileVault2. I also have guest access enableD to entice the unauthorised user to login and connect to the internet. Where I can lock or nuke the laptop using iCloud. One thing I missed about the old OpenFirmware Macs was that you could personalise a message into the firmware b…

> One thing I missed about the old OpenFirmware Macs was that you could personalise a message into the firmware boot screen like, "Call me: +1 305 555 222 for a reward!" The current FileVault login page has no such option.

Although not quite the boot screen, you can set a message on the user login screen, from System Preferences -> Security & Privacy -> Show a message when the screen is locked.

Also of course set it to require password after 1 minute or less after going to sleep (and going to sleep after a reasonable period of inactivity; I have mine set to 5 minutes) and disable automatic login.

Re: Ask HN: How do you encrypt your laptops?

#95

Post by cookiemonsta »

yardie wrote: post #88

Macbook Pro running El Capitan. The firmware is password locked so no one can change the boot disk, the SSD, Samsung 840 Pro, is encrypted with FileVault2. I also have guest access enableD to entice the unauthorised user to login and connect to the internet. Where I can lock or nuke the laptop using iCloud. One thing I missed about the old OpenFirmware Macs was that you could personalise a message into the firmware b…

"The firmware is password locked" - how did you enable this?

Re: Ask HN: How do you encrypt your laptops?

#96

Post by bedrovesen »

yardie wrote: post #88

Macbook Pro running El Capitan. The firmware is password locked so no one can change the boot disk, the SSD, Samsung 840 Pro, is encrypted with FileVault2. I also have guest access enableD to entice the unauthorised user to login and connect to the internet. Where I can lock or nuke the laptop using iCloud. One thing I missed about the old OpenFirmware Macs was that you could personalise a message into the firmware b…

Whats this guest access enableD you speak of? Sounds useful

Re: Ask HN: How do you encrypt your laptops?

#97

Post by Flimm »

astrobase_go wrote: post #35
AdmiralAsshat wrote: post #26

- Bitlocker on my Windows 10 Pro laptop (because I'm more concerned about an everyday thief prying open my laptop than a government agent) - ChromeOS built-in encryption/LUKS FDE on the Fedora partition on my Chromebook I should probably encrypt my Android phone and tablet, but I had a bad experience with performance overhead when I encrypted my last phone.

Depending on which version of Android you're running, you may be pleasantly surprised. Manually encrypted an HTC One m9 (Lollipop) and found no noticeable performance decrement, and now with it enabled by default in Marshmallow it's unnoticeable.

The main annoyance with full-disk encryption on Android is that it disables several handy features of the lock screen, such as being able to take a photo directly from the lock screen.

Re: Ask HN: How do you encrypt your laptops?

#98

Post by spilk »

eeZi wrote: post #87
spilk wrote: post #42

Earlier quoted context omitted.

Store your keys on a hardware token to reduce the chances of this happening (Nitrokey, Yubikey, OpenPGP smart card, etc.)

They'd backdoor your machine instead. Same result.

Same result? With something like a Yubikey you can't (excepting any vulnerabilities) extract the private key data even with the admin PIN codes. Based on your PIN caching preferences an attacker may be able to sign/encrypt/decrypt data with your keys (suggest setting force PIN for sign and low TTL for pin caching in gpg-agent) but they won't be able to exfiltrate your private keys.

Re: Ask HN: How do you encrypt your laptops?

#99

Post by discordance »

zeveb wrote: post #9

I'm running Debian, so I have LUKS full-disk encryption running; I consider it a sine qua non of running a personal computer. I wish it were a bit easier to enable per-user encrypted home directories as well (yes, layered: CPUs are fast, and security is worth the cost), but … I'm lazy.

May I ask a hypothetical?

If you were stopped at a border crossing and asked to unlock your drive for inspection, would you do so?

Re: Ask HN: How do you encrypt your laptops?

#100

Post by gaur »

coherentpony wrote: post #39
zeveb wrote: post #9

I'm running Debian, so I have LUKS full-disk encryption running; I consider it a sine qua non of running a personal computer. I wish it were a bit easier to enable per-user encrypted home directories as well (yes, layered: CPUs are fast, and security is worth the cost), but … I'm lazy.

For others: Sine qua non is an indispensable and essential action, condition, or ingredient. It was originally a Latin legal term for "[a condition] without which it could not be", or "but for..." or "without which [there is] nothing".

If a phrase is so foreign that you feel the need to italicize it, don't use it.
Post reply on HN