Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you encrypt your laptops?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 155 posts

Re: Ask HN: How do you encrypt your laptops?

#111

Post by cyphar »

exodust wrote: post #67

No encryption here. For performance reasons I don't want encryption throttling my laptop CPU, or causing other issues. I use the standard Windows logon password, but no encryption of drives. I use keepass for my password encryption, and I bought Kruptos 2 Pro for whenever I need to encrypt individual files or folders. It works with dropbox, so I more of less have everything covered without needing to encrypt the whol…

I've never felt performance issues with full disk encryption, and I personally wouldn't feel safe carrying my laptop if I didn't have it.

Re: Ask HN: How do you encrypt your laptops?

#113

Post by 0942v8653 »

bedrovesen wrote: post #96
yardie wrote: post #88

Macbook Pro running El Capitan. The firmware is password locked so no one can change the boot disk, the SSD, Samsung 840 Pro, is encrypted with FileVault2. I also have guest access enableD to entice the unauthorised user to login and connect to the internet. Where I can lock or nuke the laptop using iCloud. One thing I missed about the old OpenFirmware Macs was that you could personalise a message into the firmware b…

Whats this guest access enableD you speak of? Sounds useful

System Preferences > Users & Groups > Guest User > Allow guests to log onto this computer

"If FileVault is turned on guest users can only access Safari."

Re: Ask HN: How do you encrypt your laptops?

#114

Post by Guest98123 »

whamlastxmas wrote: post #80
Guest98123 wrote: post #4

I just use Truecrypt 7.1a, and encrypt the entire drive, so it requires a password before booting.

What laptop do you have? Truecrypt doesn't support UEFI which seems to be the only option every laptop has these days.

Samsung Series 9. It's almost three years old now, so that explains the lack of UEFI.

Re: Ask HN: How do you encrypt your laptops?

#115

Post by na85 »

JaRail wrote: post #82
bb88 wrote: post #69

Earlier quoted context omitted.

Or even better, the key is determined randomly, and the 8 char password decrypts the key.

The 8 char password does not decrypt the key; it unlocks/retrieves it. The drive will only allow a fixed number of attempts. Once past the 10 or whatever allowed attempts, an attacker needs to brute force the full encryption key. It should be a very similar scheme to what you get with a modern smartphone, such as a new iPhone. (Not one of the older iphones the FBI cracked recently, a new one with a Secure Enclave.)

What stops the attacker from just imaging the drive in its encrypted state and continuing to run attacks on the 8 char password well in excess of 10 attempts?

Re: Ask HN: How do you encrypt your laptops?

#116

Post by na85 »

0942v8653 wrote: post #101
gaur wrote: post #100

Earlier quoted context omitted.

If a phrase is so foreign that you feel the need to italicize it, don't use it.

On the other hand, it's quite nice to be on Hacker News where someone will post the definition :) ... now I know what that phrase means when I hear it in another context.

Nah, it's just the standard HN-ian modus operandi of misusing Latin phrases like a priori which doesn't actually mean "prior" or "prior knowledge" despite the incessant use here on this site.

How else would I attempt to appear superior? :^)

Re: Ask HN: How do you encrypt your laptops?

#117

Post by naedish »

na85 wrote: post #116
0942v8653 wrote: post #101

Earlier quoted context omitted.

On the other hand, it's quite nice to be on Hacker News where someone will post the definition :) ... now I know what that phrase means when I hear it in another context.

Nah, it's just the standard HN-ian modus operandi of misusing Latin phrases like a priori which doesn't actually mean "prior" or "prior knowledge" despite the incessant use here on this site. How else would I attempt to appear superior? :^)

Except he used it correctly here, didn't he? He could have said condicio sine qua non but my understanding is that either would be accepted usage.

Re: Ask HN: How do you encrypt your laptops?

#118

Post by jcrawfordor »

dmd wrote: post #112
jkot wrote: post #49

Earlier quoted context omitted.

I think hdd will wipe itself after N incorrect attempts.

So you copy the drive first.

Encryption is done in drive hardware, so copying the drive is possible via hardware attacks but would be a pretty involved lab operation. Would definitely take longer and require more sophistication than many in-practice crypto exploits.

Re: Ask HN: How do you encrypt your laptops?

#119

Post by jcrawfordor »

na85 wrote: post #115
JaRail wrote: post #82

Earlier quoted context omitted.

The 8 char password does not decrypt the key; it unlocks/retrieves it. The drive will only allow a fixed number of attempts. Once past the 10 or whatever allowed attempts, an attacker needs to brute force the full encryption key. It should be a very similar scheme to what you get with a modern smartphone, such as a new iPhone. (Not one of the older iphones the FBI cracked recently, a new one with a Secure Enclave.)

What stops the attacker from just imaging the drive in its encrypted state and continuing to run attacks on the 8 char password well in excess of 10 attempts?

The drive controller does not allow you to read the encrypted form of the data out. This kind of drive-encryption is the same as the common ATA lock command (implemented in your BIOS and the drive controller), but the drive controller actually encrypts the data as well as just refusing to work without being unlocked first.

Re: Ask HN: How do you encrypt your laptops?

#120

Post by jcrawfordor »

mkohlmyr wrote: post #65
wepple wrote: post #59

Earlier quoted context omitted.

What about session tokens to cloud services you likely use?

My primary accounts are not left logged in. I don't let my browser auto-fill passwords. Github for example has two-factor enabled. I somewhat regularly clean my browser data. If a nation-state wants to "get me", they will. In fact most of us would probably not be able to withstand a targeted attack by a skilled or simply motivated attacker. I don't expect my hard-drive being encrypted would save me in court. I probab…

There are a lot of low-hanging fruit forensic techniques that would allow for recovery of data that was once on the device and you now think to be gone, like session tokens and cookies. One of the major reasons to use full-drive encryption is so that these forensic artifacts will be encrypted in addition to the files you still actually keep around. This is also why you should enable full-disk encryption at the very beginning, OR wait while the entire drive is rewritten when you enable it.
Post reply on HN