Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you encrypt your laptops?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 155 posts

Re: Ask HN: How do you encrypt your laptops?

#121

Post by jz_ »

_RPM wrote: post #77
witty_username wrote: post #66

Earlier quoted context omitted.

The grey coin-sized CMOS battery is alongside the motherboard. I suggest you look at the many guides and videos, just search "removing BIOS password".

That will work for sure? I'd have to really start taking things apart.

Not for sure. That trick is kinda old.

I had a Pentium III based HP laptop that stored the password on a chip that didn't require a battery to evade such a trick. The only fix was using the backdoor password that could be generated by using the serial number of the laptop (HP required proof of ownership, but I had dumpster dived this from their offices). The backdoor password was retrieved by wiring 50 USD to a fellow in the czech republic who had the keygen tool HP support would use.

Re: Ask HN: How do you encrypt your laptops?

#122

Post by hackney »

barking wrote: post #33
t3ra wrote: post #29

Earlier quoted context omitted.

Does this affect performance? Esp for things like photoshop?

I don't use photoshop, nor can I offer anything other than my perception but I haven't noticed performance being reduced in any way.

As for performance, per DiskCryptor's wiki (windows only): "On the Intel Core 2 Quad Q6600 CPU, data encryption speed amounts to 104 MB/s per core. The maximum speed of reading the data from a single hard disk equals to 80 MB/s so it can work with up to 5 different disks without loss of performance, when using the aforementioned type of processor. In case if your disks are not operating under a constant high load, then it is possible to work with even higher number of disks, and on a weaker system, without losing the performance."

I would assume this is true for all encryption schemes. But, really the most advanced stuff runs on linux based machines, I would proffer.

Re: Ask HN: How do you encrypt your laptops?

#123

Post by Mandatum »

Johnny_Brahms wrote: post #61
leejoramo wrote: post #36

Earlier quoted context omitted.

I have been looking for any sort of software review of VeraCrypt or suggestions by security experts that they use and recommend VeraCrypt. I want something more than unknown people in forums saying they use it.

Well then, use something battle tested like cryptsetup then. It is not as nice though.

I assume he's looking for an open-source option for Microsoft Windows. OSX and Linux is largely "solved". The Microsoft stack is less so after TrueCrypt's downfall.

Re: Ask HN: How do you encrypt your laptops?

#124

Post by PhantomGremlin »

discordance wrote: post #99
zeveb wrote: post #9

I'm running Debian, so I have LUKS full-disk encryption running; I consider it a sine qua non of running a personal computer. I wish it were a bit easier to enable per-user encrypted home directories as well (yes, layered: CPUs are fast, and security is worth the cost), but … I'm lazy.

May I ask a hypothetical? If you were stopped at a border crossing and asked to unlock your drive for inspection, would you do so?

If you were stopped at a border crossing and asked to unlock your drive for inspection, would you do so?

It's not necessary to cross a border anymore with anything "interesting" on your laptop.

Just push everything of value to the cloud before crossing. Carry a USB drive with an OS on it. Format your laptop before crossing. Let them have fun "inspecting". Oh, and I'd advise doing something like

   dd if=/dev/zero of=/dev/rdiskX bs=1m
before loading the clean OS. That way there's nothing of value on the drive even if forensic tools are used to look for previous data.

Or maybe just use a Chromebook. They can't force you to unlock access to any cloud accounts, can they? Certainly not as a pre-condition for crossing a border? With a court order, yes, but then you definitely need to get an attorney involved to protect you.

Re: Ask HN: How do you encrypt your laptops?

#125

Post by superobserver »

jaeh wrote: post #93
gargravarr wrote: post #62

Earlier quoted context omitted.

I keep mine on my car keys. Problem solved.

Then you (inevitably, Murphy's ...) lose your car keys. Now you have two problems. :p

Or stow a backup of your (yubikey) hardware in an encrypted (hopefully, zero-knowledge based) cloud service and restore when lost.

Re: Ask HN: How do you encrypt your laptops?

#126

Post by nickpsecurity »

coldtea wrote: post #83
kogepathic wrote: post #34

Earlier quoted context omitted.

Just so you're aware, the firmware password on a Mac can easily be bypassed by anyone with an SPI writer. [1] Using a teensy and a chip clip, someone can clear the password or bypass the password check completely. So, it will keep the honest out, but for someone who knows what they're doing, it will only prove a mild inconvenience. This obviously doesn't help them bypass FDE, but in case they want to steal the laptop…

FDE is not supposed to be an anti-stealing mechanism anyway. Besides any potential thief wont even know whether you're running FDE or not on the laptop they steal, or whether it would be bricked or not. They can always sell it for its parts (screen, etc) anyway.

It actually is a mechanism to reduce impact of theft. Someone with access to your computing hardware might modify it to subvert the system, read keystrokes, decrypt drive, leak it, and so on. This can be as simple as Customs installing something as you leave the country during an "inspection" then reading keys right off when you come back. Not saying it happens so much as a concern we had during a brainstorm. Or someone plugging in an attack tool into your Firewire port while you take a piss at Starbucks. Or you plug in USB drive they dropped with a radio and attack kit in its connector.

Whereas, if someone straight-up steals it, they have no chance of recovering data if the encryption is strong and key isn't in memory (eg cold boot). You can also transmit media through untrusted channels that way. Even NSA's Inline Media Encryptor, which my inspired my designs, has that use case.

Re: Ask HN: How do you encrypt your laptops?

#127

Post by CPAhem »

exodust wrote: post #67

No encryption here. For performance reasons I don't want encryption throttling my laptop CPU, or causing other issues. I use the standard Windows logon password, but no encryption of drives. I use keepass for my password encryption, and I bought Kruptos 2 Pro for whenever I need to encrypt individual files or folders. It works with dropbox, so I more of less have everything covered without needing to encrypt the whol…

We use a boot password + Microsoft bitlocker on our work laptops. We use Syncdocs http://syncdocs.com to encrypt all our Google Drive stuff.

The system works OK, and should keep data safe if a laptop gets stolen. Probably won't help against state actors, though.

Re: Ask HN: How do you encrypt your laptops?

#128

Post by cpbotha »

I find it interesting that nobody yet has mentioned TCG Opal with any of the latest popular consumer self-encrypting SSDs such as the Samsung EVOs and PROs.

You get full speed disk access and SSD friendly encryption (the disk is always encrypted anyways) and a relatively elegant way to install an unencrypted boot loader (PBA) that prompts you for your password.

There's a great open source Linux-based system for managing all of this (see my writeup https://vxlabs.com/2015/02/11/use-the-hardware-based-full-di... ) and I hear recent windows has built in support.

Re: Ask HN: How do you encrypt your laptops?

#129

Post by bitserf »

sigjuice wrote: post #110
cookiemonsta wrote: post #95

Earlier quoted context omitted.

"The firmware is password locked" - how did you enable this?

https://support.apple.com/en-us/HT204455

how is an Apple service provider able to bypass this? if they can, so can an adversary, no?

Re: Ask HN: How do you encrypt your laptops?

#130

Post by brbsix »

I use full-disk encryption via LVM on LUKS [0]. I rarely bother with per-user encrypted home directories since I'm the only user of the device and I don't leave it on while traveling or unattended.

For external drives and cloud storage I use EncFS via Gnome EncFS Manager [1], which makes it easy to keep track of and mount "stashes".

[0]: https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_...

[1]: http://www.libertyzero.com/GEncfsM

Post reply on HN