Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do you encrypt your laptop's hard disk?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 135 posts

Ask HN: Do you encrypt your laptop's hard disk?

#1

Post by nonane »

I have a lot of personal and company information on 2 of my laptops (Windows 7 and a MacBook). This includes bank account information, private keys, passwords and proprietary source code. I'm always paranoid about my laptops being physically stolen while I'm traveling or if my office is robbed. To help put my mind at ease (somewhat), I've been looking into whole-drive encryption. Incase my laptop does get stolen, I can be sure the thief does not get my data.

It looks like there are 2 solutions out there for Windows - TrueCrypt and Microsoft's Bitlocker. I can't use Bitlocker because my laptop doesn't have a TPM chip, which I'm told is required to encrypt the boot volume. TrueCrypt looks like the only option available right now for Windows.

Also, it looks OS X does not have built-in whole-drive encryption like Window's Bitlocker. Luckily TrueCrypt also has support for OS X.

What do you use to protect your data? Are there any pitfalls that I need to be aware of (besides loosing your password)?

Re: Ask HN: Do you encrypt your laptop's hard disk?

#3

Post by proexploit »

I use TrueCrypt to protect my laptop. No chances in speed that I've noticed and as far as I understand it, it's quite secure. 30+ randomly generated password gets me in and it's a lot easier than you think to memorize and type quickly. I always feel like I must have made a mistake but can't remember the last time my fingers got it wrong. To me, it's kind of a no brainer. 3 extra seconds before boot is the only thing it takes to make sure my stolen laptop couldn't lead to stolen credit card numbers, accounts, business docs etc.

I've got no experience with Bitlocker, but I'm a huge fan of TrueCrypt.

Re: Ask HN: Do you encrypt your laptop's hard disk?

#4

Post by ENOTTY »

First off, I'd like to throw Bitlocker back in the ring and tell you that boot volume encryption is relatively unimportant for the threat model you propose, specifically untargeted data at rest.

Boot volume encryption/verification is designed to protect you against attackers who would replace your boot image with a one that contains a rootkit or keylogger. This threat model requires serious forethought and planning on the part of the attacker. He is likely targeting you or your company and he wants to do it steathily. Under this kind of threat, you really need the entire company to adopt an extremely high level of operational security. (Remember your security is only as strong as the weakest link in the chain.) Usually, this kind of paranoia is reserved for three letter agencies.

I should mention that Truecrypt doesn't protect against this threat either. At some point, there needs to be an unencrypted bootloader, which can be attacked. Hardware boot volume verification would verify that the bootloader has not been modified, which is what TPM tries to do.

Unless the encryption is implemented poorly (which in Truecrypt and Bitlocker is not) an attacker with access to your boot partition cannot attack your data partition without additional information (like your password).

On OS X, I've heard good things about PGP Whole Disk Encryption. I don't know if Truecrypt can handle Boot Camp (PGP WDE can), if you care about that at all. On Linux, I use dm-crypt + luks

Re: Ask HN: Do you encrypt your laptop's hard disk?

#6

Post by nonane »

tooto wrote: post #2

yes .. because I can. My macbook was stolen out of my flat this year and it was a good feeling not to have to worry about the data. don't get why you would encrypt your whole disk though. the home is all I need encrypted.

Good point. On Windows I have my data lying around in a few places (including a separate partition). I guess I want total peace of mind - for example, I don't want to worry about any data lying around in the hibernation files, crash dumps, /tmp etc.

Re: Ask HN: Do you encrypt your laptop's hard disk?

#7

Post by nonane »

jarin wrote: post #5

I keep all of my passwords encrypted in 1Password, and I have one encrypted folder on my Mac with all of my sensitive documents in it. I didn't want to encrypt my entire hard drive or even my entire home directory because of the performance hit.

I also have a password manager (KeePass) but I'm not as disciplined about keeping all my files in one place. Also, as I said in my earlier comment, I want to make sure everything on the hard disk is secure, include any system temp directories.

Re: Ask HN: Do you encrypt your laptop's hard disk?

#9

Post by nonane »

ENOTTY wrote: post #4

First off, I'd like to throw Bitlocker back in the ring and tell you that boot volume encryption is relatively unimportant for the threat model you propose, specifically untargeted data at rest. Boot volume encryption/verification is designed to protect you against attackers who would replace your boot image with a one that contains a rootkit or keylogger. This threat model requires serious forethought and planning o…

Excellent points. I said earlier that I wanted a no-brainer solution where I don't want to think / worry about where my applications or, even the OS decides to store my personal data - this is why whole-drive encryption looked attractive. However, an attacker would need some planning to get to that sort of data out - a common thief would probably not have that kind of skill anyway.

Re: Ask HN: Do you encrypt your laptop's hard disk?

#10

Post by pquerna »

nonane wrote: post #6
tooto wrote: post #2

yes .. because I can. My macbook was stolen out of my flat this year and it was a good feeling not to have to worry about the data. don't get why you would encrypt your whole disk though. the home is all I need encrypted.

Good point. On Windows I have my data lying around in a few places (including a separate partition). I guess I want total peace of mind - for example, I don't want to worry about any data lying around in the hibernation files, crash dumps, /tmp etc.

I use encrypted DMGs on osx, with specific folders symlinked to be inside the DMG, for example:

  /Users/chip/work/company -> /Volumes/enc-base/work/company
  /Users/chip/.subversion -> /Volumes/enc-base/dotfiles/subversion
  /Users/chip/.ssh -> /Volumes/enc-base/dotfiles/ssh
  /Users/chip/Library -> /Volumes/enc-base/Library
  /usr/local/mysql/current/data -> /Volumes/enc-base/mysql-data
I don't imagine its perfect, but I know most of my important and confidential things are encrypted.
Post reply on HN