Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do you encrypt your laptop's hard disk?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 135 posts

Re: Ask HN: Do you encrypt your laptop's hard disk?

#31

Post by MarcusL »

I'd use Bitlocker for your Windows 7 laptop, as a previous commenter noted it has a mode to work via a USB key inserted at boot time. In my experience it's been fast and unobtrusive. I've never used TrueCrypt, though I've looked into it several times and remembered thinking that it looked just as good (or better) technically as Bitlocker, but the UI is really horrid and overly complicated if you're looking for something that's a "no-brainer": http://www.truecrypt.org/screenshots

Bitlocker Tips:

1. You might have to enable it in your group policy (see http://www.sevenforums.com/tutorials/4681-bitlocker-drive-en...) for the option to use a USB key to show up.

2. You'll need the USB key inserted to power on the laptop or resume from hibernate, but not for waking it from sleep. That helps with convenience since you won't have to use the key to unlock it from sleep.

3. Make sure to back up the Bitlocker Recovery Key saved to the USB drive. It's saved as a hidden file, just put it somewhere safe online in case you lose the USB key.

4. Don't lose the USB key along with your laptop! Since that sort of defeats the point of encrypting the drive in the first place...

Re: Ask HN: Do you encrypt your laptop's hard disk?

#32

Post by Cockbrand »

rimantas wrote: post #8

OS X has FileVault which encrypts the home folder. I don't think I have any personal data outside of it. But I do use TrueCrypt too.

Does a TrueCrypted home directory get backed up by Time Machine? That's my biggest woe about FileVault - your home dir only gets backed up when you're logged out. Also, have you been able to run TrueCrypt as a non-admin user?

Re: Ask HN: Do you encrypt your laptop's hard disk?

#33

Post by thibaut_barrere »

Cockbrand wrote: post #30
thibaut_barrere wrote: post #12

Yes I do (since a few months): - http://agilewebsolutions.com/knox (one vault per client) on Mac OS X, including all db data if any - http://agilewebsolutions.com/products/1Password for all small-sized sensitive data (eg: production access, passwords etc), with an automated crypted backup I'm looking for a reliable and as seamless solution for Windows at my pace (not a big need). Something I'm also looking at is a wa…

There's a "securely erase free space" feature in Disk Utility, which does crash on me when I use it though, making a reboot necessary. Otherwise, you might simply use a one-liner like dd if=/dev/zero of=/tmp/free_space_eater; rm /tmp/free_space_eater This overwrites all unused space on the disk with zeroes. You'll temporarily run out of free diskspace with either option, so it's a good idea to do this when you're not…

Thanks for both tips. I didn't even think it could be built in! Mac OS kind of amazes me on a regular basis.

Re: Ask HN: Do you encrypt your laptop's hard disk?

#34

Post by shin_lao »

We use Jetico Bestcrypt VE. It's extremely secure and flexible.

http://www.jetico.com/encryption-bestcrypt-volume-encryption...

You do not require a TPM chip to use BitLocker, although it's better if you have one as the TPM makes it very difficult to tamper the boot code.

Use full volume encryption products (like BitLocker or Bestcrypt VE). There's always useful data in temporary files and it protects against leaving a sensitive file out of an encrypted volume.

Re: Ask HN: Do you encrypt your laptop's hard disk?

#35

Post by lovskogen »

I don't encrypt a bit — I even got no login password. I've got all my stuff on a 50GB Dropbox, so if I lose my MBP I'll just sync a new machine. Don't have anything of particular importance on my drive: design PSDs (could be secret), stock resources (icon packs, graphical elements), my music and a inspirational folder.

Re: Ask HN: Do you encrypt your laptop's hard disk?

#37

Post by acqq »

ENOTTY wrote: post #4

First off, I'd like to throw Bitlocker back in the ring and tell you that boot volume encryption is relatively unimportant for the threat model you propose, specifically untargeted data at rest. Boot volume encryption/verification is designed to protect you against attackers who would replace your boot image with a one that contains a rootkit or keylogger. This threat model requires serious forethought and planning o…

I don't agree with the above.

If we're talking about Windows, it's not "boot volume encryption" but the "C: disk encryption" that you have to worry about even if the attack scenario is data at rest. If you don't encrypt C: disk every forensic worker will trivially recover a lot of material that you'd believe was encrypted on another partition.

If we're talking about Linux where you configured /boot unencrypted and everything else encrypted, only then it's about the attack scenario that parent mentions.

Re: Ask HN: Do you encrypt your laptop's hard disk?

#38

Post by acqq »

nonane wrote: post #9
ENOTTY wrote: post #4

First off, I'd like to throw Bitlocker back in the ring and tell you that boot volume encryption is relatively unimportant for the threat model you propose, specifically untargeted data at rest. Boot volume encryption/verification is designed to protect you against attackers who would replace your boot image with a one that contains a rootkit or keylogger. This threat model requires serious forethought and planning o…

Excellent points. I said earlier that I wanted a no-brainer solution where I don't want to think / worry about where my applications or, even the OS decides to store my personal data - this is why whole-drive encryption looked attractive. However, an attacker would need some planning to get to that sort of data out - a common thief would probably not have that kind of skill anyway.

No, it's more the question of the goal of the "attacker" when you don't do the whole-drive encryption. If you have the data on the notebook that are worth a lot of money and you can imagine that somebody would be interested at that then you should encrypt the OS partition. Ever heard about page file? It's on the OS partition, unencrypted. Temporary files? There, unencrypted. Even if the temporary files are deleted, the content of them remains on the hard disk. Unencrypted.

Re: Ask HN: Do you encrypt your laptop's hard disk?

#39

Post by thibaut_barrere »

lovskogen wrote: post #35

I don't encrypt a bit — I even got no login password. I've got all my stuff on a 50GB Dropbox, so if I lose my MBP I'll just sync a new machine. Don't have anything of particular importance on my drive: design PSDs (could be secret), stock resources (icon packs, graphical elements), my music and a inspirational folder.

Do you work with clients ?

Re: Ask HN: Do you encrypt your laptop's hard disk?

#40

Post by DEinspanjer »

dotBen wrote: post #28
patrik wrote: post #23

Since most of my life exists in one way or another on my hard disk, I consider it to be an absolute must to encrypt the drives. I’m using PGP Whole Disk Encryption http://www.pgp.com/products/wholediskencryption/index.html , which works perfectly. I prefer it over OS X’s FileVault feature since it just protects everything and is completely transparent to the system and the user. And, btw, I’m still hoping for a mobil…

I'm weighing up going down this route - what kind of performance hit do you experience form using PGP WDE on your Mac? Thanks

Frankly, I've never noticed it being there other than when I do some extremely IO expensive operations like data processing. When I do that on my MPB though, I'm just testing it. That work belongs on a server anyway if you want it to be fast.
Post reply on HN