51–60 of 135 posts
OS X has FileVault which encrypts the home folder. I don't think I have any personal data outside of it. But I do use TrueCrypt too.
Does a TrueCrypted home directory get backed up by Time Machine? That's my biggest woe about FileVault - your home dir only gets backed up when you're logged out. Also, have you been able to run TrueCrypt as a non-admin user?
Since most of my life exists in one way or another on my hard disk, I consider it to be an absolute must to encrypt the drives. I’m using PGP Whole Disk Encryption http://www.pgp.com/products/wholediskencryption/index.html , which works perfectly. I prefer it over OS X’s FileVault feature since it just protects everything and is completely transparent to the system and the user. And, btw, I’m still hoping for a mobil…
I'm weighing up going down this route - what kind of performance hit do you experience form using PGP WDE on your Mac? Thanks
One thing to consider, however, are SSDs. To my knowledge, encrypted data is only written to blocks that already contain random data. You therefore might want to look for disks whose performance does not degrade that much when free blocks are no longer available.
I'd love to just go the whole hog and encrypt the whole drive, but as a developer I jealously guard performance as I feel it links directly to my productivity. So I just have an encrypted Truecrypt volume where really sensitive stuff goes. But I hear everyone recommending against that.
First off, I'd like to throw Bitlocker back in the ring and tell you that boot volume encryption is relatively unimportant for the threat model you propose, specifically untargeted data at rest. Boot volume encryption/verification is designed to protect you against attackers who would replace your boot image with a one that contains a rootkit or keylogger. This threat model requires serious forethought and planning o…
I'll have to respectfully disagree here. Windows has heaps of different ways of caching all kinds of information outside of your home folder. Individual applications can also cache stuff wherever permissions allow (and often do). Realistically with Windows if you're going to encrypt you want to encrypt your C: drive.
PGP WDE works, it's 'good enough' to be a PITA for any authorities and you can use the same software on PC and Mac, but be warned - PGP broke Snow Leopard upgrades from Leopard when it came out and every major PGP upgrade I've ever done on Windows has resulted in a reinstall (but then again, 9.x was really, really bad).
If you're using a non-administrator account for your day to day on OSX you can use FileVault - just watch your /tmp folder.
Question: for developers out there, what is the overhead of full encryption on your hard drive for a development laptop? I'd love to just go the whole hog and encrypt the whole drive, but as a developer I jealously guard performance as I feel it links directly to my productivity. So I just have an encrypted Truecrypt volume where really sensitive stuff goes. But I hear everyone recommending against that.
On Windows, PGP gives me no real difference in anything that isn't I/O bound, although I did notice that Fallout 3 went from fine to unplayable at the same settings - I've noticed that anything that makes extensive use of sound (presumably streamed off disk) has an impact.
On Linux I did some tests a while back with luks and found that there was about a 5% overhead on i/o operations for a luks partition with ext3 vs straight ext3.
I haven't had any figures for Mac but PGP is a bit of a memory hog on Leopard. The Mac Mini server we have at work isn't something you'd want to use for day to day activities, certainly nothing intensive, but is fine as an office file server.
At the end of the day, what you're looking at is a minor memory impact (for most cases) and a minor to noticeable impact on i/o performance in exchange for a significant improvement in confidentiality for data at rest. That's the call you need to make. If your code and other files are sufficiently sensitive for you not to want random thieves to be able to look at your laptop if they steal it, encrypt. If you have sensitive information that requires protection for legal purposes, encrypt. If it's not an issue for you, then don't.
A bit off topic, but making it less likely you'll lose your laptop to begin with is important. Here are some ideas. Most laptop have a special slot that accepts a cable lock. I make use of it whenever I'm in a coffee shop and have to leave the machine for more than a moment. I loop it through bag straps and my jacket too. You want to look hard to deal with. Its also a good idea to make sure your laptop requires a pas…
OS X has FileVault which encrypts the home folder. I don't think I have any personal data outside of it. But I do use TrueCrypt too.
First off, I'd like to throw Bitlocker back in the ring and tell you that boot volume encryption is relatively unimportant for the threat model you propose, specifically untargeted data at rest. Boot volume encryption/verification is designed to protect you against attackers who would replace your boot image with a one that contains a rootkit or keylogger. This threat model requires serious forethought and planning o…
I have however ran into one problem: The licensing app somehow "forgot" that it was registered (something to do with changing active directory binding). I would not have noticed except I went looking for why the computer was so slow.
I opened the PGP app and it said it wasn't licensed and the disk was "decrypting" itself.
I had to wait for basically 3 hours for it to decrypt the disk, re-enter my registration information, and re-encrypt the disk.
Question: for developers out there, what is the overhead of full encryption on your hard drive for a development laptop? I'd love to just go the whole hog and encrypt the whole drive, but as a developer I jealously guard performance as I feel it links directly to my productivity. So I just have an encrypted Truecrypt volume where really sensitive stuff goes. But I hear everyone recommending against that.
I'm sure there's more overheard with full disk encryption and I might just be used to the lower performance of my portable apps. I'd say it's worth it.
http://news.cnet.com/8301-13578_3-9876060-38.html
The paper referenced is available at:
http://citp.princeton.edu/pub/coldboot.pdf
From that paper, the most salient sentence for this discussion is:
"On all of our sample DRAMs, the decay rates were low enough that an attacker who cut power for 60 seconds would recover 99.9% of bits correctly."
The long and short is that your password has to be in RAM at some point in order to be matched against what is typed in. RAM decays slowly after a machine has been switched off. As the research shows, one can use a widely-available can of air to make that decay happen even slower. In the process, one can pull the value out of RAM.
Note that this is a hardware problem that no software on the market has been able to address. To do so, you would have to be able to validate x against y without having the value of y ever enter RAM.
Consequently, a reasonably good tech thief can read the password out of RAM. For the not-so-good tech thief, using passwords and social engineering tricks like being nice to someone and then asking them to watch your stuff for a moment will probably do the trick. I tend to see the various implementations of full-disk encryption as more for peace of mind and mitigation of liability than real security.