Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Year's Resolution: Full Disk Encryption on Every Computer You Own

eff.org

Post reply on HN
Print view View original

21–30 of 187 posts

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#21

Post by raesene2 »

codesuela wrote: post #4
mike-cardwell wrote: post #3

Earlier quoted context omitted.

There's nothing stopping you using FDE on an SSD...

FDE on a SSD negates the gained speed advantage

there's some scenarios where it may not be too bad. From what I've read I'd agree that truecrypt on an SSD doesn't sound like a good option. Bitlocker seems possible if you're running Win7 (ultimate or enterprise).

One other thing to watch out for with SSDs is the "native" AES encryption. From what I've read in many cases it's only there to provide a fast wipe facility and doesn't actually provide protection for data on a lost laptop. Some SSDs (eg Intel 320) provide password protection for the encryption keys via the ATA password, but a bit of reading didn't make me feel too comfortable with how they've implemented it.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#22

Post by daeken »

thibaut_barrere wrote: post #16
daeken wrote: post #15

Earlier quoted context omitted.

I use FDE and then encrypted vaults for each project. Even if my computer is lost/stolen when it's on or asleep and the FDE does nothing, I can be assured that the vast majority of the sensitive data is safe.

I'm adding FDE too :) I use Knox for Vaults (on Mac), what do you use out of curiosity?

Knox on OS X (what I use for day job work) and Truecrypt on Windows. PGP Desktop for FDE.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#23

Post by RyanGWU82 »

codesuela wrote: post #4
mike-cardwell wrote: post #3

Earlier quoted context omitted.

There's nothing stopping you using FDE on an SSD...

FDE on a SSD negates the gained speed advantage

That's not what I've seen, at least for FileVault 2 under OS X Lion. I'm using a 2010 iMac with a third-party SSD, and a 2011 MacBook Air with Apple's stock SSD. Both computers are blazing fast at disk access, even with full-disk encryption enabled.

If you're confident you're encrypting all your data, then you're still way above average. The nice thing about FDE is that I can "set it and forget it." I don't have to think about which files belong on which partition anymore. It's all safe.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#24

Post by morsch »

jrgifford wrote: post #19

Unfortunately, the amount of time I spend running/breaking the development version of Ubuntu prohibits full disk encryption, but I do have /home encrypted. Is that "good enough"?

That's what I intend to do the next opportunity I get. Your swap space could still leak confidential information, though.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#25

Post by lgeek »

codesuela wrote: post #4
mike-cardwell wrote: post #3

Earlier quoted context omitted.

There's nothing stopping you using FDE on an SSD...

FDE on a SSD negates the gained speed advantage

As far as I can tell, the only problem is that the encryption layer won't forward TRIM commands to the SSD by default because that can reveal some information about the data layout. I've been using full disk encryption on an SSD for a year and while the write speed got somewhat slower over time, it's still better than a hard drive, and overall the system feels responsive. At the rate the cost/GB drops, I was intending from start to replace it after two years or less.

But here's the thing: If you use Linux with dm-crypt, you can set it to pass TRIM commands to the disk. It seems pretty safe, it's only that it will leak information about which blocks are actually used.

LE: Here's how to do it: https://wiki.archlinux.org/index.php/System_Encryption_with_...

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#26

Post by Create »

mike-cardwell wrote: post #3
codesuela wrote: post #2

I got myself an SSD for Christmas and that is why I moved off full disk encryption on home computer and instead encrypt almost everything except the system. However I've turned off the page file and I'm trying to set up pre boot authentication for non system volumes. On another note, I plan to slowly switch to Ubuntu and I wonder how secure the home folder encryption is?

There's nothing stopping you using FDE on an SSD...

http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.ht...

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#27

Post by SickAnimations »

My system triple boots into OS X, Windows and Ubuntu. I have a home partition, formatted in HFS+.

What would be the best strategy for me to use? Should I just encrypt the home volume using something cross-platform like TrueCrypt, or is it practical (an maintainable) to do full-disk encryption in such an environment?

My home partition has very sensitive data and I've been putting off creating a TrueCrypt container for this data.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#28

Post by arthurschreiber »

codesuela wrote: post #6
mike-cardwell wrote: post #5

Earlier quoted context omitted.

Does it? Even if you have a CPU with AES-NI instuctions like an Intel Core i5 or i7?

unfortunately yes, see http://blog.siyuz.net/2010/11/17/truecrypt-7-0a-fde-on-ssd/#

I encrypted my SSD using BitLocker, and for me, the performance hit is not really noticable in my day-to-day work (programming + running a virtual machine). Your SSD will still be A LOT faster than a regular, unencrypted HDD. But YMMV.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#29

Post by Jach »

If you go full disk encryption with TrueCrypt, make sure you look into their Hidden OS feature as well. A judge may be able to order you to give up the decryption key to the OS when accessing the drive prompts for one (last I checked the precedent is still somewhat shaky), because while they can't know what's being encrypted they can infer something readable is. They can't prove the existence of a Hidden OS, though, so your 'real' encrypted area is just noise and can't be legally proved anything else so a second key can't be demanded.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#30

Post by goblin89 »

mike-cardwell wrote: post #10
[deleted] wrote: post #7

[deleted]

"I have always thought that the only reason you would need full disk encryption on a computer is if you was doing something illegal." Did you even read the article? It mentions several legitimate reasons why you would need to use encryption for perfectly legal reasons. It still surprises me hear people who are intelligent enough to use the Internet come out with the, "if you've nothing to hide" argument. EDIT: The in…

Not to argue with your points (business data is sensitive stuff), but another link from the article leads to this:

> For maximum security make sure you are alone and close the curtains. Write on a hard surface - not on a pad of paper. After you memorize your passphrase, burn your notes, pulverize the ashes and flush them down the toilet.

That is quite a paranoid's hell. =)

Full-disk encryption may just provide false sense of safety, as we store lots of data in the cloud, where even strong passwords do not guarantee that nobody will get access to the data.

IMO for one to be 100% sure that nothing could go wrong one should not store anything anywhere.

Post reply on HN