This is all good, until you get any kind of disk corruption. Good luck getting any of your data back.
That's why you should have up-to-date backups.
New Year's Resolution: Full Disk Encryption on Every Computer You Own
131–140 of 187 posts
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#132Earlier quoted context omitted.
You can and should encrypt your partition, since your home key might end up there. https://help.ubuntu.com/community/EncryptedFilesystems If you want hibernate to work you can use uswsusp for example: https://we.riseup.net/debian/encrypted-swap Sleep always works, but as mentioned above, your key will be in memory...
Interesting.... I think i'll stick with user directory encryption, but thanks for those links.
Well, I use /home with luks on some machines and user directory (encfs) on others, but have all of them with swap encrypted or no swap partition at all.
Since the keys/other private info might leak there, you are not doing it right, unless you have sysctl swappness level set to 0.
Not only that, /tmp and other temporary directories might also be another leaky place...
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#133Can anyone comment on the speed/performance of TrueCrypt, EncFS, and similar on older systems, e.g. a 5 - 7 year old laptop? I'm considering carrying a "sacrificial" machine in case it is, um, "indefinitely detained", but I'm uncertain what kind of a performance hit full disk (or partition -- though I'm inclined to encrypt the entire disk) encryption will incur. (I currently have Core Duo and P4 candidates for the jo…
Truecrypt has a simple benchmark that you can try (and I think it has a portable installation option so you don't even have to install it on the system to try it out). My core duo 1.6 GHz laptop gets about 60 MB/s of AES encryption/decryption speeds on battery (which I think reduces the clock to 1 GHz). I consider the impact negligible. However if you have an SSD in your system and do full-disk-encryption you will lo…
Thank you for the response. These are both "spinning plates" machines. Part of what would keep their loss a minor financial hit.
I wonder whether the dual cores help significantly. (As I'm more inclined to make the P4 the sacrifice.) However, if your observation is that the perceived impact is "negligible", this encourages me that it will be acceptable, if more significant, on the P4.
I hadn't noticed the benchmark utility you describe. I'll have a look for/at it. Thanks!
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#134So how do you encrypt a home server? Any device that has to be bootable without human intervention will have to store the encryption keys on the device somewhere making the encryption merely obfuscation.
It is possible for "swap" RAM to be encrypted on Linux and it could generate a random per boot key, also being a form of obfuscation. https://lkml.org/lkml/2011/12/28/69
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#135Microsoft BitLocker in its most secure mode is the gold standard because it protects against more attack modes than other software. Unfortunately, Microsoft has only made it available with certain versions of Microsoft Windows. Though MS says that BitLocker doesn't have back doors [1], I wonder how true this actually is... [1] http://blogs.msdn.com/b/si_team/archive/2006/03/02/542590.as...
Do MS developers have a track record of bald-faced lies that I'm unaware of?
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#136On OSX with Lion - there is no excuse http://osxdaily.com/2011/08/10/filevault-2-benchmarks-disk-e...
Have you noticed crashes and general instability on OS X Lion + Filevault 2? We've tried it on a Core2Duo Macbook Pro (early 2007) and MacBook (Mid 2010). We've seen lots of OS crashes (Macbook) and general performance issues when running XCode (Macbook Pro). We're also running virtualization software on the Macs (Parallels and VMWare) - I'm not sure if they're interacting with Filevault 2 (shouldn't be). Just wonder…
no i have no problems. macbook air 2010 w/ lion + file vault active - no crashes or instability. i do time machine backups on a regular basis and work with Xcode, photoshop, iWork, vmware fusion - never had any problem.
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#137I'm not an expert on security, but I do know a bit about human nature. I'd suggest a 2-level encryption scheme. Perhaps FDE and a BIOS password as level 1, and then a futher encrypted area of your HD as level 2. Why? Because this allows you to appear to be cooperating with any request to look at your computer. Simply type in the level 1 stuff and demonstrate the system booting up. I bet 9 times out of 10 whoever is c…
Once you boot up and log in couldn't they see your whole system.
Not if your secondary partition isn't mounted automatically. It's not a stretch to assume that customs agents (or whomever) aren't going to look for unmounted partitions when the computer is booting and running normally.
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#138Unfortunately, full-disk encryption absolutely kills SSD performance because it makes the data look random (i.e. incompressible). It will wear out the SSD much faster than using it without would, because the hardware compression unit in the controller can sometimes achieve 8:1, and therefore have to rewrite only 1/8th of the NAND cells that it otherwise would.
I think you're right on the effect but wrong on the implied grave magnitudes "absolutely kills" and "much faster", because:
• not all SSDs even have hardware compression
• modern workloads have less highly compressible data than in the past: large-media formats include their own compression, and bulk data processing often does its own application-level compress/decompress on store/load
I'd be interested to see any benchmarks that quantify the speed/lifetime hit that whole-disk encryption might cause for SSDs, but my hunch is that the effect would be slight in normal scenarios.
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#139Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#140What about on my mobile? I am not aware (as I havent looked) of any encryption available to the data on my iPhone, or MyTouch 4G. Further, I use Gmail - I have zero expectation of privacy from google. I also store all my important docs for work and personal on DropBox. What will I gain from encrypting my laptop? aside from it being stolen/lost - I dont see any added security/benefit from doing this. I am not trying t…
iPhone data is encrypted by default - remote wipe works by destroying the key. Unfortunately, the key is obviously only protected by a user's passcode, if they've even set one. The 4-digit pin codes have been shown to be broken, but I've not seen (maybe I missed it?) evidence of those with alphanumeric passcodes being compromised.