Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Year's Resolution: Full Disk Encryption on Every Computer You Own

eff.org

Post reply on HN
Print view View original

151–160 of 187 posts

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#151

Post by mahyarm »

cmos wrote: post #82
slowpoke wrote: post #63

Earlier quoted context omitted.

Exactly. Trusting proprietary, closed source software (in other words, a third party) for encryption is missing the point of encryption so hard, it's not even funny.

I'm pretty sure everything has a back door. I was a consultant writing test code for software that managed the license creation process for my state's DMV and we had two separate doors for the FBI and CIA. They could just type any information in they wanted to, upload a picture, hit print, and the process would mail them a drivers license like everyone else.

That is like an organizational intranet interface, not a backdoor. A backdoor would have to give access to an undesired third party by the end user.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#153

Post by AdamGibbins »

st3fan wrote: post #150
conradev wrote: post #89

Earlier quoted context omitted.

Combined with a firmware password, it makes a MacBook impenentrable.

Got a good pointer to setting a firmware password?

Reboot your Mac into recovery mode (hold Cmd+R on bootup), its in one of the menus there.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#154

Post by mahyarm »

wazoox wrote: post #13

None of my current computers is powerful enough for that without it being a serious hassle. And I'm pretty sure it will drain my laptop battery much faster...

Many processors, computers and hard drives have dedicated AES encryption chips, the battery hit is pretty much nonexistent on these computers.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#155

Post by FooBarWidget »

Groxx wrote: post #84
coob wrote: post #58

Earlier quoted context omitted.

The RIP Act in the UK allows for jail time for refusing to give a key.

What if the key doesn't exist? The point of a hidden OS is plausible deniability. When used correctly, there shouldn't be any evidence that another OS exists. For instance: what if there wasn't a hidden OS, and you do keep random data in your unused HD space? They'd be jailing you for refusing to give something that doesn't exist.

It's unplausible for unused space on the harddisk to be random due to the way filesystems work. Random data is likely to be encrypted data.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#156

Post by rdl »

ck2 wrote: post #14

It's sad we need encryption mostly for protection from not criminals, but our own government for even trivial data. What freaks me out most these days is how easily people fall into the belief that "oh well traveling is not a right so you have to give up rights when you fly or drive anywhere". No, if you are a citizen of the United States and unless you are actually crossing a border, you should have the unqualified…

I am much more concerned about criminals or foreign governments seizing my data (from a lost or stolen machine) than I am about the US Government. If USG wanted the data for legal reasons, it would be pretty easy to detain and get a court order. If the USG illegally wanted data from me, it would be easy to just black bag and monitor the endpoints.

Disk encryption means not having to apologize profusely to everyone when/if your laptop is stolen. That's the real low hanging fruit.

Of course, the only sensitive data I have is authentication credentials (easily revoked), commercially sensitive stuff, and personal privacy (which has much higher value to me in keeping secret than to anyone else in publishing), so I feel pretty safe.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#157

Post by rdl »

culturestate wrote: post #140
samstave wrote: post #112

What about on my mobile? I am not aware (as I havent looked) of any encryption available to the data on my iPhone, or MyTouch 4G. Further, I use Gmail - I have zero expectation of privacy from google. I also store all my important docs for work and personal on DropBox. What will I gain from encrypting my laptop? aside from it being stolen/lost - I dont see any added security/benefit from doing this. I am not trying t…

iPhone data is encrypted by default - remote wipe works by destroying the key. Unfortunately, the key is obviously only protected by a user's passcode, if they've even set one. The 4-digit pin codes have been shown to be broken, but I've not seen (maybe I missed it?) evidence of those with alphanumeric passcodes being compromised.

The issue is that I can conduct an unlimited-attempts brute force attack against the passcode. I can do about 10 per second on an iPhone 4S, but I do need access to the machine, unless I'm willing to crack open the iPhone and do a destructive hardware attack.

At 10 per second, I feel ok with an 8-10 character numeric passphrase, or a 7-8 character lowercase-only passcode.

I just wish the iPhone had some intelligence about adaptive locking -- lock faster when it's outside my home/car, don't go from unlocked to locked very fast, if at all, if docked in secure places inches from a 9mm. Or pairing with an RF device attached to me, like the Blackberry CAC reader.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#158

Post by epochwolf »

FooBarWidget wrote: post #155
Groxx wrote: post #84

Earlier quoted context omitted.

What if the key doesn't exist? The point of a hidden OS is plausible deniability. When used correctly, there shouldn't be any evidence that another OS exists. For instance: what if there wasn't a hidden OS, and you do keep random data in your unused HD space? They'd be jailing you for refusing to give something that doesn't exist.

It's unplausible for unused space on the harddisk to be random due to the way filesystems work. Random data is likely to be encrypted data.

Except that some operating systems have a secure erase option for free space (OSX for example).

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#159

Post by epochwolf »

fl3tch wrote: post #111
trotsky wrote: post #76

The feds and other serious folks are pretty careful these days not to turn off anything until they've had forensics evaluate the situation. And not just because of FDE, memory analysis very frequently yields the best evidence due to it's timely and overlooked nature. Since most encryption systems retain their keys during lock and sleep, unless you usually leave your system powered off I wouldn't count on being afford…

If you're worried about a state-level adversary, then yes, you should always turn off your computer when not using it. They could still be spying on you and wait until you turn it on to kick down the door. There are people who have thought about these things, too. One suggestion is a dead man's trap, like a pad that you sit on, so if the door gets kicked down (or they snipe you from outside the window), as soon as yo…

You could just hold down the power button on your computer for 4 seconds and require a password to boot the system.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#160

Post by spindritf »

nohat wrote: post #116

One thing that worries me is how difficult it makes it if you get some data corruption. For example, I had a hardrive that had full disk encryption start to fail, and found pulling the data off much more difficult because I had to decrypt the whole lvm to get any access. I'm actually not confident how exactly corruption maps from cyphertext to plaintext in various modern crypto systems. I would guess that you would g…

I would rather back my data up than hope to retrieve it from a corrupted fs or, worse, a failing disk.
Post reply on HN