Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Year's Resolution: Full Disk Encryption on Every Computer You Own

eff.org

Post reply on HN
Print view View original

161–170 of 187 posts

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#161

Post by esrauch »

fl3tch wrote: post #108
jpdoctor wrote: post #77

Earlier quoted context omitted.

An automated update of the decoy would be a good addition to such software.

Not sure exactly how this would be implemented, but it sounds like a bad idea, since they would just wait for your automated updater to decrypt the decoy. Even if it was in some limited fashion, the encryption key would be in RAM, so it would be as vulnerable as any running system. (BTW, if you're worried about a state-level adversary, that means you should always turn off your computer when not using it, and wait a…

Well, the point of the decoy i that you don't care if they can access it isn't it?

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#162

Post by conformal »

morsch wrote: post #92
buro9 wrote: post #78

Earlier quoted context omitted.

Which is what we thought was happening with Dropbox and why people were up in arms about discovering that it wasn't the case. There remains the space for a cloud sync service that encrypts client side and provides good enough clients for every major platform. Spider Oak comes close, but it's just too damn ugly an interface and isn't the "Install and forget" option that Dropbox is.

I use Wuala. I think their software is pretty nice; don't know how it compares to SpiderOak since I've never used it. They encrypt client-side. Employees can't access data. Or so they say, since the client isn't open source, which is my main hangup. If I understand correctly, it's not as secure/confidential as Spider Oak: the encryption key for file A is Hash(A) and your own key is only used to gain access to Hash(A)…

knowing file hashes assists substantially in cryptanalysis via PoE

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#163

Post by conformal »

bengl3rt wrote: post #121

Unfortunately, full-disk encryption absolutely kills SSD performance because it makes the data look random (i.e. incompressible). It will wear out the SSD much faster than using it without would, because the hardware compression unit in the controller can sometimes achieve 8:1, and therefore have to rewrite only 1/8th of the NAND cells that it otherwise would.

been running with FDE on an SSD for >3 years now, still works fine.

sure it's slower but how often do most people really push their disk past 20 MB/s?

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#165

Post by 3pt14159 »

Create wrote: post #106
slowpoke wrote: post #68

Earlier quoted context omitted.

While you are basically correct, the mere ability to check the source yourself and possibly be able to find (or even fix) said bugs-which-could-or-could-not-be-cleverly-hidden-backdoors puts it leagues ahead of any proprietary solution, where there is never any way to be sure there isn't just something like a void force_decrypt(string company_master_password) [1] in there. And to be perfectly honest, I'd rather trust…

be reassured, that "nobody" actually checks thoroughly in practice, so don't rely on it. http://www.h-online.com/newsticker/news/item/Debian-package-...

Doesn't that prove that people do check it? Isn't the point of open source that you can have problems for a time, but eventually you'll be ok? Certainly better than you could write yourself or trust in a closed source system.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#166

Post by brc »

Willwhatley wrote: post #39
flipbrad wrote: post #20

Earlier quoted context omitted.

To be honest, I don't see why national borders are so strongly part of the equation. I suppose that depends on your worldview. I live within the Schengen Area, and to me it seem patently obvious that most 'bad things' in the world are hardly affected by national borders. They're typically supra-national (climate change, credit crunch, cracking, etc) or intra-national (most crime, etc. I don't mean to argue for more c…

My understanding is World War I. Apparently passports and visas were an innovation inspired by the militarism and nationalism that swept Europe at the beginning of the twentieth century. However governments rarely divest themselves of power once acquired, and so although many, many more folk are internationalist these years, there exists this relict of national control. /stills rant about how in the United States, th…

I often still marvel when reading the biographies of enlightenment-era people, who often travelled and worked extensively in all sorts of cities and countries. There are often tales of going to Rome for a year or two, then returning to Scotland, then off to Germany for a while, or wherever.

While the modern-EU person can do this without any trouble, anyone from outside the EU (or the US), this is just a pipedream without serious legal money to throw at the visa manufacturing industry.

Nationalism is still heavily with us, and even more so than in earlier times.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#167

Post by brc »

ck2 wrote: post #14

It's sad we need encryption mostly for protection from not criminals, but our own government for even trivial data. What freaks me out most these days is how easily people fall into the belief that "oh well traveling is not a right so you have to give up rights when you fly or drive anywhere". No, if you are a citizen of the United States and unless you are actually crossing a border, you should have the unqualified…

The latest example I know of happening is the seizing of the laptops of a blogger who runs a climate-science related website. His blog was one of the handful that the 'climategate' links were posted on.

So the outcome was that a warrant was given to search his house, 6 armed officers entered, took two laptops and left (to my knowledge, they still haven't been returned). He wasn't charged with a crime or wasn't a suspect in a crime, he merely had a link posted in a wordpress-hosted blog that he runs by the person that distributed the zip file containing the emails.

It's pretty bad that you can lose hardware and have it inspected by unknown persons for unknown reasons simply because you had an anonymous poster put something on your blog.

This story, to me, really brought it home that the biggest threat to computer privacy probably isn't theft but rather falling foul of a political position.

http://tallbloke.wordpress.com/2011/12/14/tallbloke-towers-r...

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#168

Post by brc »

code4pizza wrote: post #18

I wonder if there would be significant environmental implications if everyone switched to full disk encryption... Does this impose a significant processor load and does that translate to greater power consumption?

Simple answer : no. Even at massive scale where everyone did it, the tiny, tiny differences in power consumption wouldn't be a rounding error in power generation.

Power stations are built to supply x amount of energy for y time. They aren't like a car engine where switching off the air-con makes a noticeable difference.

This kind of meme gets going because of the campaign to switch appliances off at the wall, thinking it is going to make some type of differences. Every analysis I have ever seen is that (1) the difference is so small it makes no difference and (2) whatever minute drop in demand is found will quickly be used up in industrial users expanding consumption into the lower demand period. Just running one arc-furnace or aluminium smelter for 1 hour longer is going to negate most domestic level fine shavings like switching the TV off at the wall.

Mostly this stuff is promoted to make people feel like they personally are involved and making a difference.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#169

Post by kijin »

FooBarWidget wrote: post #155
Groxx wrote: post #84

Earlier quoted context omitted.

What if the key doesn't exist? The point of a hidden OS is plausible deniability. When used correctly, there shouldn't be any evidence that another OS exists. For instance: what if there wasn't a hidden OS, and you do keep random data in your unused HD space? They'd be jailing you for refusing to give something that doesn't exist.

It's unplausible for unused space on the harddisk to be random due to the way filesystems work. Random data is likely to be encrypted data.

If you use TrueCrypt properly, most unused space on your hard disk will be filled with random bits, whether or not you have a hidden OS in there.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#170

Post by slowpoke »

powertower wrote: post #115
slowpoke wrote: post #63

Earlier quoted context omitted.

Exactly. Trusting proprietary, closed source software (in other words, a third party) for encryption is missing the point of encryption so hard, it's not even funny.

> Trusting proprietary, closed source software (in other words, a third party) for encryption is missing the point of encryption so hard, it's not even funny. I don't have the experience, knowledge, and time (+ effort) to review every source-code line and every theorem used by an encryption application ... to make sure it's not doing something it shouldn't. And (chances are) you don't either. So it's not about closed…

>So it's not about closed-source or open-source, but rather it's about trust.

And that's my point. How can I trust someone who's unwilling to show me the source of their software and denies me my basic freedoms?

What I am not saying is that Free Software should be blindly trusted - that would be stupid and reckless. What I am saying is that for security[1], proprietary software cannot and must not be trusted, under any circumstances. You cannot even verify what the program you are using does? It's not secure, full stop.

And again, it's a massive difference between hiding a backdoor in a binary blob as opposed to essentially trying to hide it in plain sight. It's possible, but highly unlikely to go unnoticed for a prolonged amount of time. And if it is found, it will probably be fixed pretty much instantly as per Linus' Law.

Finally, corporations and businesses are bound to law for the most part. If they are required (or ordered) to include a backdoor for the FBI or NSA, they will most likely have to oblige. Not so much for Free Software. You essentially cannot force such a backdoor since even if the original maintainers include it, the project will just be forked, and law enforcement - to put it bluntly - can't do shit against it.

[1] And arguably everywhere else, too, but I'd prefer to stay on topic.

Post reply on HN