It's great to see the EFF recommending http://diceware.com for secure passphrase generation.
New Year's Resolution: Full Disk Encryption on Every Computer You Own
171–180 of 187 posts
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#172This is all good, until you get any kind of disk corruption. Good luck getting any of your data back.
Why am I down voted? My laptop HD was encrypted, it got corrupted, and I lost the entire drive. If even a few bytes are corrupted, you are SOL. Luckily, I had an offsite backup (unencrypted) I'm just warning people about the dangers of not keeping an unecrypted backup.
> Luckily, I had an offsite backup (unencrypted)
Don't call that luck. You should be proud of yourself.
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#173Earlier quoted context omitted.
What if the key doesn't exist? The point of a hidden OS is plausible deniability. When used correctly, there shouldn't be any evidence that another OS exists. For instance: what if there wasn't a hidden OS, and you do keep random data in your unused HD space? They'd be jailing you for refusing to give something that doesn't exist.
My dad was the security officer in a major department of UK gov, and he asked this very question to legal. The response was that if the key doesn't exist, you must prove its non-existence. His protest on that fell on deaf ears. Furthermore, if the key is controlled under the Official Secrets Act, you will brake the law both when you hand them over you and when you don't. Basically, laws that don't make absolute logic…
That's pretty damn messed up. Basically they're saying: "we're accusing you of having X, we didn't find it on your encrypted drive, but maybe you have a hidden OS where it's at! Give the key!" And suppose you did give up your hidden OS key and they still find nothing? Do they say "Aha! Well, we didn't find it on this device, but we found this innocent picture of Jesus--give us the key you used to steg the information inside!"? And suppose you actually had some steg'd info inside, but it's not the information they wanted, it's nothing illegal. Do they then say "Clearly you dumped the incriminating hard drive in a landfill--tell us where!"?
Something mentioned at the beginning of the paper "I've Got Nothing to Hide" and Other Misunderstandings of Privacy, is Friedrich Dürrenmatt's Traps, from 1956. It involves a seemingly innocent man put on trial by a group of retired lawyers for a mock trial game, the man inquires what his crime shall be. "An altogether minor matter," the prosecutor replied … "A crime can always be found."
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#174Earlier quoted context omitted.
be reassured, that "nobody" actually checks thoroughly in practice, so don't rely on it. http://www.h-online.com/newsticker/news/item/Debian-package-...
Doesn't that prove that people do check it? Isn't the point of open source that you can have problems for a time, but eventually you'll be ok? Certainly better than you could write yourself or trust in a closed source system.
Yes, it is certainly easier to audit than binaries, but one of the main axioms in cryptography is, that it should ensure security for the timeframe until the information protected is still valuable (one can assume, that eventually all crypto is cracked -- the question is when, and how to delay this to ensure functionality).
This bug was injected for two years: the damage has been done, with literally over a million of weak keys that pollute the internet. That said, I acknowledge, that the ssl system has (perhaps even more) serious weaknesses beyond the keys themselves. It should have been caught days after commit, and never should have made it into debian stable (and debian has a very slow, thorough release cycle). But telnetd comes to mind, etc. Perhaps only OpenBSD shows consistent true efforts in open source auditing.
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#175On OSX with Lion - there is no excuse http://osxdaily.com/2011/08/10/filevault-2-benchmarks-disk-e...
I haven't been able to use Filevault with iTunes match ...
https://discussions.apple.com/message/16987224
Though I'd love to hear any reports to the contrary!
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#176Earlier quoted context omitted.
FDE on a SSD negates the gained speed advantage
I ran some benchmarks and 4K read speed really takes a hit with FDE: 2xWestern Digital blue label RAID 0 : 0,65Mb/s (for refrence) Crucial M4 without FDE : 19,07 Mb/s Crucial M4 with FDE : 5,59 Mb/s however the benchmark shows that a SSD is still substantially faster than a classical RAID 0 array
Not enough information to verify the usefulness of your benchmark. Were the volumes/partitions aligned? What technology/cipher/keysize did you use for the FDE? Does your CPU have the AES-NI instructions? Does the encryption tech that you're using take advantage of those instructions?
FDE on any type of media causes no slow down if the CPU can encrypt/decrypt at least as fast as the disk can transfer data. It's not correct to say that FDE always causes slow downs.
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#177Earlier quoted context omitted.
That's why you should have up-to-date backups.
but then couldn't people still get to your unencrypted data (through your backups)?
I use FDE on my laptop. I recently wrote up how I handle encrypted backups:
https://grepular.com/Secure_Free_Incremental_and_Instant_Bac...
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#178This is all good, until you get any kind of disk corruption. Good luck getting any of your data back.
Why am I down voted? My laptop HD was encrypted, it got corrupted, and I lost the entire drive. If even a few bytes are corrupted, you are SOL. Luckily, I had an offsite backup (unencrypted) I'm just warning people about the dangers of not keeping an unecrypted backup.
Why isn't your offsite backup encrypted too? Yes, if your data is corrupted, and your backups are corrupted, then you lose your data. That's the case regardless of whether or not you're using encryption.
I use FDE on my laptop. My backups are also encrypted. I use duplicity which basically tars up the files and then encrypts using GnuPG. It only tars up the changes between each run, so I have incremental backups, and version history of every single file on my system. All encrypted - https://grepular.com/Secure_Free_Incremental_and_Instant_Bac...
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#179Earlier quoted context omitted.
This is all good, until you get any kind of disk corruption. Good luck getting any of your data back.
If my encrypted disk becomes corrupted and then corrupts my unencrypted backup, what's the difference?
A good backup, e.g. Time machine, lets you restore feom before the corruption. A backup on an encrypted disk risks the entire backup volume being corrupted and unusable in one go, thus making it a very brittle backup.
I'm assuming that a corrupted encrypted file is totally unusable here, and now that I think more about it I'm not sure - encryption with chained blocks would mean errors have a larger affect than just at the error site, wouldn't it?
Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own
#180Earlier quoted context omitted.
If you're worried about a state-level adversary, then yes, you should always turn off your computer when not using it. They could still be spying on you and wait until you turn it on to kick down the door. There are people who have thought about these things, too. One suggestion is a dead man's trap, like a pad that you sit on, so if the door gets kicked down (or they snipe you from outside the window), as soon as yo…
You could just hold down the power button on your computer for 4 seconds and require a password to boot the system.
That depends on how quickly they can get guns pointed at you once the door is kicked in.