71–80 of 117 posts
Earlier quoted context omitted.
Delete all the files then "dd" from the random device until the drive is full? Must we always jump straight to the hydraulic press?
> the random device /dev/zero would be sufficient. Also easier to confirm things worked (if desired) since you know what to expect on read-back.
Somethings not mentioned in the article, but are pretty relevant. Modern SSD controllers encrypt all data by default. Not to increase security, to improve wear levelling. Encrypted data should be effectively random data (that’s what good encryption aims to produce). So encrypting the data ensures that patterns in data written to the SSD don’t end up creating uneven wear patterns in the flash chips. As a consequence,…
> Flash storage, unlike traditional hard drives, can really be completely and irrecoverably erased, with no lingering magnetic ghosts that a sufficiently determined person could in theory reconstruct. I think people vastly overestimate the possibility to recover any data from a wiped HDD. See for example this article by SANS [1]. To recover a single bit you have a better chance of flipping a coin to see if the bit wa…
This can't be true. Any method must be at least as good as a coin toss. If it's worse you can just bit flip the result and end up better than the coin.
Furthermore, [0] https://en.wikipedia.org/wiki/Monty_Hall_problem
Somethings not mentioned in the article, but are pretty relevant. Modern SSD controllers encrypt all data by default. Not to increase security, to improve wear levelling. Encrypted data should be effectively random data (that’s what good encryption aims to produce). So encrypting the data ensures that patterns in data written to the SSD don’t end up creating uneven wear patterns in the flash chips. As a consequence,…
Sure there would be performance implications, but who would care? You might just want to store a key for some full performance encrypted data that you would like to be able to actually remove access to. Sometimes performance is not the most important thing to optimize for.
> Flash storage, unlike traditional hard drives, can really be completely and irrecoverably erased, with no lingering magnetic ghosts that a sufficiently determined person could in theory reconstruct. I think people vastly overestimate the possibility to recover any data from a wiped HDD. See for example this article by SANS [1]. To recover a single bit you have a better chance of flipping a coin to see if the bit wa…
All those articles are very theoretical, in reality 1 pass of dd /dev/zero makes things unrecoverable, for recent SSD since trim is enabled by default you can't recover anything, I deleted a document by mistake on an SSD and it was impossible to get back, the moment I pressed delete on windows the trim command was sent and everything was erased on the ssd. Pro recovery compagny that are not shady know that SSD recove…
https://en.wikipedia.org/wiki/Thermite Securely erases all known forms of electronic data storage. Cheap, reliable, fun for the whole family!
Earlier quoted context omitted.
Delete all the files then "dd" from the random device until the drive is full? Must we always jump straight to the hydraulic press?
Hydraulic press is too obscure, .45 ACP works just as well. But it depends on your risk profile, for most people a wipe-and-reuse is going to be fine, especially if the "reuser" is already a trusted entity.
If you erase the volume, regardless of whether you had FileVault enabled or not, the key is deleted [0].
If FileVault isn’t enabled on a Mac with the T2 chip during the initial Setup and
When deleting a volume, its volume key is securely deleted by Secure Enclave
----------------------------------------------- Incorrect ramblings below: -----------------------------------------------
Apple recommends setting up FileVault on their SSDs. It is literally the only way to ensure that the data on the SSD is not recoverable.
And you should do this before you put anything ON the Mac.
If you add a file and only later encrypt the drive, you have no guarantee that that file still isn't somewhere readable one way or another.
This is important when you think about buying a Mac and then choose to return it 3 days later.
Apple states [0]:
Note: With a solid-state drive (SSD), secure erase options are not available in Disk Utility. For more security, consider turning on FileVault encryption when you start using your SSD drive.
Note: If you have an iMac Pro or another Mac with an Apple T2 Security Chip, the data on your drive is already encrypted automatically. However, turning on FileVault provides further protection by requiring your login password to decrypt your data.
[0] https://support.apple.com/guide/disk-utility/erase-and-refor...
[1] https://support.apple.com/guide/mac-help/encrypt-mac-data-wi...
And Yubikey don't leak secrets.
If your system is compromised to the point that someone gets access to the full disk decryption key protected by your Yubikey, you've got bigger problem than securely erasing the disk.
Need to recommission a disk? dd to the disk because why not. Some sectors didn't get dd'ed? Well, the bad guys need your Yubikey too.
So, really, what do we think about Yubikeys?
Are people now going to steal your Yubikey in addition to finding the sectors that weren't overwritten by dd?