Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory

mathstodon.xyz

Post reply on HN
Print view View original

141–150 of 247 posts

Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory

#141

Post by Terr_ »

andrewpiroli wrote: post #38
nacs wrote: post #32

Earlier quoted context omitted.

Reminder that by using Bitlocker, you're using a closed source encryption for which Microsoft will happily hand out your recovery key on request. https://www.forbes.com/sites/thomasbrewster/2026/01/22/micro...

Only if you store your key with Microsoft, which is not required or the default if you're using a local account which I assume most privacy sensitive people are.

> if you're using a local account

Unfortunately Microsoft keeps working to destroy that option and force consumers to make a remote account. [0][1] Their consistent moves towards wanting to co-own my computer were one of the many last-straws that made me migrate everything to Linux this year.

> Local-only commands removal: We are removing known mechanisms for creating a local account in the Windows Setup experience (OOBE). While these mechanisms were often used to bypass Microsoft account setup, they also inadvertently skip critical setup screens, potentially causing users to exit OOBE with a device that is not fully configured for use. Users will need to complete OOBE with internet and a Microsoft account, to ensure device is setup correctly.

[0] https://blogs.windows.com/windows-insider/2025/10/06/announc...

[1] https://www.windowslatest.com/2025/10/07/microsoft-confirms-...

Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory

#142

Post by superkuh »

dijit wrote: post #68
Arainach wrote: post #65

Earlier quoted context omitted.

Veracrypt is more difficult to set up - whether on one machine or a fleet. Bitlocker is a few buttons in the UI, configurable via Group Policy, and so much more. What is brittle or awkward?

"PLEASE ENTER YOUR BITLOCKER RECOVERY KEY" Where is it? A) Uploaded to microsoft B) Somewhere in EntraID? C) Somewhere in our onprem AD? D) Written down on a scrap of paper when I set up the laptop the fact that they never ask for the passphrase is a weakness of the system. Because now you have an extremely difficult situation as soon as you're off the happy path. It's also like 64 characters alphanumeric with no cap…

Or nowhere you know at all if you're a non-technical user who was on a local account Win 11 setup who was tricked by microsoft dark pattern pop-ups getting you to go to "online accounts" which automatically and silently encrypts your drives in the background and then tells you to go to to some shady domain called aka.ms (with another computer, since yours is now locked on a bluescreen and unusable). Basically a typical ransomware message. In truth in this case it's #1 (uploaded to Microsoft) but the non-technical user doesn't know that. Even I thought aka.ms screen was ransomware when my parent called me saying their computer had a "virus".

Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory

#144

Post by Terr_ »

nacs wrote: post #32
naturalmovement wrote: post #24

Earlier quoted context omitted.

It absolutely is and they have most the enterprise market.

Reminder that by using Bitlocker, you're using a closed source encryption for which Microsoft will happily hand out your recovery key on request. https://www.forbes.com/sites/thomasbrewster/2026/01/22/micro...

Tangentially: Microsoft telemetry collects the serial# of your devices and reports it (with your IP and MS account) back to the mothership, and some printers embed their serial# in printed pages.

So take countermeasures if you print something out criticizing any groups that abuse political or law-enforcement powers.

Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory

#145

Post by dlcarrier »

noinsight wrote: post #86
IngoBlechschmid wrote: post #34

Earlier quoted context omitted.

Okay, yes, sure. It definitely is the most-used encryption software for Windows. But I would never trust it a second, being proprietary and known for issues. You likely know that, but for the benefit of others: 38C3 - Windows BitLocker: Screwed without a Screwdriver https://media.ccc.de/v/38c3-windows-bitlocker-screwed-withou... https://www.youtube.com/watch?v=5eNtT2p12cM

If you’re at all serious about security and not user convenience, you deploy BitLocker with a PIN instead of TPM only. And then a whole class of vulnerabilities goes away.

Just a PIN? For most people that's a 4-digit number, which has a worst-case scenario of 10,000 attempts and a median of only a few hundred. Why not use a full 8-digit password?

Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory

#147

Post by dlcarrier »

m3047 wrote: post #124
dist-epoch wrote: post #58

Earlier quoted context omitted.

Both Intel/AMD CPUs produced in the last 5 years or so support full transparent (to the OS) memory encryption. So cold boot attacks are a thing of the past if you enable this feature (it's typically disabled because it reduces RAM speed by about 0.5%).

Recent news is that this isn't shipping on some consumer-grade CPUs from AMD. There, made it explicit enough there's no room for conversation. Here's the link: https://arstechnica.com/security/2026/06/users-cry-foul-afte...

AMD backtracked on that strategy: https://www.techpowerup.com/350142/amd-to-restore-tsme-memor...

Future AGESA updates will still include memory encryption for all processor models. It's one of the rare instances of consumer backlash creating a clear and immediate response.

Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory

#148

Post by bluebarbet »

tombert wrote: post #103

I don't think this bothers me. The only reason that I do the disk encryption is so that I don't have to worry about people going through my laptop to steal tax documents and/or credit card stuff when I sell the laptop. I of course also wipe the laptop too, but I figure that if the data is encrypted at the drive level then there's very little risk of anyone being able to use some kind of forensics tool and recover dat…

Assuming the encryption key is strong, the wiping is theoretically redundant.

Re: Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory

#150

Post by nagaiaida »

gruez wrote: post #73
andrewpiroli wrote: post #38

Earlier quoted context omitted.

Only if you store your key with Microsoft, which is not required or the default if you're using a local account which I assume most privacy sensitive people are.

Not to mention that unless the bitlocker activation flow changed recently, it specifically asks you how to store your backup keys, with a choice given been local options (eg. usb drive, printing it off, etc.) and saving it to your microsoft account.

dell opts you in without telling you. one day you'll just reboot to an unexpected bitlocker screen and have to figure out whether you're getting ransomwared before eventually digging a key out of your microsoft account you weren't aware was there.
Post reply on HN