New Year's Resolution: Full Disk Encryption on Every Computer You Own • Hacker News Board

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#141

Post by culturestate » Mon, Jan 02, 2012, 8:29 PM UTC

gojomo wrote: post #138

bengl3rt wrote: post #121

Unfortunately, full-disk encryption absolutely kills SSD performance because it makes the data look random (i.e. incompressible). It will wear out the SSD much faster than using it without would, because the hardware compression unit in the controller can sometimes achieve 8:1, and therefore have to rewrite only 1/8th of the NAND cells that it otherwise would.

I think you're right on the effect but wrong on the implied grave magnitudes "absolutely kills" and "much faster", because: • not all SSDs even have hardware compression • modern workloads have less highly compressible data than in the past: large-media formats include their own compression, and bulk data processing often does its own application-level compress/decompress on store/load I'd be interested to see any be…

Anand benchmarked FileVault(1) and his conclusion was "Overall the hit on pure I/O performance is in the 20 - 30% range. It's noticeable but not big enough to outweigh the benefits of full disk encryption."

1. http://www.anandtech.com/show/4485/back-to-the-mac-os-x-107-...

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#142

Post by culturestate » Mon, Jan 02, 2012, 8:35 PM UTC

paulhauggis wrote: post #139

outworlder wrote: post #131

Earlier quoted context omitted.

That's why you should have up-to-date backups.

but then couldn't people still get to your unencrypted data (through your backups)?

If you're doing FDE, you should be encrypting your backups as well. It can be relatively trivial, depending on your backup setup.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#143

Post by kgo » Mon, Jan 02, 2012, 8:59 PM UTC

Jach wrote: post #29

If you go full disk encryption with TrueCrypt, make sure you look into their Hidden OS feature as well. A judge may be able to order you to give up the decryption key to the OS when accessing the drive prompts for one (last I checked the precedent is still somewhat shaky), because while they can't know what's being encrypted they can infer something readable is. They can't prove the existence of a Hidden OS, though,…

Actually it works the other way around, and is considered to be a problem by many security experts. If you don't have a Hidden OS partition, and the court requests the password, it's impossible for you to prove you DON'T have one. Just like it's impossible to prove you just forgot your password.

So you're better off making a hidden OS partition and not using it, just so you can access it.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#144

Post by jodrellblank » Mon, Jan 02, 2012, 9:03 PM UTC

Willwhatley wrote: post #39

flipbrad wrote: post #20

Earlier quoted context omitted.

To be honest, I don't see why national borders are so strongly part of the equation. I suppose that depends on your worldview. I live within the Schengen Area, and to me it seem patently obvious that most 'bad things' in the world are hardly affected by national borders. They're typically supra-national (climate change, credit crunch, cracking, etc) or intra-national (most crime, etc. I don't mean to argue for more c…

My understanding is World War I. Apparently passports and visas were an innovation inspired by the militarism and nationalism that swept Europe at the beginning of the twentieth century. However governments rarely divest themselves of power once acquired, and so although many, many more folk are internationalist these years, there exists this relict of national control. /stills rant about how in the United States, th…

Apparently passports and visas were an innovation inspired by the militarism and nationalism that swept Europe at the beginning of the twentieth century.

Passports were referenced plenty in Around The World in 80 Days, written in 1873. ( http://aroundtheworld.phileas-fogg.net/80days.html )

Although if you mean the systematic use of passports, rather than their invention, yes - Wikipedia Says:

*During World War I, European governments introduced border passport requirements for security reasons (to keep out spies) and to control the emigration of citizens with useful skills, retaining potential manpower. These controls remained in place after the war, and became standard procedure, though not without controversy. British tourists of the 1920s complained, especially about attached photographs and physical descriptions, which they considered led to a "nasty dehumanisation"

- http://en.wikipedia.org/wiki/Passport

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#145

Post by kgtm » Mon, Jan 02, 2012, 9:16 PM UTC

culturestate wrote: post #141

gojomo wrote: post #138

Earlier quoted context omitted.

I think you're right on the effect but wrong on the implied grave magnitudes "absolutely kills" and "much faster", because: • not all SSDs even have hardware compression • modern workloads have less highly compressible data than in the past: large-media formats include their own compression, and bulk data processing often does its own application-level compress/decompress on store/load I'd be interested to see any be…

Anand benchmarked FileVault(1) and his conclusion was "Overall the hit on pure I/O performance is in the 20 - 30% range. It's noticeable but not big enough to outweigh the benefits of full disk encryption." 1. http://www.anandtech.com/show/4485/back-to-the-mac-os-x-107-...

Yes, but that result is most likely on a Sandforce-powered SSD, which sports different transfer speeds based on the payload (compressible/incompressible). Like the GP notes, this is not a problem with SSDs in general.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#146

Post by jodrellblank » Mon, Jan 02, 2012, 9:26 PM UTC

culturestate wrote: post #142

paulhauggis wrote: post #139

Earlier quoted context omitted.

but then couldn't people still get to your unencrypted data (through your backups)?

If you're doing FDE, you should be encrypting your backups as well. It can be relatively trivial, depending on your backup setup.

This is all good, until you get any kind of disk corruption. Good luck getting any of your data back.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#147

Post by paulhauggis » Mon, Jan 02, 2012, 9:35 PM UTC

paulhauggis wrote: post #114

This is all good, until you get any kind of disk corruption. Good luck getting any of your data back.

Why am I down voted?

My laptop HD was encrypted, it got corrupted, and I lost the entire drive. If even a few bytes are corrupted, you are SOL.

Luckily, I had an offsite backup (unencrypted) I'm just warning people about the dangers of not keeping an unecrypted backup.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#148

Post by culturestate » Mon, Jan 02, 2012, 9:38 PM UTC

kgtm wrote: post #145

culturestate wrote: post #141

Earlier quoted context omitted.

Anand benchmarked FileVault(1) and his conclusion was "Overall the hit on pure I/O performance is in the 20 - 30% range. It's noticeable but not big enough to outweigh the benefits of full disk encryption." 1. http://www.anandtech.com/show/4485/back-to-the-mac-os-x-107-...

Yes, but that result is most likely on a Sandforce-powered SSD, which sports different transfer speeds based on the payload (compressible/incompressible). Like the GP notes, this is not a problem with SSDs in general.

That benchmark is with a stock Apple SSD, which IIRC are not Sandforce-based. To be clear, I'm actually in agreement with Anand and OP - the benefits of FDE far outweigh the consequential I/O hit.

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#149

Post by culturestate » Mon, Jan 02, 2012, 9:49 PM UTC

jodrellblank wrote: post #146

culturestate wrote: post #142

Earlier quoted context omitted.

If you're doing FDE, you should be encrypting your backups as well. It can be relatively trivial, depending on your backup setup.

This is all good, until you get any kind of disk corruption. Good luck getting any of your data back.

If my encrypted disk becomes corrupted and then corrupts my unencrypted backup, what's the difference?

Re: New Year's Resolution: Full Disk Encryption on Every Computer You Own

#150

Post by st3fan » Mon, Jan 02, 2012, 9:52 PM UTC

conradev wrote: post #89

tobiasbischoff wrote: post #8

On OSX with Lion - there is no excuse http://osxdaily.com/2011/08/10/filevault-2-benchmarks-disk-e...

Combined with a firmware password, it makes a MacBook impenentrable.

Got a good pointer to setting a firmware password?