Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So I lost my OpenBSD FDE password (2016)

words.filippo.io

Post reply on HN
Print view View original

31–40 of 77 posts

Re: So I lost my OpenBSD FDE password (2016)

#31

Post by girvo »

calvinmorrison wrote: post #6
dspillett wrote: post #2

This is something that is difficult when trying to encourage less technical users to be secure. Once you convince them to do things right, they've heard of circumstances like this and are petrified of accidentally losing something. In a commercial environment there are ways and means¹ but getting a non-technical user to securely and safely manage access credentials is can be a time consuming education process. Especi…

I am sitting on a 12TB array after my move I just can't come up with the combination... However, there are better options for users - how about Smartcards? You know, like yubikey / U2F before the web? You can even use it with LUKS

As much as I adore my Yuibikey, my girlfriend thinks I’m decidedly weird because I have two: one on my actual keys, and a backup that’s in my safe at home. Which is annoying because not every system lets me setup two Yubikeys (though TOTP is fine at least). I’m not using it for FDE, but I am using it for securing my password manager (which does support both keys) which holds the backup keys for said FDE and so on.

Re: So I lost my OpenBSD FDE password (2016)

#32

Post by nutto »

nijave wrote: post #30
orangepurple wrote: post #21

Earlier quoted context omitted.

So if your motherboard needs to be replaced you can't recover your data? Nice!

It's effectively just multiple key protectors. TPM+PIN is one way to protect the data encryption key. You can also backup the actual encryption key (which is the recovery key). You can also add a password that protects the key or back the key up to an online Microsoft account or enterprise Active Directory account.

The actual encryption key for the volume data isn't the recovery key, it's the FVEK (full volume encryption key), which is encrypted using the VMK (volume master key).

The recovery key is a 128-bit value (entered as 8 groups of 7 digits, each of which when divided by 11 gives a 16-bit value, where a non-zero remainder indicates the group has been incorrectly entered) which gets hashed repeatedly, with a salt, to derive a 256-bit key that decrypts a copy of the VMK.

Re: So I lost my OpenBSD FDE password (2016)

#33

Post by jojobas »

briHass wrote: post #18
dspillett wrote: post #2

This is something that is difficult when trying to encourage less technical users to be secure. Once you convince them to do things right, they've heard of circumstances like this and are petrified of accidentally losing something. In a commercial environment there are ways and means¹ but getting a non-technical user to securely and safely manage access credentials is can be a time consuming education process. Especi…

This is why Microsoft Windows is so adamant about having you create an online account as your means of sign-in on modern Windows versions. FDE requires it on some versions. Telling users that forgot their password that not only do they need to reinstall Windows, but that every single document, photo, video of their grandkids, etc. is now lost forever is untenable. At the same time, FDE is important for security, so w…

FDE with someone "in the cloud" having the key is defeating the purpose of FDE. Windows used to offer printing a very long key on paper.

Re: So I lost my OpenBSD FDE password (2016)

#34

Post by dspillett »

briHass wrote: post #18
dspillett wrote: post #2

This is something that is difficult when trying to encourage less technical users to be secure. Once you convince them to do things right, they've heard of circumstances like this and are petrified of accidentally losing something. In a commercial environment there are ways and means¹ but getting a non-technical user to securely and safely manage access credentials is can be a time consuming education process. Especi…

This is why Microsoft Windows is so adamant about having you create an online account as your means of sign-in on modern Windows versions. FDE requires it on some versions. Telling users that forgot their password that not only do they need to reinstall Windows, but that every single document, photo, video of their grandkids, etc. is now lost forever is untenable. At the same time, FDE is important for security, so w…

Well, one if the official reasons/excuses. Tracking in various forms is the main reason MS is so adamant about that…

Re: So I lost my OpenBSD FDE password (2016)

#35

Post by ilammy »

jojobas wrote: post #33
briHass wrote: post #18

Earlier quoted context omitted.

This is why Microsoft Windows is so adamant about having you create an online account as your means of sign-in on modern Windows versions. FDE requires it on some versions. Telling users that forgot their password that not only do they need to reinstall Windows, but that every single document, photo, video of their grandkids, etc. is now lost forever is untenable. At the same time, FDE is important for security, so w…

FDE with someone "in the cloud" having the key is defeating the purpose of FDE. Windows used to offer printing a very long key on paper.

Depends on your threat model.

Most people protect against access by whoever stole their laptop, with Microsoft and TLAs not being considered a threat. Those who do probably don't use Windows in the first place.

Re: So I lost my OpenBSD FDE password (2016)

#36

Post by gwillen »

girvo wrote: post #31
calvinmorrison wrote: post #6

Earlier quoted context omitted.

I am sitting on a 12TB array after my move I just can't come up with the combination... However, there are better options for users - how about Smartcards? You know, like yubikey / U2F before the web? You can even use it with LUKS

As much as I adore my Yuibikey, my girlfriend thinks I’m decidedly weird because I have two: one on my actual keys, and a backup that’s in my safe at home. Which is annoying because not every system lets me setup two Yubikeys (though TOTP is fine at least). I’m not using it for FDE, but I am using it for securing my password manager (which does support both keys) which holds the backup keys for said FDE and so on.

Name and shame sites that don't support using multiple Yubikeys! I'm pretty sure they're violating the guidelines in the standard if they do that.

Re: So I lost my OpenBSD FDE password (2016)

#37

Post by sedatk »

This is one the main problems with our approach to information security: we disproportionately prioritize protection of our data against theft/law enforcement/rogue bigtech employee over losing it in any other way. That's why many have lost their thousands of bitcoins, because they secured their keys so hard against theft that their data has eventually become unrecoverable despite that there'd be no thief, officer, rogue employee perhaps for a decade.

People who advise not using cloud for backups, suggesting cold wallets and whatnot as blanket advice have been harmful by giving way to the orders of magnitude more likely but the catastrophic scenario that is simple data loss.

Some people bash on Microsoft for backing up your drive encryption keys in the cloud for example, but it's the most common failure mode they're trying to address. No thief would access your cloud, no state-level actor would be deterred by lack of cloud (see: xkcd wrench), no rogue employee could make use of your hard drive encryption keys.

Get your priorities based on your threat model, and get your threat model right, people.

Re: So I lost my OpenBSD FDE password (2016)

#38

Post by ok_dad »

I’ve just been using the same password for my FDE forever, and only for that purpose. I figure it keeps my data safe from theft, but probably not from the feds or my wife if she wanted in there, because they could either compel me to unlock it or have access to put some keyboard sniffer in my boot loader.

The password is quite a few random characters that I memorized when I first used FDE decades ago and I’ve never had reason to change it.

I rotate my other passwords often and never use this one anywhere other than a boot loader; I don’t even type it into a running operating system to save it.

I’ll never forget it, but if I had to change it then I think I would go with the “battery horse stapler” method of pass phrase.

Re: So I lost my OpenBSD FDE password (2016)

#39

Post by jchw »

sedatk wrote: post #37

This is one the main problems with our approach to information security: we disproportionately prioritize protection of our data against theft/law enforcement/rogue bigtech employee over losing it in any other way. That's why many have lost their thousands of bitcoins, because they secured their keys so hard against theft that their data has eventually become unrecoverable despite that there'd be no thief, officer, r…

I skimmed back the article after reading this comment, and I'm still not really sure how this follows. Of course you should always make redundant backups with parameters suitable for however much assurances you want to have that you will not lose data. However, I dunno if there's any particular evidence to suggest that data loss is the main concern here. I mean, I have a backup strategy for most of my data, but I'd choose to spend at least some time trying to avoid the need to restore a backup first. Plus, I don't think there's good evidence to suggest that data theft is not a huge concern for people. Inside this article is a link back to a previous article about a NAS vulnerability that allows anyone to change the password of the NAS and enable SSH without authentication. I dunno if it's the same vulnerability I remember from some years ago, but there was a pretty real situation where many WD MyCloud users had their data stolen and NASes wiped. (I actually had a thankfully-mostly-decommissioned MyCloud at the time and it did in fact get pwned.)

Backup strategies and good security posture is a "why not both" type of situation. It's harder than it should be, but sometimes that's the cost of doing business.

Re: So I lost my OpenBSD FDE password (2016)

#40

Post by kogir »

gwillen wrote: post #36
girvo wrote: post #31

Earlier quoted context omitted.

As much as I adore my Yuibikey, my girlfriend thinks I’m decidedly weird because I have two: one on my actual keys, and a backup that’s in my safe at home. Which is annoying because not every system lets me setup two Yubikeys (though TOTP is fine at least). I’m not using it for FDE, but I am using it for securing my password manager (which does support both keys) which holds the backup keys for said FDE and so on.

Name and shame sites that don't support using multiple Yubikeys! I'm pretty sure they're violating the guidelines in the standard if they do that.

AWS is my largest annoyance in this regard.
Post reply on HN