Debian with full disk encryption as suggested by installer.
Works.
Ask HN: How do you encrypt your laptops?
51–60 of 155 posts
Re: Ask HN: How do you encrypt your laptops?
#52Yup, encrypt every time. Otherwise, they may be able to snag your SSH RSA keys off of the hard drive, and if you've password protected it, they can try to brute force it. Also, it helps safeguard against border patrol wanting to access your data while traveling.
Store your keys on a hardware token to reduce the chances of this happening (Nitrokey, Yubikey, OpenPGP smart card, etc.)
the way I read about Yubikey is that it is for websites, accounts, etc. Can you use it to log into your actual OS?
Re: Ask HN: How do you encrypt your laptops?
#53I also set up FileVault on my Mac, which I don't particularly like because it uses my login password to encrypt the hard drive.
I run Mint on my ThinkPad, and encrypted the hard drive at install-time (which is LUKS in the background). This means I have a separate password for the OS and my user data. The boot password is very long (it's a saying that is memorable to me) so is pretty difficult to brute-force, while my user password is complex enough for regular use. I also have my user data encrypted. LUKS can leverage the AES instructions on current-gen CPUs to speed up encrypted operations to near-native speeds, but even without it, you'll only notice a slow-down if you're doing heavy IO. My MBP is an old Core 2 Duo and is not unsable with FDE enabled.
I also used my Yubikey as a second factor for a time - you can hook this into the LUKS decryption screen to hash the passphrase a second time to generate the decryption key. While I was at it, I had my Yubikey set up to be required to log in or unlock the screen. So while there was a backup passphrase to unlock the hard drive, I couldn't get into my own user account without the Yubikey. I eventually disabled this because I thought it was overkill, but it works pretty well.
However, don't forget that encryption ONLY protects data at rest! A laptop in sleep mode is NOT secure, even with FDE. I always shut down the machine completely when I'm in a situation I could lose it (e.g. airport security). Otherwise, the keys are kept in memory, and a determined hacker has ways of getting to them - look up DMA attacks. Downloading the contents of RAM through a firewire port is pretty trivial these days.
A final thing to note - none of these methods stop a thief installing their own OS on your machine. Whilst this means your data is secure, you can make things a little bit harder for the thief by adding a boot or BIOS password to prevent them booting from a different medium. There are ways to reset this, admittedly, but since it won't get in your way (much), add another stumbling block for your enemy.
Re: Ask HN: How do you encrypt your laptops?
#54Earlier quoted context omitted.
That sounds like an annoyance, not encryption to me.
It's the 8-char password that I find absurd - that would take about 2 hours to brute force max.
Allegedly it's 256-bit AES and would take thousands of years to brute force. (Allegedly, because of course there's no way for me to easily verify!)
Re: Ask HN: How do you encrypt your laptops?
#55Earlier quoted context omitted.
Store your keys on a hardware token to reduce the chances of this happening (Nitrokey, Yubikey, OpenPGP smart card, etc.)
the way I read about Yubikey is that it is for websites, accounts, etc. Can you use it to log into your actual OS?
Yes, with a bit of setup and depending on your OS.
My problem with hardware tokens is simply that I lose them.
Re: Ask HN: How do you encrypt your laptops?
#56- Bitlocker on my Windows 10 Pro laptop (because I'm more concerned about an everyday thief prying open my laptop than a government agent) - ChromeOS built-in encryption/LUKS FDE on the Fedora partition on my Chromebook I should probably encrypt my Android phone and tablet, but I had a bad experience with performance overhead when I encrypted my last phone.
I have the same setup: bitlocker for Windows 10 and LUKS for Fedora. I have also enabled secure boot and it works fine with both OS'.
Re: Ask HN: How do you encrypt your laptops?
#57Earlier quoted context omitted.
It's the 8-char password that I find absurd - that would take about 2 hours to brute force max.
Allegedly it's 256-bit AES and would take thousands of years to brute force. (Allegedly, because of course there's no way for me to easily verify!)
a 256-bit AES key might take eternity, but if it's derived directly from 8-char ASCII the search space is tiny. Somewhat does depend on how it's actually implemented in hardware, however.
Re: Ask HN: How do you encrypt your laptops?
#58Earlier quoted context omitted.
Store your keys on a hardware token to reduce the chances of this happening (Nitrokey, Yubikey, OpenPGP smart card, etc.)
the way I read about Yubikey is that it is for websites, accounts, etc. Can you use it to log into your actual OS?
You can. The Yubikey can store a hash value in its second slot to act as a hardware token. I used to use mine with PAM so I couldn't get into my user account without it: https://developers.yubico.com/yubico-pam/
Re: Ask HN: How do you encrypt your laptops?
#59I don't have any files on my personal laptop. I have a USB key or two on my key-ring, and in theory I have an external hard-drive although currently I don't use it. I keep code on a VM and GitHub. In general I don't really have anything I can't lose or have made public. Instead of looking at my laptop as a thing I have to protect I look at it as a thing that will inevitably be lost, damaged or replaced.
What about session tokens to cloud services you likely use?
Re: Ask HN: How do you encrypt your laptops?
#60I use the Mac Disk Utility to create an encrypted volume. I use that volume to store sensitive files. Its just one file so its fairly easy to back up in its encrypted form.
The main hassle is I have to open the drive and enter the password before using. But its used infrequently.