Local Encryption ... Why Not?
-
There are so many exploits like this kept secret by black hats and/or governments (assuming you don't consider the two one and the same.) Tons of it is kept private for personal use, tons is shared, tons is sold. The info is out there and anyone who has it and doesn't expose it isn't a good guy. Simply by receiving information that someone has been exploited and keeping that secret from them makes you (you typically being a government) one of the bad guys.
-
@scottalanmiller said:
There are so many exploits like this kept secret by black hats and/or governments (assuming you don't consider the two one and the same.) Tons of it is kept private for personal use, tons is shared, tons is sold. The info is out there and anyone who has it and doesn't expose it isn't a good guy. Simply by receiving information that someone has been exploited and keeping that secret from them makes you (you typically being a government) one of the bad guys.
This, a thousand times, this!
-
More than two years since our last update on this one!
-
Still think FDE is a good way to go to protect against the non "deep state" hackers.
-
@brrabill said in Local Encryption ... Why Not?:
Still think FDE is a good way to go to protect against the non "deep state" hackers.
FDE does nothing against hacking, though, but is effective against people who walk off with your desktops. But hackers would never even know FDE was there, it's bypassed once the machine is powered on.
-
Right, I mean when the careless CEO leaves his laptop in an airport and you're just trying to protect the goods from a 14 year old kid with a Windows 10 ISO.
-
@scottalanmiller said in Local Encryption ... Why Not?:
@brrabill said in Local Encryption ... Why Not?:
Still think FDE is a good way to go to protect against the non "deep state" hackers.
FDE does nothing against hacking, though, but is effective against people who walk off with your desktops. But hackers would never even know FDE was there, it's bypassed once the machine is powered on.
Unless you use LUKS with passwords or something like a Yubikey.
-
@stacksofplates said in Local Encryption ... Why Not?:
@scottalanmiller said in Local Encryption ... Why Not?:
@brrabill said in Local Encryption ... Why Not?:
Still think FDE is a good way to go to protect against the non "deep state" hackers.
FDE does nothing against hacking, though, but is effective against people who walk off with your desktops. But hackers would never even know FDE was there, it's bypassed once the machine is powered on.
Unless you use LUKS with passwords or something like a Yubikey.
This is a gripe I've had with Bitlocker. Ya it's encrypted so someone can't just take a drive, but if they take the whole system it's unencrypted with the push of a button. I'm willing to bet you could get a shim between the drive and the SATA port to read data flowing. Of course this is completely out of realm of normal people, but it's still the point.
-
@stacksofplates said in Local Encryption ... Why Not?:
This is a gripe I've had with Bitlocker. Ya it's encrypted so someone can't just take a drive, but if they take the whole system it's unencrypted with the push of a button.
How? I'm not familiar with Bitlocker although it is installed on my laptop.
-
Just been re-reading some of this,
I need to "reinstall" my computer, might do it this afternoon. (need to install another SSD coz i can
)Might give Scott's idea of nothing stored on the local machine a go
have everything On-Line, maybe not even use Outlook . Most of the files i need/use are either in SharePoint or my OneDrive (or should be going forward) -
@stacksofplates said in Local Encryption ... Why Not?:
@stacksofplates said in Local Encryption ... Why Not?:
@scottalanmiller said in Local Encryption ... Why Not?:
@brrabill said in Local Encryption ... Why Not?:
Still think FDE is a good way to go to protect against the non "deep state" hackers.
FDE does nothing against hacking, though, but is effective against people who walk off with your desktops. But hackers would never even know FDE was there, it's bypassed once the machine is powered on.
Unless you use LUKS with passwords or something like a Yubikey.
This is a gripe I've had with Bitlocker. Ya it's encrypted so someone can't just take a drive, but if they take the whole system it's unencrypted with the push of a button.
It depends on if you are using a passphrase on the disk or if your computer has a TPM module. If it's TPM, then you're right. If you have a passphrase, then you're in a little better shape.
-
Simple answer to the concern about the system being unencrypted is to not use something based on hardware then. Use VeraCrypt if you need "more".
-
@dafyre said in Local Encryption ... Why Not?:
@stacksofplates said in Local Encryption ... Why Not?:
@stacksofplates said in Local Encryption ... Why Not?:
@scottalanmiller said in Local Encryption ... Why Not?:
@brrabill said in Local Encryption ... Why Not?:
Still think FDE is a good way to go to protect against the non "deep state" hackers.
FDE does nothing against hacking, though, but is effective against people who walk off with your desktops. But hackers would never even know FDE was there, it's bypassed once the machine is powered on.
Unless you use LUKS with passwords or something like a Yubikey.
This is a gripe I've had with Bitlocker. Ya it's encrypted so someone can't just take a drive, but if they take the whole system it's unencrypted with the push of a button.
It depends on if you are using a passphrase on the disk or if your computer has a TPM module. If it's TPM, then you're right. If you have a passphrase, then you're in a little better shape.
Right. I'm referring to TPM.
-
@carnival-boy said in Local Encryption ... Why Not?:
@stacksofplates said in Local Encryption ... Why Not?:
This is a gripe I've had with Bitlocker. Ya it's encrypted so someone can't just take a drive, but if they take the whole system it's unencrypted with the push of a button.
How? I'm not familiar with Bitlocker although it is installed on my laptop.
If it's using TPM to unlock, all you have to do is turn it on.
-
@hobbit666 said in Local Encryption ... Why Not?:
Just been re-reading some of this,
I need to "reinstall" my computer, might do it this afternoon. (need to install another SSD coz i can
)Might give Scott's idea of nothing stored on the local machine a go
have everything On-Line, maybe not even use Outlook . Most of the files i need/use are either in SharePoint or my OneDrive (or should be going forward)All of my dotfiles are in version control. Every time I open a new terminal it checks for changes. So really the only thing that's local for me is the applications that are installed (and keys).
-
@stacksofplates said in Local Encryption ... Why Not?:
If it's using TPM to unlock, all you have to do is turn it on.
Sure, but Bitlocker with TPM allows you to setup a pre-boot pin, so all good.
-
@carnival-boy said in Local Encryption ... Why Not?:
@stacksofplates said in Local Encryption ... Why Not?:
If it's using TPM to unlock, all you have to do is turn it on.
Sure, but Bitlocker with TPM allows you to setup a pre-boot pin, so all good.
Yeah, if you do that, TPM does good stuff for mobile devices.
-
@carnival-boy said in Local Encryption ... Why Not?:
@stacksofplates said in Local Encryption ... Why Not?:
If it's using TPM to unlock, all you have to do is turn it on.
Sure, but Bitlocker with TPM allows you to setup a pre-boot pin, so all good.
Right, as long as you require something. I’ve seen some that just do TPM and nothing else. I guess it’s not a gripe I have with Bitlocker. Just the fact that people don’t pay attention to that. LUKS forces a password or some type of key.
-
Had a customer a few weeks ago lose their laptop because they encrypted it but couldn't figure out their password. Non-replaceable part. So it was hosed.
-
I've advocated we store nothing on our laptops but so far its had little effect. We are very backward here unfortunately. I think storing mostly online is very good and makes services like Nextcloud very valuable in this scenario.
