4 ms·

So many bootloader fixes, this is awesome! For those using FDE, read this: http://spaceisdisorienting.com/when-fulldisk-encryption-goes-wrong http://spaceisdiso

So many bootloader fixes, this is awesome! For those using FDE, read this: http://spaceisdisorienting.com/when-fulldisk-encryption-goes-wrong http://spaceisdisorienting.com/when-fulldisk-encryption-goes... I tend to use FDE for non mission critical working environments, like casually surfing the web, or just messing around with code. FDE can go wrong at the worst of times, and can undo years of work if you let it. That's why if you're using FDE for anything important, you should be backing up crucial data to containers, or otherwise preparing for the entire disk to be scrambled beyond repair and or bricked.

pwnna 10y ago
That article describes how the master encryption key stored on the hdd (your password encrypts this key afaik) gets corrupted, which means the author was unable to recover the files on the computer even if nothing is wrong anywhere else. Now I'm not familiar with the inner workings of OS X as I don't personally use that system. However, with FDE (LUKS) on Linux, this is 100% avoidable if you backed up the LUKS Header: https://calum.org/posts/backup-your-LUKS-header-and-LVM-config https://calum.org/posts/backup-your-LUKS-header-and-LVM-conf.... This does not negate the need for a real backup tho. So you should backup your data regardless, however you want to do that.
- cmurf 10y ago
  I think there ought to be two copies of the header these days; each written out separately and atomically, and checksummed, similar to GPT (in the UEFI spec).
franciscop 10y ago
You should be doing regular back-ups, FDE or not FDE. If you can, keep a "cold one" in a remote location. For day to day, I use the T3 SSD[1]. It is tiny, ultra-resistent and not so expensive considering it's an SSD with USB 3.1 Type C. [1] https://www.amazon.com/Samsung-T3-Portable-SSD-MU-PT1T0B/dp/B01AVF6UO8 https://www.amazon.com/Samsung-T3-Portable-SSD-MU-PT1T0B/dp/...

pwnna 10y ago

That article describes how the master encryption key stored on the hdd (your password encrypts this key afaik) gets corrupted, which means the author was unable to recover the files on the computer even if nothing is wrong anywhere else. Now I'm not familiar with the inner workings of OS X as I don't personally use that system. However, with FDE (LUKS) on Linux, this is 100% avoidable if you backed up the LUKS Header: https://calum.org/posts/backup-your-LUKS-header-and-LVM-config https://calum.org/posts/backup-your-LUKS-header-and-LVM-conf.... This does not negate the need for a real backup tho. So you should backup your data regardless, however you want to do that.

cmurf 10y ago
I think there ought to be two copies of the header these days; each written out separately and atomically, and checksummed, similar to GPT (in the UEFI spec).

franciscop 10y ago

You should be doing regular back-ups, FDE or not FDE. If you can, keep a "cold one" in a remote location. For day to day, I use the T3 SSD[1]. It is tiny, ultra-resistent and not so expensive considering it's an SSD with USB 3.1 Type C. [1] https://www.amazon.com/Samsung-T3-Portable-SSD-MU-PT1T0B/dp/B01AVF6UO8 https://www.amazon.com/Samsung-T3-Portable-SSD-MU-PT1T0B/dp/...