6 ms·

First off, I'd like to throw Bitlocker back in the ring and tell you that boot volume encryption is relatively unimportant for the threat model you propose, spe

by ENOTTY 16y ago

First off, I'd like to throw Bitlocker back in the ring and tell you that boot volume encryption is relatively unimportant for the threat model you propose, specifically untargeted data at rest. Boot volume encryption/verification is designed to protect you against attackers who would replace your boot image with a one that contains a rootkit or keylogger. This threat model requires serious forethought and planning on the part of the attacker. He is likely targeting you or your company and he wants to do it steathily. Under this kind of threat, you really need the entire company to adopt an extremely high level of operational security. (Remember your security is only as strong as the weakest link in the chain.) Usually, this kind of paranoia is reserved for three letter agencies. I should mention that Truecrypt doesn't protect against this threat either. At some point, there needs to be an unencrypted bootloader, which can be attacked. Hardware boot volume verification would verify that the bootloader has not been modified, which is what TPM tries to do. Unless the encryption is implemented poorly (which in Truecrypt and Bitlocker is not) an attacker with access to your boot partition cannot attack your data partition without additional information (like your password). On OS X, I've heard good things about PGP Whole Disk Encryption. I don't know if Truecrypt can handle Boot Camp (PGP WDE can), if you care about that at all. On Linux, I use dm-crypt + luks

nonane 16y ago
Excellent points. I said earlier that I wanted a no-brainer solution where I don't want to think / worry about where my applications or, even the OS decides to store my personal data - this is why whole-drive encryption looked attractive. However, an attacker would need some planning to get to that sort of data out - a common thief would probably not have that kind of skill anyway.
- acqq 16y ago
  No, it's more the question of the goal of the "attacker" when you don't do the whole-drive encryption. If you have the data on the notebook that are worth a lot of money and you can imagine that somebody would be interested at that then you should encrypt the OS partition. Ever heard about page file? It's on the OS partition, unencrypted. Temporary files? There, unencrypted. Even if the temporary files are deleted, the content of them remains on the hard disk. Unencrypted.
acqq 16y ago
I don't agree with the above. If we're talking about Windows, it's not "boot volume encryption" but the "C: disk encryption" that you have to worry about even if the attack scenario is data at rest. If you don't encrypt C: disk every forensic worker will trivially recover a lot of material that you'd believe was encrypted on another partition. If we're talking about Linux where you configured /boot unencrypted and everything else encrypted, only then it's about the attack scenario that parent mentions.
- ENOTTY 16y ago
  Bitlocker, Truecrypt, dm-crypt, PGP WDE will encrypt your data but leave something unencrypted in order to boot from it. I'm not advocating against "full" disk encryption. That's what I use. I just wanted to say that the OP doesn't need boot volume verification and that Bitlocker is sufficient for his needs.
rm-rf 16y ago
Assuming of course that all the data that you wish to protect is on your data partition, and that no protected data is, was, or ever will be on any other partition. Full disk encryption removes the possibility of exposure of protected data showing up on non-encrypted partitions. With most operating systems, I don't think that there is a way to ensure that no protected data will ever end up on a non-protected partition. Presumably - if there is any writable directory on an unencrypted partition, there is a reasonable chance that protected data will end up on that partition.
- ENOTTY 16y ago
  I highly doubt an OS or an application would be writing to the unencrypted boot sector or an unencrypted boot partition. First off, the OS should disallow that operation without elevated privileges. I don't know if Windows or OSX follow that guidance. I'm not advocating against "full" disk encryption. That's what I use. I just wanted to say that the OP doesn't need boot volume verification and that Bitlocker is sufficient for his needs.
iuguy 16y ago
> boot volume encryption is relatively unimportant for the threat model you propose, specifically untargeted data at rest. I'll have to respectfully disagree here. Windows has heaps of different ways of caching all kinds of information outside of your home folder. Individual applications can also cache stuff wherever permissions allow (and often do). Realistically with Windows if you're going to encrypt you want to encrypt your C: drive. PGP WDE works, it's 'good enough' to be a PITA for any authorities and you can use the same software on PC and Mac, but be warned - PGP broke Snow Leopard upgrades from Leopard when it came out and every major PGP upgrade I've ever done on Windows has resulted in a reinstall (but then again, 9.x was really, really bad). If you're using a non-administrator account for your day to day on OSX you can use FileVault - just watch your /tmp folder.
- ENOTTY 16y ago
  I highly doubt an OS or an application would be writing to the unencrypted boot sector or an unencrypted boot partition. At some point, some partition somewhere will need to be unencrypted, otherwise the system cannot boot, since the decryption programs are typically too large for a single boot sector. I'm not advocating against "full" disk encryption. That's what I use. I just wanted to say that the OP doesn't need boot volume verification and that Bitlocker is sufficient for his needs.
geocar 16y ago
I use PGP WDE on OSX. It is easy to use and doesn't seem to slow it down much. I have however ran into one problem: The licensing app somehow "forgot" that it was registered (something to do with changing active directory binding). I would not have noticed except I went looking for why the computer was so slow. I opened the PGP app and it said it wasn't licensed and the disk was "decrypting" itself. I had to wait for basically 3 hours for it to decrypt the disk, re-enter my registration information, and re-encrypt the disk.
ENOTTY 16y ago
Okay, seems a lot of people misunderstood what I meant. There is no such thing as full disk encryption, at least in the "full" sense of the term. There will be some unencrypted partition somewhere that boots the OS. TPM is designed to verify that this partition has not changed from a trusted configuration. I wanted to say that OP does not need this level of security, which is why Bitlocker is a viable and free and fast solution for him to use. (And the security current implementations of TPM provide are questionable right now.) Applications should not be allowed to write to this partition without elevated privileges. The OS shouldn't be writing to this during normal operation either. Sensitive data should not be put on this partition, and as far as I have heard, Windows has not done anything like this. When I say "data", what I refer to is the C: drive. With Bitlocker and Truecrypt, the C: drive is encrypted. The Users folder should be encrypted. All the bazillions of temp directories should be encrypted. The hibernation file is encrypted. Even Program Files is encrypted.

by ENOTTY 16y ago

nonane 16y ago

Excellent points. I said earlier that I wanted a no-brainer solution where I don't want to think / worry about where my applications or, even the OS decides to store my personal data - this is why whole-drive encryption looked attractive. However, an attacker would need some planning to get to that sort of data out - a common thief would probably not have that kind of skill anyway.

acqq 16y ago
No, it's more the question of the goal of the "attacker" when you don't do the whole-drive encryption. If you have the data on the notebook that are worth a lot of money and you can imagine that somebody would be interested at that then you should encrypt the OS partition. Ever heard about page file? It's on the OS partition, unencrypted. Temporary files? There, unencrypted. Even if the temporary files are deleted, the content of them remains on the hard disk. Unencrypted.

acqq 16y ago

I don't agree with the above. If we're talking about Windows, it's not "boot volume encryption" but the "C: disk encryption" that you have to worry about even if the attack scenario is data at rest. If you don't encrypt C: disk every forensic worker will trivially recover a lot of material that you'd believe was encrypted on another partition. If we're talking about Linux where you configured /boot unencrypted and everything else encrypted, only then it's about the attack scenario that parent mentions.

ENOTTY 16y ago
Bitlocker, Truecrypt, dm-crypt, PGP WDE will encrypt your data but leave something unencrypted in order to boot from it. I'm not advocating against "full" disk encryption. That's what I use. I just wanted to say that the OP doesn't need boot volume verification and that Bitlocker is sufficient for his needs.

rm-rf 16y ago

Assuming of course that all the data that you wish to protect is on your data partition, and that no protected data is, was, or ever will be on any other partition. Full disk encryption removes the possibility of exposure of protected data showing up on non-encrypted partitions. With most operating systems, I don't think that there is a way to ensure that no protected data will ever end up on a non-protected partition. Presumably - if there is any writable directory on an unencrypted partition, there is a reasonable chance that protected data will end up on that partition.

ENOTTY 16y ago
I highly doubt an OS or an application would be writing to the unencrypted boot sector or an unencrypted boot partition. First off, the OS should disallow that operation without elevated privileges. I don't know if Windows or OSX follow that guidance. I'm not advocating against "full" disk encryption. That's what I use. I just wanted to say that the OP doesn't need boot volume verification and that Bitlocker is sufficient for his needs.

iuguy 16y ago

> boot volume encryption is relatively unimportant for the threat model you propose, specifically untargeted data at rest. I'll have to respectfully disagree here. Windows has heaps of different ways of caching all kinds of information outside of your home folder. Individual applications can also cache stuff wherever permissions allow (and often do). Realistically with Windows if you're going to encrypt you want to encrypt your C: drive. PGP WDE works, it's 'good enough' to be a PITA for any authorities and you can use the same software on PC and Mac, but be warned - PGP broke Snow Leopard upgrades from Leopard when it came out and every major PGP upgrade I've ever done on Windows has resulted in a reinstall (but then again, 9.x was really, really bad). If you're using a non-administrator account for your day to day on OSX you can use FileVault - just watch your /tmp folder.

ENOTTY 16y ago
I highly doubt an OS or an application would be writing to the unencrypted boot sector or an unencrypted boot partition. At some point, some partition somewhere will need to be unencrypted, otherwise the system cannot boot, since the decryption programs are typically too large for a single boot sector. I'm not advocating against "full" disk encryption. That's what I use. I just wanted to say that the OP doesn't need boot volume verification and that Bitlocker is sufficient for his needs.

geocar 16y ago

I use PGP WDE on OSX. It is easy to use and doesn't seem to slow it down much. I have however ran into one problem: The licensing app somehow "forgot" that it was registered (something to do with changing active directory binding). I would not have noticed except I went looking for why the computer was so slow. I opened the PGP app and it said it wasn't licensed and the disk was "decrypting" itself. I had to wait for basically 3 hours for it to decrypt the disk, re-enter my registration information, and re-encrypt the disk.

ENOTTY 16y ago

Okay, seems a lot of people misunderstood what I meant. There is no such thing as full disk encryption, at least in the "full" sense of the term. There will be some unencrypted partition somewhere that boots the OS. TPM is designed to verify that this partition has not changed from a trusted configuration. I wanted to say that OP does not need this level of security, which is why Bitlocker is a viable and free and fast solution for him to use. (And the security current implementations of TPM provide are questionable right now.) Applications should not be allowed to write to this partition without elevated privileges. The OS shouldn't be writing to this during normal operation either. Sensitive data should not be put on this partition, and as far as I have heard, Windows has not done anything like this. When I say "data", what I refer to is the C: drive. With Bitlocker and Truecrypt, the C: drive is encrypted. The Users folder should be encrypted. All the bazillions of temp directories should be encrypted. The hibernation file is encrypted. Even Program Files is encrypted.