5 ms·

Honestly, that's not something you can expect from regular non-power users. Full-disk encryption isn't enabled by default on most consumer laptops, and few regu

Honestly, that's not something you can expect from regular non-power users. Full-disk encryption isn't enabled by default on most consumer laptops, and few regular users go out of their way to set it up.

briandear 7y ago
Full disk encryption is the default on MacOS Mojave.
- apk-d 7y ago
  It's also enabled by default on Surface Book 2 (and possibly other Surface line devices). No idea how well Bitlocker (or Windows Hello for that matter) stand up to border control.
  - oneplane 7y ago
    BitLocker security depends on TPM usage. If it's turned on a lab can crack it rather easily because the keys can be stolen via LPC.
- dontbenebby 7y ago
  > Full disk encryption is the default on MacOS Mojave. But many people don't use a strong password/phrase.
steelframe 7y ago
You don't need "full" disk encryption on Chromebook devices or Android phones. Both ship with file-based disk encryption for all user data, on-by-default for all recent devices. When I travel out of the country, I reset my phone and Chromebook to their factory defaults and then provision a decoy account. Once I'm across the border, I provision my primary account. Even if they image my devices, all they'll get is old encrypted garbage for which the key is unavailable because the key was rendered inaccessible when the device was reset to factory defaults.
- snazz 7y ago
  They could replace part of the password-checking software with a backdoored version that would send your password off to them. Your data is protected, but the OS can still compromise it and a bad actor can replace parts of the OS (which is open source in both of your cases, making the process even easier).
  - saagarjha 7y ago
    On Chrome OS, this should cause the “your OS is unverified” warning to show up.
    - snazz 7y ago
      Does that mean that every OS file is signed and checksummed like on iOS (correct me if I’m wrong)?
      - gruez 7y ago
        yes, something like this: https://source.android.com/security/verifiedboot/dm-verity https://source.android.com/security/verifiedboot/dm-verity
      - sowbug 7y ago
        https://www.chromium.org/chromium-os/chromiumos-design-docs/verified-boot https://www.chromium.org/chromium-os/chromiumos-design-docs/...
      - saagarjha 7y ago
        Yes, except you have the ability to replace it if you'd like.

briandear 7y ago

Full disk encryption is the default on MacOS Mojave.

apk-d 7y ago
It's also enabled by default on Surface Book 2 (and possibly other Surface line devices). No idea how well Bitlocker (or Windows Hello for that matter) stand up to border control.
- oneplane 7y ago
  BitLocker security depends on TPM usage. If it's turned on a lab can crack it rather easily because the keys can be stolen via LPC.
dontbenebby 7y ago
> Full disk encryption is the default on MacOS Mojave. But many people don't use a strong password/phrase.

steelframe 7y ago

You don't need "full" disk encryption on Chromebook devices or Android phones. Both ship with file-based disk encryption for all user data, on-by-default for all recent devices. When I travel out of the country, I reset my phone and Chromebook to their factory defaults and then provision a decoy account. Once I'm across the border, I provision my primary account. Even if they image my devices, all they'll get is old encrypted garbage for which the key is unavailable because the key was rendered inaccessible when the device was reset to factory defaults.

snazz 7y ago
They could replace part of the password-checking software with a backdoored version that would send your password off to them. Your data is protected, but the OS can still compromise it and a bad actor can replace parts of the OS (which is open source in both of your cases, making the process even easier).
- saagarjha 7y ago
  On Chrome OS, this should cause the “your OS is unverified” warning to show up.
  - snazz 7y ago
    Does that mean that every OS file is signed and checksummed like on iOS (correct me if I’m wrong)?
    - gruez 7y ago
      yes, something like this: https://source.android.com/security/verifiedboot/dm-verity https://source.android.com/security/verifiedboot/dm-verity
    - sowbug 7y ago
      https://www.chromium.org/chromium-os/chromiumos-design-docs/verified-boot https://www.chromium.org/chromium-os/chromiumos-design-docs/...
    - saagarjha 7y ago
      Yes, except you have the ability to replace it if you'd like.