4 ms·

> But with LUKS FDE, even booting is arguably hard unless they could read the key from RAM. You can also use FDE on Android devices. That won't stop the border

by GranPC 7y ago

> But with LUKS FDE, even booting is arguably hard unless they could read the key from RAM. You can also use FDE on Android devices. That won't stop the border police from forcing you to unlock your device or deny entry, though.

mirimir 7y ago
True, using dm-crypt. And iOS also has FDE. So my comment about iOS vs Android only applies once the phone is unlocked. And I wouldn't be comfortable with just the root passphrase protecting me. My main complaint is Apple -- and so anyone who can pressure Apple -- controlling what I can install on the device.
- knd775 7y ago
  You can sideload apps on iOS. You can use cydia impactor, use enterprise certificates, or sign them yourself.
  - mirimir 7y ago
    Huh. Didn't know about cydia impactor. But Apple can revoke certificates, and then your stuff is gone. Right?
    - knd775 7y ago
      Unfortunately, yes. If you don't distribute the signed binary, they'll never do it. But, they can, which is unfortunate.
bilbo0s 7y ago
>is arguably hard unless they could read the key from RAM... That's the fine print that kind of makes FDE a bad fit for mobile. (At least FDE as it's typically implemented.) I don't think it's any secret that Trust Zone has a larger attack surface than Secure Enclave, but cold boot attacks to extract data from RAM are stupidly pedestrian. At least make it hard for them. Apple's self destruct is extremely poor UX for any user cursed with the misfortune of forgetfulness, but it's a lot more secure than Android's Trust Zone.