6 ms·

FYI, at this point, hardware-based drive encryption is considered utterly broken and you shouldn't use it: https://news.ycombinator.com/item?id=18382975 https:/

FYI, at this point, hardware-based drive encryption is considered utterly broken and you shouldn't use it: https://news.ycombinator.com/item?id=18382975 https://news.ycombinator.com/item?id=18382975

Rapzid 7y ago
I will look into it but the 970 Evo I have supposedly has fixes in for a lot of the stuff from a couple years back.
londons_explore 7y ago
Which is a real shame, because 'in the hardware, with no software complexity or overhead' is exactly where encryption should live. I wish some SSD manufacturers would get third party audits of their firmware which can say "We believe data stored on this SSD is not decryptable without an externally provided key". It ought to be pretty trivial to inspect the source to verify all keys which can derive the master key are never written to persistent storage.
- dmos62 7y ago
  Audit-based security is ok, but the ideal solution is open hardware and firmware.
  - londons_explore 7y ago
    My ranking of security: "It's secure because we say so" "It's secure, and we have a published design and audit" "It's open source" "We're offering a reward to anyone who can break it" "Our company would go under if anyone found a flaw in it" SSD's are currently at the first stage.
    - dmos62 7y ago
      I'd put "it's open-source and simple" somewhere below "it's open source". There are quite a few open source codebases that are very hard to trust due to the sheer complexity.
      - beatgammit 7y ago
        Yeah, like OpenSSL a few years ago.
    - close04 7y ago
      I'm not sure if I'd put being open source higher than actually being audited. In theory there's no difference between the 2. In practice being open source means that it could be audited while publishing an audit means it was. It's the difference between giving someone money and giving them a lottery ticket for that money. As many programmers admit themselves, it's also their job/duty/etc. to audit open source code but most actually don't especially for the sprawling, complex code. When everybody's responsible nobody is. It's better than closed source and security through obscurity but potential is only valuable if exploited. OSS without audit could be in some cases just as (in)secure as closed source simply because it may provide its own layer of obscurity through complexity and the expectation that "someone" will check. Someone else.
      - londons_explore 7y ago
        True, but this is balanced by the fact many audits miss parts, and at least being opensource means it's quite likely to become the target of automated fuzzers and vulnerability scanning tools.
    - MayeulC 7y ago
      Add to that: "I designed it" (and was checked) "I built it myself" Which is actually cumulative with what you wrote. We currently have a bit of a "trusting trust" issue with open hardware: how do you check that the fab didn't tamper with your ICs before manufacturing them?
      - dmos62 7y ago
        > how do you check that the fab didn't tamper with your ICs Same goes for deployable software. How do you know that that program is compiled from that source?
        MayeulC 7y ago
        That's quite easy actually: with reproducible builds, hashes and signatures. None of this is possible or easy to do in the hardware world.
        dmos62 7y ago
        Suppose you have the source code for gmail: how do you know that what you're interacting with when you're on gmail.com is compiled from that?
        MayeulC 7y ago
        Gmail is kind of tricky, I am not sure if you are talking about the web interface or something else. The web interface is a slightly more complex case, as you'd have to patch the browser, and check every piece of javascript. You cannot check the server part yourself, of course. But you wouldn't use SAAS if you were interested in security in the first place, unless you trust Google's servers, in which case HTTPS+HSTS (+cert pinning?) should be enough. Otherwise (android app? Browser js/html/css?) you separately compile gmail. Assuming the build is reproductible, you can check that its hash corresponds to what was sent to you.
    - numpad0 7y ago
      Is it ranked from middle to top & bottom? Because both ends looks weak

FYI, at this point, hardware-based drive encryption is considered utterly broken and you shouldn't use it: https://news.ycombinator.com/item?id=18382975 https://news.ycombinator.com/item?id=18382975

Rapzid 7y ago

I will look into it but the 970 Evo I have supposedly has fixes in for a lot of the stuff from a couple years back.

londons_explore 7y ago

Which is a real shame, because 'in the hardware, with no software complexity or overhead' is exactly where encryption should live. I wish some SSD manufacturers would get third party audits of their firmware which can say "We believe data stored on this SSD is not decryptable without an externally provided key". It ought to be pretty trivial to inspect the source to verify all keys which can derive the master key are never written to persistent storage.

dmos62 7y ago
Audit-based security is ok, but the ideal solution is open hardware and firmware.
- londons_explore 7y ago
  My ranking of security: "It's secure because we say so" "It's secure, and we have a published design and audit" "It's open source" "We're offering a reward to anyone who can break it" "Our company would go under if anyone found a flaw in it" SSD's are currently at the first stage.
  - dmos62 7y ago
    I'd put "it's open-source and simple" somewhere below "it's open source". There are quite a few open source codebases that are very hard to trust due to the sheer complexity.
    - beatgammit 7y ago
      Yeah, like OpenSSL a few years ago.
  - close04 7y ago
    I'm not sure if I'd put being open source higher than actually being audited. In theory there's no difference between the 2. In practice being open source means that it could be audited while publishing an audit means it was. It's the difference between giving someone money and giving them a lottery ticket for that money. As many programmers admit themselves, it's also their job/duty/etc. to audit open source code but most actually don't especially for the sprawling, complex code. When everybody's responsible nobody is. It's better than closed source and security through obscurity but potential is only valuable if exploited. OSS without audit could be in some cases just as (in)secure as closed source simply because it may provide its own layer of obscurity through complexity and the expectation that "someone" will check. Someone else.
    - londons_explore 7y ago
      True, but this is balanced by the fact many audits miss parts, and at least being opensource means it's quite likely to become the target of automated fuzzers and vulnerability scanning tools.
  - MayeulC 7y ago
    Add to that: "I designed it" (and was checked) "I built it myself" Which is actually cumulative with what you wrote. We currently have a bit of a "trusting trust" issue with open hardware: how do you check that the fab didn't tamper with your ICs before manufacturing them?
    - dmos62 7y ago
      > how do you check that the fab didn't tamper with your ICs Same goes for deployable software. How do you know that that program is compiled from that source?
      - MayeulC 7y ago
        That's quite easy actually: with reproducible builds, hashes and signatures. None of this is possible or easy to do in the hardware world.
        dmos62 7y ago
        Suppose you have the source code for gmail: how do you know that what you're interacting with when you're on gmail.com is compiled from that?
        MayeulC 7y ago
        Gmail is kind of tricky, I am not sure if you are talking about the web interface or something else. The web interface is a slightly more complex case, as you'd have to patch the browser, and check every piece of javascript. You cannot check the server part yourself, of course. But you wouldn't use SAAS if you were interested in security in the first place, unless you trust Google's servers, in which case HTTPS+HSTS (+cert pinning?) should be enough. Otherwise (android app? Browser js/html/css?) you separately compile gmail. Assuming the build is reproductible, you can check that its hash corresponds to what was sent to you.
  - numpad0 7y ago
    Is it ranked from middle to top & bottom? Because both ends looks weak