4 ms·
Without WDE, how can you verify that the OS and apps haven't been altered? If a laptop with WDE is left in my control for days and then returned, you know you'
by kogir 16y ago
Without WDE, how can you verify that the OS and apps haven't been altered? If a laptop with WDE is left in my control for days and then returned, you know you're still safe. Without WDE, you have to completely wipe the unencrypted portion lest modified apps upload your encrypted user data once the system boots.
- borism 16y agoYou can compare unencrypted system files to those on your Time Machine back-up or installation media. What if system and program files were modified from within the system? WDE doesn't help in this case. WDE doesn't solve integrity or availability problems. It's primary goal is confidentiality.
- ryannielsen 16y agoArguably, all binaries comprising the OS and installed apps should be individually signed to ensure they're never modified, even by a malicious user who can access the encrypted disk. Whole disk encryption guarantees nothing more than your disk is encrypted. On pure single-user systems that are never accessible by other users, that might be fine. The second you allow more that one user, remote or local, to access the disk, you may as well treat the disk as unencrypted. At that point, you need to rely on per-user data encryption and OS and app signature validation to prevent malicious attacks.
- tptacek 16y agoYes! WDE only makes sense for single-user systems (ie, most systems). Yes! WDE does nothing about malicious software. You are correct on both counts.