4 ms·

>FileVault for professional use Probably not the best choice :) you never want to use proprietary software if security is a concern

duhi88 6y ago
What is a non-proprietary solution for full-disk encryption?
- williamscales 6y ago
  luks
- centimeter 6y ago
  luks or zfs.
  - aborsy 6y ago
    Or Veracrypt.
  - blacklion 6y ago
    I want not note, that ZFS is not full disk encryption. ZFS native encryption was designed to allow secure backups via "zfs send | zfs receive" mechanism, so it encrypt only data blocks, and not metadata. LUKS and GEIL are full-disk encryption systems, and if you need FDE, you must use them under ZFS, not ZFS native encryption.
    - nix23 6y ago
      >LUKS and GEIL GELI ;) ZFS native encryption on Root is ~IS full disk encryption minus the boot-loader, i would say that's "full" interesting data encryption.
    - fomine3 6y ago
      Technically true but what is the situation that become problem?
Nextgrid 6y ago
I disagree. There are times when either no open-source solution is available, or the open-source solution is unmaintained, or not popular (thus not under much scrutiny) and you don't have the resources (time and skill) to audit it yourself. As long as the incentives of the developer of the security scheme and the end-user are aligned (so no backdoors), I would trust a widespread, proprietary solution which appears to stand up to significant attacks (the solution being widespread means there are lots of efforts underway to crack it) more than an open-source implementation that nobody uses.
acdha 6y ago
Go count how many CVEs have come out for OpenSSL, GNUTLS, LUKS, etc. and ask whether you’re offering helpful advice. Security is expensive and there are no silver bullets: at the end of the day you need a lot of skilled work and being open source doesn’t magically get that for free.
- ethbr0 6y ago
  That's apples and oranges. Counting published vulnerabilities in open source systems vs closed source systems says nothing about the relative true ratio of vulnerabilities.
  - acdha 6y ago
    Are you seriously claiming that anything short of omniscience is useless? In most fields people deal with incomplete data on a daily basis and this is no different. CVEs don’t tell you everything but they definitely give you more than zero, and more to the point, the many vulnerabilities in open source projects suggests that the very broad but completely unsupported claim I was responding to is based on ideology rather than reasoned analysis.
    - ethbr0 6y ago
      > the many vulnerabilities in open source projects suggests that the very broad but completely unsupported claim I was responding to is based on ideology rather than reasoned analysis Does it? In order to claim that, one would have to have some idea of (a) the ratio of disclosed vulnerabilities to true vulnerabilities discovered in both open source, accessible code vs closed source, hardware locked code, and (b) the relative ratios of disclosed vulnerabilities. Do you have any idea what either ratio might be? 1:1? 4:1? 1:4? 100:1?
      - zaarn 6y ago
        Unless you know the true ratio, you can't claim that open source projects are better either. Or that one has advantages over the other when it comes to cryptographic security. I'm not GP and I'm not arguing for either side, just pointing i tout.
marcinzm 6y ago
As it stands now, from my understanding, the failure case of the proprietary solution is the same level of security as the best case of the open source solution. So I don't see your point. Open source isn't any better. Open source full disk encryption can be password cracked without limitations just like a hacked T2 chip. A sleeping open source full disk encryption machine can be accessed with enough skill to pull things out of frozen ram, etc.

duhi88 6y ago

What is a non-proprietary solution for full-disk encryption?

williamscales 6y ago
luks
centimeter 6y ago
luks or zfs.
- aborsy 6y ago
  Or Veracrypt.
- blacklion 6y ago
  I want not note, that ZFS is not full disk encryption. ZFS native encryption was designed to allow secure backups via "zfs send | zfs receive" mechanism, so it encrypt only data blocks, and not metadata. LUKS and GEIL are full-disk encryption systems, and if you need FDE, you must use them under ZFS, not ZFS native encryption.
  - nix23 6y ago
    >LUKS and GEIL GELI ;) ZFS native encryption on Root is ~IS full disk encryption minus the boot-loader, i would say that's "full" interesting data encryption.
  - fomine3 6y ago
    Technically true but what is the situation that become problem?

Nextgrid 6y ago

I disagree. There are times when either no open-source solution is available, or the open-source solution is unmaintained, or not popular (thus not under much scrutiny) and you don't have the resources (time and skill) to audit it yourself. As long as the incentives of the developer of the security scheme and the end-user are aligned (so no backdoors), I would trust a widespread, proprietary solution which appears to stand up to significant attacks (the solution being widespread means there are lots of efforts underway to crack it) more than an open-source implementation that nobody uses.

acdha 6y ago

Go count how many CVEs have come out for OpenSSL, GNUTLS, LUKS, etc. and ask whether you’re offering helpful advice. Security is expensive and there are no silver bullets: at the end of the day you need a lot of skilled work and being open source doesn’t magically get that for free.

ethbr0 6y ago
That's apples and oranges. Counting published vulnerabilities in open source systems vs closed source systems says nothing about the relative true ratio of vulnerabilities.
- acdha 6y ago
  Are you seriously claiming that anything short of omniscience is useless? In most fields people deal with incomplete data on a daily basis and this is no different. CVEs don’t tell you everything but they definitely give you more than zero, and more to the point, the many vulnerabilities in open source projects suggests that the very broad but completely unsupported claim I was responding to is based on ideology rather than reasoned analysis.
  - ethbr0 6y ago
    > the many vulnerabilities in open source projects suggests that the very broad but completely unsupported claim I was responding to is based on ideology rather than reasoned analysis Does it? In order to claim that, one would have to have some idea of (a) the ratio of disclosed vulnerabilities to true vulnerabilities discovered in both open source, accessible code vs closed source, hardware locked code, and (b) the relative ratios of disclosed vulnerabilities. Do you have any idea what either ratio might be? 1:1? 4:1? 1:4? 100:1?
    - zaarn 6y ago
      Unless you know the true ratio, you can't claim that open source projects are better either. Or that one has advantages over the other when it comes to cryptographic security. I'm not GP and I'm not arguing for either side, just pointing i tout.

marcinzm 6y ago

As it stands now, from my understanding, the failure case of the proprietary solution is the same level of security as the best case of the open source solution. So I don't see your point. Open source isn't any better. Open source full disk encryption can be password cracked without limitations just like a hacked T2 chip. A sleeping open source full disk encryption machine can be accessed with enough skill to pull things out of frozen ram, etc.