4 ms·

What is a good strategy for most convenience while securing private data on a laptop that could be stolen? Full disk encryption is good for when the machine is

by neolog 6y ago

What is a good strategy for most convenience while securing private data on a laptop that could be stolen? Full disk encryption is good for when the machine is powered off. What about for the scenario when it gets swiped during the work day when I'm in the bathroom?

Ericson2314 6y ago
Have a shit battery + full disk encryption + linux with broken hibernate support :D
- x86_64Ubuntu 6y ago
  Did Linux ever fix the hibernate stuff? I remember 5 years ago, it was a MUST to disable it, because the system would go to hibernate and never wake up again without a hard restart.
  - neolog 6y ago
    On most of my linux computers it always works. On one of them it works 90% of the time, which sounds high but is really annoying. (Probably an interaction with AMDGPU.)
  - cat199 6y ago
    if you are talking about 'suspend' generally, this really depends on the model (read: drivers), not sure on hibernate itself (since i just sleep)
  - ChuckNorris89 6y ago
    Sleep and hibernate is not really a linux problem, it's more of a OEM closed-source firmware implementation which is only tested to work on Windows problem so the linux devs have to eyeball it and pray that it works which makes it a constant game of whack-a-mole. So until there is an open standard for firmware used by all OEMs it will never be truly fixed. Hell, sleep doesn't even work half the time on my XPS15 with Windows so Dell can't even get that right. That's why the likes of System76 develop their own firmware.
  - gnulinux 6y ago
    It works on my thinkpad, and has always worked on my laptops. Linux firmware is hit&miss.
  - heavyset_go 6y ago
    Hibernate works well on my Macbook with Ubuntu installed.
13415 6y ago
Full disk encryption and a strict policy of always closing the laptop / lock the screen when leaving. In some scenarios USB ports also need to be physically disabled.
- neolog 6y ago
  Locking the screen doesn't enable FDE though, does it?
  - 13415 6y ago
    What attacks are you thinking of? A cold boot attack while you're on the toilet? Or that the laptop is stolen? First and foremost you need to ensure physical security anyway. Otherwise a dedicated attacker can also just install a bug.
    - gpm 6y ago
      Laptop is stolen by a foreign intelligence agency who can do things like "pour liquid nitrogen on the ram and swap it to another computer to recover encryption keys" or whatever (I've been told that's a real attack... but it always seemed like an intelligence agency ought to just make a device to read the ram without pulling it at all... just hijack the wires communicating to the ram or something...)
      - maccard 6y ago
        If that's your threat, the device doesn't leave your sight or possession, ever. I work at a significantly lower threat level than that and we're regularly told that when off site devices don't leave your possession, and on-site, deviecs should be tethered and locked when not in use.
    - neolog 6y ago
      Laptop is stolen.
- cratermoon 6y ago
korijn 6y ago
You could use it without the battery pack plugged in at office situations, so that it would be forced to go powerless in your scenario.
panic_on_oops 6y ago
Cloud native OS?
maerF0x0 6y ago
> What about for the scenario when it gets swiped during the work day when I'm in the bathroom? Can you help me understand what attacks you think can be done with a locked screen, powered on laptop ? (given Full disk encryption is on)
- neolog 6y ago
  Does linux have a screen locker that is reasonably secure?
  - delroth 6y ago
    Against what threat model? The general answer is "yes, most of them, including all the ones being used as defaults in major distros" -- they will not allow a user that isn't in possession of the password to log back into the session. They don't necessarily prevent against other threat models, like "the attacker dumps the laptop's RAM" (which you could technically protect against if you froze all session processes and encrypted their working set with a key held in a secure element).
- tgsovlerkhgsel 6y ago
  DMA attacks - once you get access to a bus that allows direct memory access, you can unlock the machine. Not something a thief that wants the laptop would do, but definitely something a targeted attacker who specifically steals a laptop to get your data would do.
- laurent92 6y ago
  In theory, you can keep the RAM powered and read the decryption key from it. I believe a system like Apple’s Secure Enclave (everything contained in one chip) is better in that regard, although I’m not an expert.
- yabones 6y ago
  Another commenter mentioned DMA, so I'll expand on that. If the device has only USB, network, and display outputs, not a lot. Modern systems are pretty hardened with this config. However, if it has Thunderbolt, ExpressCard, PCMCIA, or even FireWire, it's hosed. This kind of attack has been highly researched by intelligence, for example the 'Sonic Screwdriver' attack revealed in 2017 [1] targeted Macs by tampering with boot parameters, and was installed over thunderbolt. There have also been some PoC exploits for extracting BitLocker encryption keys out of memory using FireWire [2], though I'm not sure those have ever been widespread attack vectors. Basically, the old adage still holds up - physical access is full access. The only thing you can really do is fill up any ports that could be used for DMA sidechannel attacks with epoxy, then hope nobody attacks your TCP stack or USB controller... --- [1] https://arstechnica.com/information-technology/2017/03/new-wikileaks-dump-the-cia-built-thunderbolt-exploit-implants-to-target-macs/ https://arstechnica.com/information-technology/2017/03/new-w... [2] https://support.microsoft.com/en-ca/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d https://support.microsoft.com/en-ca/help/2516445/blocking-th...
tgsovlerkhgsel 6y ago
Even when powered on, full disk encryption still changes the scenario from "reboot from a live CD" to "perform some advanced attack involving special hardware". Unless someone specifically targets you for your data, FDE will keep your data safe from thieves who may sell the laptop (unwiped) or take a look otherwise.
jedimastert 6y ago
Take it with you to the bathroom or turn it off.

by neolog 6y ago

Ericson2314 6y ago

Have a shit battery + full disk encryption + linux with broken hibernate support :D

x86_64Ubuntu 6y ago
Did Linux ever fix the hibernate stuff? I remember 5 years ago, it was a MUST to disable it, because the system would go to hibernate and never wake up again without a hard restart.
- neolog 6y ago
  On most of my linux computers it always works. On one of them it works 90% of the time, which sounds high but is really annoying. (Probably an interaction with AMDGPU.)
- cat199 6y ago
  if you are talking about 'suspend' generally, this really depends on the model (read: drivers), not sure on hibernate itself (since i just sleep)
- ChuckNorris89 6y ago
  Sleep and hibernate is not really a linux problem, it's more of a OEM closed-source firmware implementation which is only tested to work on Windows problem so the linux devs have to eyeball it and pray that it works which makes it a constant game of whack-a-mole. So until there is an open standard for firmware used by all OEMs it will never be truly fixed. Hell, sleep doesn't even work half the time on my XPS15 with Windows so Dell can't even get that right. That's why the likes of System76 develop their own firmware.
- gnulinux 6y ago
  It works on my thinkpad, and has always worked on my laptops. Linux firmware is hit&miss.
- heavyset_go 6y ago
  Hibernate works well on my Macbook with Ubuntu installed.

13415 6y ago

Full disk encryption and a strict policy of always closing the laptop / lock the screen when leaving. In some scenarios USB ports also need to be physically disabled.

neolog 6y ago
Locking the screen doesn't enable FDE though, does it?
- 13415 6y ago
  What attacks are you thinking of? A cold boot attack while you're on the toilet? Or that the laptop is stolen? First and foremost you need to ensure physical security anyway. Otherwise a dedicated attacker can also just install a bug.
  - gpm 6y ago
    Laptop is stolen by a foreign intelligence agency who can do things like "pour liquid nitrogen on the ram and swap it to another computer to recover encryption keys" or whatever (I've been told that's a real attack... but it always seemed like an intelligence agency ought to just make a device to read the ram without pulling it at all... just hijack the wires communicating to the ram or something...)
    - maccard 6y ago
      If that's your threat, the device doesn't leave your sight or possession, ever. I work at a significantly lower threat level than that and we're regularly told that when off site devices don't leave your possession, and on-site, deviecs should be tethered and locked when not in use.
  - neolog 6y ago
    Laptop is stolen.
cratermoon 6y ago

korijn 6y ago

You could use it without the battery pack plugged in at office situations, so that it would be forced to go powerless in your scenario.

panic_on_oops 6y ago

Cloud native OS?

maerF0x0 6y ago

> What about for the scenario when it gets swiped during the work day when I'm in the bathroom? Can you help me understand what attacks you think can be done with a locked screen, powered on laptop ? (given Full disk encryption is on)

neolog 6y ago
Does linux have a screen locker that is reasonably secure?
- delroth 6y ago
  Against what threat model? The general answer is "yes, most of them, including all the ones being used as defaults in major distros" -- they will not allow a user that isn't in possession of the password to log back into the session. They don't necessarily prevent against other threat models, like "the attacker dumps the laptop's RAM" (which you could technically protect against if you froze all session processes and encrypted their working set with a key held in a secure element).
tgsovlerkhgsel 6y ago
DMA attacks - once you get access to a bus that allows direct memory access, you can unlock the machine. Not something a thief that wants the laptop would do, but definitely something a targeted attacker who specifically steals a laptop to get your data would do.
laurent92 6y ago
In theory, you can keep the RAM powered and read the decryption key from it. I believe a system like Apple’s Secure Enclave (everything contained in one chip) is better in that regard, although I’m not an expert.
yabones 6y ago
Another commenter mentioned DMA, so I'll expand on that. If the device has only USB, network, and display outputs, not a lot. Modern systems are pretty hardened with this config. However, if it has Thunderbolt, ExpressCard, PCMCIA, or even FireWire, it's hosed. This kind of attack has been highly researched by intelligence, for example the 'Sonic Screwdriver' attack revealed in 2017 [1] targeted Macs by tampering with boot parameters, and was installed over thunderbolt. There have also been some PoC exploits for extracting BitLocker encryption keys out of memory using FireWire [2], though I'm not sure those have ever been widespread attack vectors. Basically, the old adage still holds up - physical access is full access. The only thing you can really do is fill up any ports that could be used for DMA sidechannel attacks with epoxy, then hope nobody attacks your TCP stack or USB controller... --- [1] https://arstechnica.com/information-technology/2017/03/new-wikileaks-dump-the-cia-built-thunderbolt-exploit-implants-to-target-macs/ https://arstechnica.com/information-technology/2017/03/new-w... [2] https://support.microsoft.com/en-ca/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d https://support.microsoft.com/en-ca/help/2516445/blocking-th...

tgsovlerkhgsel 6y ago

Even when powered on, full disk encryption still changes the scenario from "reboot from a live CD" to "perform some advanced attack involving special hardware". Unless someone specifically targets you for your data, FDE will keep your data safe from thieves who may sell the laptop (unwiped) or take a look otherwise.

jedimastert 6y ago

Take it with you to the bathroom or turn it off.