4 ms·

Most users don’t want a separate password for disk encryption though, so I’m not sure it’s a huge problem?

by orf 6y ago

La1n 6y ago
Most users probably also didn't care about the first-party firewall exemptions. They could have asked people if they wanted a separate password for disk encryption (e.g. a small checkbox).
- fpoling 6y ago
  It is highly non-trivial to extract private key from Apple encryption chips, last time I heared the price is at least 100K USD, and probably much higher now. So unless one values own secrets that high, a short password could be OK.
webmobdev 6y ago
It's about choice and control over your data - an educated user knows that with hardware encryption, it is very difficult to retrieve data if the hardware fails. There's also the trust factor where you would prefer to have the keys, rather than trust some device. (E.g. Some Western Digital drives have problems with their hardware encryption and made the data on it irretrievable for many - https://github.com/andlabs/reallymine/issues/53 https://github.com/andlabs/reallymine/issues/53 . More here - https://carltonbale.com/western-digital-mybook-drive-lock-encryption-failure-and-recovery/ https://carltonbale.com/western-digital-mybook-drive-lock-en...). What is being questioned and criticized is the removal of this choice. Especially when a product claims a commitment to privacy.
ddtaylor 6y ago
IMO that's a big problem. They are completely different risk categories. My FDE password is absurdly long and complicated, since I never want someone who gains physical access to get all my data, but my Linux user account password isn't as long since it's main purpose is to stop someone from getting passed my lock screen if I was to leave my system unattended.
- mvanbaak 6y ago
  Both are 'physical access'. If one does not power down your system, your FDE is unlocked. So they only need your Linux user account password to get access to the data on your disk. FDE only protects your data when it's locked. Normally this is when your system is shut down.
  - KraftKacke 6y ago
    Separation is still recommended. Storage encryption can be attacked differently than a running system.
  - GekkePrutser 6y ago
    True but it's a slightly different category as he wouldn't leave his system on but locked in a potential high risk scenario.
    - jiofih 6y ago
      You mean he would shut down a MacBook every day after us? That’s blasphemy.
      - fpoling 6y ago
        At least with 10.15 and earlier you can configure MacOS to hybernate after certain amount of time when it will ask for FDE password on wake up and load everything from the disk.
  - ddtaylor 6y ago
    The main difference is in the attack surface. Attacking the FDE can happen offline with infinite attempts with a large-scale operation dedicating lots of compute power. Breaking my user password has to happen on site at that exact moment and my lock screen can detect N number of failed logins and shutdown.

Most users don’t want a separate password for disk encryption though, so I’m not sure it’s a huge problem?

by orf 6y ago

Most users don’t want a separate password for disk encryption though, so I’m not sure it’s a huge problem?

La1n 6y ago

Most users probably also didn't care about the first-party firewall exemptions. They could have asked people if they wanted a separate password for disk encryption (e.g. a small checkbox).

fpoling 6y ago
It is highly non-trivial to extract private key from Apple encryption chips, last time I heared the price is at least 100K USD, and probably much higher now. So unless one values own secrets that high, a short password could be OK.

webmobdev 6y ago

It's about choice and control over your data - an educated user knows that with hardware encryption, it is very difficult to retrieve data if the hardware fails. There's also the trust factor where you would prefer to have the keys, rather than trust some device. (E.g. Some Western Digital drives have problems with their hardware encryption and made the data on it irretrievable for many - https://github.com/andlabs/reallymine/issues/53 https://github.com/andlabs/reallymine/issues/53 . More here - https://carltonbale.com/western-digital-mybook-drive-lock-encryption-failure-and-recovery/ https://carltonbale.com/western-digital-mybook-drive-lock-en...). What is being questioned and criticized is the removal of this choice. Especially when a product claims a commitment to privacy.

ddtaylor 6y ago

IMO that's a big problem. They are completely different risk categories. My FDE password is absurdly long and complicated, since I never want someone who gains physical access to get all my data, but my Linux user account password isn't as long since it's main purpose is to stop someone from getting passed my lock screen if I was to leave my system unattended.

mvanbaak 6y ago
Both are 'physical access'. If one does not power down your system, your FDE is unlocked. So they only need your Linux user account password to get access to the data on your disk. FDE only protects your data when it's locked. Normally this is when your system is shut down.
- KraftKacke 6y ago
  Separation is still recommended. Storage encryption can be attacked differently than a running system.
- GekkePrutser 6y ago
  True but it's a slightly different category as he wouldn't leave his system on but locked in a potential high risk scenario.
  - jiofih 6y ago
    You mean he would shut down a MacBook every day after us? That’s blasphemy.
    - fpoling 6y ago
      At least with 10.15 and earlier you can configure MacOS to hybernate after certain amount of time when it will ask for FDE password on wake up and load everything from the disk.
- ddtaylor 6y ago
  The main difference is in the attack surface. Attacking the FDE can happen offline with infinite attempts with a large-scale operation dedicating lots of compute power. Breaking my user password has to happen on site at that exact moment and my lock screen can detect N number of failed logins and shutdown.