5 ms·
This idea came about in the days when we kept disks unencrypted. Ripping the disk and editing /etc/shadow or pulling data was trivial. Physical access was the _
by advisedwang 5y ago
This idea came about in the days when we kept disks unencrypted. Ripping the disk and editing /etc/shadow or pulling data was trivial. Physical access was the _only_ requirement to do this.
Disk encryption then became practical, and defeating it requires a running, vulnerable machine (for cold boot) or tampering+user interaction (for evil maid).
Secure Boot makes those even harder - you will have to compromise the TPM itself.
All of this is to say it is still possible to attack a machine with physical access, but you now have to enage in further security breaks. It's not really "game over" anymore as there are further defensive to defeat.
- mlang23 5y agoDisk encryption is only really practical when you never need to reboot. Found that out the hard way, like most others did at some point :-)
- generalizations 5y agoYup. Can't remote manage a system with encrypted boot disks.
- advisedwang 5y agoSure you can, e.g. https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock https://docs.microsoft.com/en-us/windows/security/informatio... https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening https://access.redhat.com/documentation/en-us/red_hat_enterp... https://wiki.archlinux.org/title/Dm-crypt/Specialties#Remote_unlocking_of_the_root_(or_other)_partition https://wiki.archlinux.org/title/Dm-crypt/Specialties#Remote... etc
- generalizations 5y agoDoesn't look like it. Those are some complex solutions, and I might have missed something, but do note that I said 'boot disk'. From what I can tell, those solutions still have to leave /boot unencrypted, which was my point.