4 ms·

What's the threat model here? If you install malware that runs as your user, it can see and edit any of your files regardless of whether or not the OS knows de

What's the threat model here? If you install malware that runs as your user, it can see and edit any of your files regardless of whether or not the OS knows decryption keys for them. If you require a password to cold boot the device, then stealing someone's powered-off laptop doesn't get the data. (That's without any special hardware.) So the scenarios that remain are: fingerprint to unlock device to boot (need to do some crypto before the OS, unless you want the fingerprint to just flat-out give up the key to anything sniffing the SPI bus), or somehow resisting data modification without requiring the user to type a password. I feel like Bitlocker tries to do the latter, but I don't know what attacks they are trying to protect against. (It's on by default on new laptops, but you can just sniff the key over SPI when the OS is booting, so what security does it actually provide?)

r00fus 5y ago
> What's the threat model here? I'm guessing they're protecting devices against APTs: state-level actors with lots of funding, competitors intent on discrediting their ecosystem, NSO Group, etc. As a side benefit for users and Apple it makes the entire chain more difficult to introspect/attack.
jandrewrogers 5y ago
I'd guess the threat model is imaging the encrypted storage, which can be done even if the computer is turned off, in the hopes of acquiring the keys later to decrypt the image. If you install malware and the encryption is not visible to the OS, all you get is the data on the machine at the time of implant, since storage image decryption is coupled to the hardware. I also imagine it is much easier to exfiltrate encryption keys stolen from the OS undetected than to rummage around and exfiltrate the contents of a hard drive.
zeckalpha 5y ago
> If you install malware that runs as your user, it can see and edit any of your files regardless of whether or not the OS knows decryption keys for them. The OS now prompts to grant file access permissions to applications.

r00fus 5y ago

> What's the threat model here? I'm guessing they're protecting devices against APTs: state-level actors with lots of funding, competitors intent on discrediting their ecosystem, NSO Group, etc. As a side benefit for users and Apple it makes the entire chain more difficult to introspect/attack.

jandrewrogers 5y ago

I'd guess the threat model is imaging the encrypted storage, which can be done even if the computer is turned off, in the hopes of acquiring the keys later to decrypt the image. If you install malware and the encryption is not visible to the OS, all you get is the data on the machine at the time of implant, since storage image decryption is coupled to the hardware. I also imagine it is much easier to exfiltrate encryption keys stolen from the OS undetected than to rummage around and exfiltrate the contents of a hard drive.

zeckalpha 5y ago

> If you install malware that runs as your user, it can see and edit any of your files regardless of whether or not the OS knows decryption keys for them. The OS now prompts to grant file access permissions to applications.