4 ms·

reading all these comments like remove the hdd, it sounds like a good future solution may be to get my self an external drive, (or even a cloud drive), and some

reading all these comments like remove the hdd, it sounds like a good future solution may be to get my self an external drive, (or even a cloud drive), and somehow set everything up so all my User data exists on that "partition" or drive or whatever. i wouldn't know where to begin to figure out how to do this on mac, but I'm sure it's possible somehow. then the main device is essentially a dumb terminal with the OS on it, and all the proprietary data / keys / config etc is on an encrypted external drive

7steps2much 4y ago
At that point we would be almost going full circle back to terminals and mainframes. Then someone will figure out most users don't need much processing power (only emails, word, etc.) and back to centralized computing we go!
dangus 4y ago
This isn't really necessary. "Remove your HDD" is outdated advice. Any modern SSD can/will leverage cryptographic erasure to render any data unreadable. [1] Since OP is talking about Apple systems, Mac computers with the T2 chip or newer (which includes all Apple Silicon Macs), full disk encryption is automatic even with FileVault turned off. [2] Basically, when you erase a drive on a modern Mac, the encryption key is changed, so prior data is not recoverable in the same way that an unencrypted HDD will leave magnetic traces of readable previous data. [1] https://www.dell.com/support/kbdoc/en-ca/000150908/data-removal-processes-for-a-solid-state-hard-drive https://www.dell.com/support/kbdoc/en-ca/000150908/data-remo... [2] https://support.apple.com/guide/mac-help/encrypt-mac-data-with-filevault-mh11785/mac https://support.apple.com/guide/mac-help/encrypt-mac-data-wi...
- raxxorraxor 4y ago
  If you encrypt your device like this, it is outdated in a way that you also need to make a copy of your TPM recovery key in case of a hardware failure or replacement. Your data will be lost otherwise. Same goes for MS Bitlocker. Support cannot migrate your data to a new device. If support can access the recovery key to do that, it will be able to access your data as well. This can provide security but comes with new dangers. I would still recommend removing the HDD. If you encrypt this way, lose the recovery password and your device has a critical failure, your data is lost.
  - dangus 4y ago
    1. If you’re depending on a single local drive to safely house your data you don’t have to lose an encryption key to lose your data. 2. Apple and Microsoft both provide user-friendly cloud-based recovery options for FileVault and Bitlocker that leverage iCloud and Microsoft accounts, respectively. 2.5. “But what if you don’t want to trust/use cloud services?” See #1. You can’t depend on your single drive anyway. If you can be responsible for safeguarding backups you can be responsible for safeguarding encryption/recovery keys. 3. Organizations and probably most individuals rely on professionally managed storage solutions to house important data. Organizations don’t tell their employees to store important things on their local laptop, it’s Box/Dropbox/Drive/etc. 4. Considering how most computer users are on laptops, removing the drive is not a practical suggestion, even if the laptop has an easily removable drive. That type of knowledge and ability is beyond the vast majority of computer users. That’s why, to me, the best way to operate is on a full disk encrypted device that’s treated as disposable. At any time it could be stolen, fall on the ground, stop working due to a power surge, get wet, etc. If your workflow involves device replacement causing lost data you’re already in a vulnerable position.

7steps2much 4y ago

At that point we would be almost going full circle back to terminals and mainframes. Then someone will figure out most users don't need much processing power (only emails, word, etc.) and back to centralized computing we go!

dangus 4y ago

This isn't really necessary. "Remove your HDD" is outdated advice. Any modern SSD can/will leverage cryptographic erasure to render any data unreadable. [1] Since OP is talking about Apple systems, Mac computers with the T2 chip or newer (which includes all Apple Silicon Macs), full disk encryption is automatic even with FileVault turned off. [2] Basically, when you erase a drive on a modern Mac, the encryption key is changed, so prior data is not recoverable in the same way that an unencrypted HDD will leave magnetic traces of readable previous data. [1] https://www.dell.com/support/kbdoc/en-ca/000150908/data-removal-processes-for-a-solid-state-hard-drive https://www.dell.com/support/kbdoc/en-ca/000150908/data-remo... [2] https://support.apple.com/guide/mac-help/encrypt-mac-data-with-filevault-mh11785/mac https://support.apple.com/guide/mac-help/encrypt-mac-data-wi...

raxxorraxor 4y ago
If you encrypt your device like this, it is outdated in a way that you also need to make a copy of your TPM recovery key in case of a hardware failure or replacement. Your data will be lost otherwise. Same goes for MS Bitlocker. Support cannot migrate your data to a new device. If support can access the recovery key to do that, it will be able to access your data as well. This can provide security but comes with new dangers. I would still recommend removing the HDD. If you encrypt this way, lose the recovery password and your device has a critical failure, your data is lost.
- dangus 4y ago
  1. If you’re depending on a single local drive to safely house your data you don’t have to lose an encryption key to lose your data. 2. Apple and Microsoft both provide user-friendly cloud-based recovery options for FileVault and Bitlocker that leverage iCloud and Microsoft accounts, respectively. 2.5. “But what if you don’t want to trust/use cloud services?” See #1. You can’t depend on your single drive anyway. If you can be responsible for safeguarding backups you can be responsible for safeguarding encryption/recovery keys. 3. Organizations and probably most individuals rely on professionally managed storage solutions to house important data. Organizations don’t tell their employees to store important things on their local laptop, it’s Box/Dropbox/Drive/etc. 4. Considering how most computer users are on laptops, removing the drive is not a practical suggestion, even if the laptop has an easily removable drive. That type of knowledge and ability is beyond the vast majority of computer users. That’s why, to me, the best way to operate is on a full disk encrypted device that’s treated as disposable. At any time it could be stolen, fall on the ground, stop working due to a power surge, get wet, etc. If your workflow involves device replacement causing lost data you’re already in a vulnerable position.