3 ms·

If you encrypt your device like this, it is outdated in a way that you also need to make a copy of your TPM recovery key in case of a hardware failure or replac

If you encrypt your device like this, it is outdated in a way that you also need to make a copy of your TPM recovery key in case of a hardware failure or replacement. Your data will be lost otherwise. Same goes for MS Bitlocker. Support cannot migrate your data to a new device. If support can access the recovery key to do that, it will be able to access your data as well. This can provide security but comes with new dangers. I would still recommend removing the HDD. If you encrypt this way, lose the recovery password and your device has a critical failure, your data is lost.

dangus 4y ago
1. If you’re depending on a single local drive to safely house your data you don’t have to lose an encryption key to lose your data. 2. Apple and Microsoft both provide user-friendly cloud-based recovery options for FileVault and Bitlocker that leverage iCloud and Microsoft accounts, respectively. 2.5. “But what if you don’t want to trust/use cloud services?” See #1. You can’t depend on your single drive anyway. If you can be responsible for safeguarding backups you can be responsible for safeguarding encryption/recovery keys. 3. Organizations and probably most individuals rely on professionally managed storage solutions to house important data. Organizations don’t tell their employees to store important things on their local laptop, it’s Box/Dropbox/Drive/etc. 4. Considering how most computer users are on laptops, removing the drive is not a practical suggestion, even if the laptop has an easily removable drive. That type of knowledge and ability is beyond the vast majority of computer users. That’s why, to me, the best way to operate is on a full disk encrypted device that’s treated as disposable. At any time it could be stolen, fall on the ground, stop working due to a power surge, get wet, etc. If your workflow involves device replacement causing lost data you’re already in a vulnerable position.

dangus 4y ago

1. If you’re depending on a single local drive to safely house your data you don’t have to lose an encryption key to lose your data. 2. Apple and Microsoft both provide user-friendly cloud-based recovery options for FileVault and Bitlocker that leverage iCloud and Microsoft accounts, respectively. 2.5. “But what if you don’t want to trust/use cloud services?” See #1. You can’t depend on your single drive anyway. If you can be responsible for safeguarding backups you can be responsible for safeguarding encryption/recovery keys. 3. Organizations and probably most individuals rely on professionally managed storage solutions to house important data. Organizations don’t tell their employees to store important things on their local laptop, it’s Box/Dropbox/Drive/etc. 4. Considering how most computer users are on laptops, removing the drive is not a practical suggestion, even if the laptop has an easily removable drive. That type of knowledge and ability is beyond the vast majority of computer users. That’s why, to me, the best way to operate is on a full disk encrypted device that’s treated as disposable. At any time it could be stolen, fall on the ground, stop working due to a power surge, get wet, etc. If your workflow involves device replacement causing lost data you’re already in a vulnerable position.