8 ms·

The answer to every single category is "yes" to whether its worth encrypting. The question isn't whether or not data is worth encrypting, it's whether it's wor

The answer to every single category is "yes" to whether its worth encrypting. The question isn't whether or not data is worth encrypting, it's whether it's worth encrypting in ways which have worse user ergonomics as a trade-off to potentially better security. There is literally no reason in 2023 why normal users should not have full-disk encryption enabled on every single device and be using a password manager, both tied to on-device secure biometrics (think TouchID).

c0balt 4y ago
There is a reason to avoid full disk encryption for average, "normal", users: What happens when the user loses/ forgets their password? Most (in my experience) users don't have backups for their devices. Some data, like pictures, are maybe 'backed up" by the cloud provider of their choice via their phones. Further, some users may store important files in multiple places but most don't. And losing data is a real pita.
- andix 4y ago
  Windows stores the keys inside the cloud by default. This is not optimal, but reduces the lost key scenario a lot. But it also protects the data on a lost laptop, as long as the attacker doesn’t get access to your Microsoft account.
  - hsbauauvhabzb 4y ago
    First I’m hearing of this, but I’m unsurprised given how it’s basically impossible to install windows without creating a Microsoft account. I really respect Microsoft core engineers, but wish they’d revolt and quit over the team focused on driving profits via toxic behaviours like online account requirements, and embedding one drive into everything. I even get spam emails *from* Microsoft on newly created corporate o365 accounts, like what the actual fuck is wrong with them to think that’s okay?
    - andix 4y ago
      I think their strategy makes a lot of sense. If you want to live off the grid, you can use Linux. Since everything is now a web app (also Microsoft products), that’s easier then ever.
      - hsbauauvhabzb 4y ago
        Spoken like a true Microsoft marketing department employee two cups deep into the koolaid arrogant enough to think the only two roads are ‘my way or the highway’
        tracker1 4y ago
        For your average home user, it's probably the better option, even if I as an individual don't like it at all. Not every person's specific needs/wants are the same. I've had encrypted Linux volumes become inaccessible because of a changed password when I wasn't able to come back to that system for a few days after and frankly forgot the specific combination of words used. Luckily I did have backups... but it could have been worse. A mom losing all the baby footage of their child because of lost/broken/damaged encryption is not a pleasant thing to explain to someone.
        hsbauauvhabzb 4y ago
        I’m unsure how that relates to the above comments about Microsoft pushing products and services via dark patterns. Are you employed by Microsoft, or have any professional association with the company?
        tracker1 4y ago
        No... I'm using Linux on my desktop, and a Macbook Air M1 for my personal laptop. But funny that you would assume so.
        hsbauauvhabzb 4y ago
- Shared404 4y ago
  YepYepYepYepYep. The number of times I've had to bail someone out because they wrecked their computer and I had to pull their HDD/SSD is a _lot_.
  - andix 4y ago
    I know, but this scenario may soon be in the past. With smartphones and also ARM macs there is no feasible way to directly access the storage. And at least with apple devices encryption is the standard. It’s not even possible to run them unencrypted anymore.
    - crazygringo 4y ago
      But the whole point of the article is the cloud analogy. If they didn't encrypt their cloud content but lost their password, it's recoverable, the same as from an unencrypted hard drive. If they encrypt it, they're SOL.
  - _Algernon_ 4y ago
    Their issue wasn't encryption, it was that they didn't have backups (of the data and/or encryption key). Data without backups is already lost, you just don't know it yet.
    - Shared404 4y ago
      That doesn't help me when J. Random user comes for help. If people are doing things right, everything should be encrypted. "Average users" don't do things right. I hate saying it, but experience has played this out for me time and time again.
      - _Algernon_ 4y ago
        Point is that even without encryption they had a ticking time bomb on their hands. They would have shown up with the exact same problem, just later. Instead of discouraging encryption, use it as a way to encourage backups in the future.
- nine_k 4y ago
  In other words, if your data is worth backing up, it's worth encrypting. Also, if you'd rather lose it than let it fall into wrong hands, it's worth encrypting. Else it's just a jot pad containing nothing sensitive, and can as well be plaintext.
  - throwaway894345 4y ago
    Eh, for me it’s more likely that I would mismanage the key to my photo backup than it is someone would steal my backup media or otherwise attack it. I would certainly much rather have unauthorized access to my photos than for me to lose access to them. That doesn’t mean I’m going to take zero precautions toward preventing unauthorized access, but I’m going to prefer unauthorized access to data loss.
  - zamadatix 4y ago
    Not true e.g. I have a large amount of bespoke ISOs/installers/etc I don't want to lose and have to find again but I don't really give a damn if someone got access to them and was able to e.g. install Sim City 4 without my permission. This is even true with a good amount of my unique data. I'm not worried if someone has access to my video game saves or anything in my dotfiles that isn't explicitly crypto (e.g. an SSH key) or so on but it'd be a real PITA to lose those. I backup a good deal of things but I encrypt only a small subset.
- babypuncher 4y ago
  Full disk encryption has been the default on iOS devices for nearly a decade and it hasn't really been a problem. People don't generally forget passwords they use several times a day.
  - shortstuffsushi 4y ago
    A counter, or perhaps extension example to this: say I had a phone ten years ago that had full disk encryption. Since then, I've migrated to a new phone, but kept the old one around to have access to the pictures. Ten years on, I finally have the desire to go and look and... now I realize I have a paperweight because I can't remember the password.
    - giantrobot 4y ago
      Is this an actual issue? Who keeps an old phone around as a data vault like that? Both iOS and Android have had off-device photo syncing for at least a decade. The intersection of people that 1) leave an old phone in a drawer as a photo vault and 2) never used any sort of photo syncing is not nearly large enough that FDE is in any way problematic for most people.
      - deleted 4y ago
        [deleted]
      - shortstuffsushi 4y ago
        > Is this an actual issue Yes? I mean, it exists and I know of at least a half dozen people in immediate proximity to me that have kept old devices around in case they want their photos later. Some have them backed up elsewhere as well, sure. Contrary to your assertion, I'd guess the opposite - I suspect there's a large number of people, especially non-technical people, with phones in drawers with information they'd like to have available for "some day." Obviously speculation based on my own experience. WRT the off device syncing being default, that is fine up to the Xgb that the provider offers free, anything beyond that is not synced without a monthly subscription, and the same people I know that are keeping phones around are also not paying for that.
- tristor 4y ago
  > What happens when the user loses/ forgets their password? When your password is the same password you use to login to your device and/or your fingerprint or faceprint, it's a bit hard to "lose". That's exactly what I mean by user ergonomics trade-offs. Technically, it might be better to have a different password for important things that are encrypted vs your login password, but in practice what matters is that the average user's device is basically a brick to a thief both from the perspective of using said device on the black market or stealing the user's data. Maybe this is one of those weird splits that now exists in the world between people who operate in sane UX ecosystems like Apple-land vs those who continue to accept unending abuse from Microsoft and Google in the Windows/Android cesspit. I just don't see the issue you're describing occurring for most average users in 2023, at least in the West.
- spindle 4y ago
  > average, "normal", users Right! Not to mention the users with memory problems. That is a lot of people. Dementia is common, just for a start.
ok123456 4y ago
>There is literally no reason in 2023 why normal users should not have full-disk encryption enabled on every single device and be using a password manager, both tied to on-device secure biometrics (think TouchID). Data recovery. Key loss. Being able to put the drive into another computer and get data off is more common to the average user than someone physically compromising their computer and trying to read their secrets.
- ajsnigrutin 4y ago
  This is not completely true... there were many cases where repair technicians went looking through peoples personal data when the computer (or tablet, phone,...) was brought in for repair. With an inability to physically remove the hard drive in some computers (ahem, the fruit ones), encryption is the only way to keep your data safe when you have to give your device to someone else (even if for repair).
  - ok123456 4y ago
    So, if you really value security, buy a computer that you can take the hard drive out of.
  - _Algernon_ 4y ago
    Not sure why this is downvoted. Here is a recent example showcasing how common this is: https://arstechnica.com/information-technology/2022/11/half-of-computer-repairs-result-in-snooping-of-sensitive-data-study-finds/ https://arstechnica.com/information-technology/2022/11/half-...
jcelerier 4y ago
I lost my encryption key for matrix recently and lost a few conversations because of it (despite saving them both as a file and as an email). Just this makes me want to never ever touch anything fully encrypted again with a ten kilometre pole.
gidorah 4y ago
I am technically competant enough to have full disk encryption and a whole bunch of other things. If I were to die, is my wife though? No. She is not. So if I want her to access stuff if I die, then that means me leaving documentation for her. Which doesn't really result in better security - how can I encrypt stuff I've had to literally print out. The ergonomics is a HUGE factor.
eternityforest 4y ago
At a certain point encryption becomes useless (Full disk encryption with a short password, or one written on a sticky note near the device, etc). I'm not familiar with how Mac does things, but some of those solutions prioritize security over reliability and store the keys in a crypto processor that can't be backed up, leaving no way to recover the drive if they break.

c0balt 4y ago

There is a reason to avoid full disk encryption for average, "normal", users: What happens when the user loses/ forgets their password? Most (in my experience) users don't have backups for their devices. Some data, like pictures, are maybe 'backed up" by the cloud provider of their choice via their phones. Further, some users may store important files in multiple places but most don't. And losing data is a real pita.

andix 4y ago
Windows stores the keys inside the cloud by default. This is not optimal, but reduces the lost key scenario a lot. But it also protects the data on a lost laptop, as long as the attacker doesn’t get access to your Microsoft account.
- hsbauauvhabzb 4y ago
  First I’m hearing of this, but I’m unsurprised given how it’s basically impossible to install windows without creating a Microsoft account. I really respect Microsoft core engineers, but wish they’d revolt and quit over the team focused on driving profits via toxic behaviours like online account requirements, and embedding one drive into everything. I even get spam emails *from* Microsoft on newly created corporate o365 accounts, like what the actual fuck is wrong with them to think that’s okay?
  - andix 4y ago
    I think their strategy makes a lot of sense. If you want to live off the grid, you can use Linux. Since everything is now a web app (also Microsoft products), that’s easier then ever.
    - hsbauauvhabzb 4y ago
      Spoken like a true Microsoft marketing department employee two cups deep into the koolaid arrogant enough to think the only two roads are ‘my way or the highway’
      - tracker1 4y ago
        For your average home user, it's probably the better option, even if I as an individual don't like it at all. Not every person's specific needs/wants are the same. I've had encrypted Linux volumes become inaccessible because of a changed password when I wasn't able to come back to that system for a few days after and frankly forgot the specific combination of words used. Luckily I did have backups... but it could have been worse. A mom losing all the baby footage of their child because of lost/broken/damaged encryption is not a pleasant thing to explain to someone.
        hsbauauvhabzb 4y ago
        I’m unsure how that relates to the above comments about Microsoft pushing products and services via dark patterns. Are you employed by Microsoft, or have any professional association with the company?
        tracker1 4y ago
        No... I'm using Linux on my desktop, and a Macbook Air M1 for my personal laptop. But funny that you would assume so.
        hsbauauvhabzb 4y ago
Shared404 4y ago
YepYepYepYepYep. The number of times I've had to bail someone out because they wrecked their computer and I had to pull their HDD/SSD is a _lot_.
- andix 4y ago
  I know, but this scenario may soon be in the past. With smartphones and also ARM macs there is no feasible way to directly access the storage. And at least with apple devices encryption is the standard. It’s not even possible to run them unencrypted anymore.
  - crazygringo 4y ago
    But the whole point of the article is the cloud analogy. If they didn't encrypt their cloud content but lost their password, it's recoverable, the same as from an unencrypted hard drive. If they encrypt it, they're SOL.
- _Algernon_ 4y ago
  Their issue wasn't encryption, it was that they didn't have backups (of the data and/or encryption key). Data without backups is already lost, you just don't know it yet.
  - Shared404 4y ago
    That doesn't help me when J. Random user comes for help. If people are doing things right, everything should be encrypted. "Average users" don't do things right. I hate saying it, but experience has played this out for me time and time again.
    - _Algernon_ 4y ago
      Point is that even without encryption they had a ticking time bomb on their hands. They would have shown up with the exact same problem, just later. Instead of discouraging encryption, use it as a way to encourage backups in the future.
nine_k 4y ago
In other words, if your data is worth backing up, it's worth encrypting. Also, if you'd rather lose it than let it fall into wrong hands, it's worth encrypting. Else it's just a jot pad containing nothing sensitive, and can as well be plaintext.
- throwaway894345 4y ago
  Eh, for me it’s more likely that I would mismanage the key to my photo backup than it is someone would steal my backup media or otherwise attack it. I would certainly much rather have unauthorized access to my photos than for me to lose access to them. That doesn’t mean I’m going to take zero precautions toward preventing unauthorized access, but I’m going to prefer unauthorized access to data loss.
- zamadatix 4y ago
  Not true e.g. I have a large amount of bespoke ISOs/installers/etc I don't want to lose and have to find again but I don't really give a damn if someone got access to them and was able to e.g. install Sim City 4 without my permission. This is even true with a good amount of my unique data. I'm not worried if someone has access to my video game saves or anything in my dotfiles that isn't explicitly crypto (e.g. an SSH key) or so on but it'd be a real PITA to lose those. I backup a good deal of things but I encrypt only a small subset.
babypuncher 4y ago
Full disk encryption has been the default on iOS devices for nearly a decade and it hasn't really been a problem. People don't generally forget passwords they use several times a day.
- shortstuffsushi 4y ago
  A counter, or perhaps extension example to this: say I had a phone ten years ago that had full disk encryption. Since then, I've migrated to a new phone, but kept the old one around to have access to the pictures. Ten years on, I finally have the desire to go and look and... now I realize I have a paperweight because I can't remember the password.
  - giantrobot 4y ago
    Is this an actual issue? Who keeps an old phone around as a data vault like that? Both iOS and Android have had off-device photo syncing for at least a decade. The intersection of people that 1) leave an old phone in a drawer as a photo vault and 2) never used any sort of photo syncing is not nearly large enough that FDE is in any way problematic for most people.
    - deleted 4y ago
      [deleted]
    - shortstuffsushi 4y ago
      > Is this an actual issue Yes? I mean, it exists and I know of at least a half dozen people in immediate proximity to me that have kept old devices around in case they want their photos later. Some have them backed up elsewhere as well, sure. Contrary to your assertion, I'd guess the opposite - I suspect there's a large number of people, especially non-technical people, with phones in drawers with information they'd like to have available for "some day." Obviously speculation based on my own experience. WRT the off device syncing being default, that is fine up to the Xgb that the provider offers free, anything beyond that is not synced without a monthly subscription, and the same people I know that are keeping phones around are also not paying for that.
tristor 4y ago
> What happens when the user loses/ forgets their password? When your password is the same password you use to login to your device and/or your fingerprint or faceprint, it's a bit hard to "lose". That's exactly what I mean by user ergonomics trade-offs. Technically, it might be better to have a different password for important things that are encrypted vs your login password, but in practice what matters is that the average user's device is basically a brick to a thief both from the perspective of using said device on the black market or stealing the user's data. Maybe this is one of those weird splits that now exists in the world between people who operate in sane UX ecosystems like Apple-land vs those who continue to accept unending abuse from Microsoft and Google in the Windows/Android cesspit. I just don't see the issue you're describing occurring for most average users in 2023, at least in the West.
spindle 4y ago
> average, "normal", users Right! Not to mention the users with memory problems. That is a lot of people. Dementia is common, just for a start.

ok123456 4y ago

>There is literally no reason in 2023 why normal users should not have full-disk encryption enabled on every single device and be using a password manager, both tied to on-device secure biometrics (think TouchID). Data recovery. Key loss. Being able to put the drive into another computer and get data off is more common to the average user than someone physically compromising their computer and trying to read their secrets.

ajsnigrutin 4y ago
This is not completely true... there were many cases where repair technicians went looking through peoples personal data when the computer (or tablet, phone,...) was brought in for repair. With an inability to physically remove the hard drive in some computers (ahem, the fruit ones), encryption is the only way to keep your data safe when you have to give your device to someone else (even if for repair).
- ok123456 4y ago
  So, if you really value security, buy a computer that you can take the hard drive out of.
- _Algernon_ 4y ago
  Not sure why this is downvoted. Here is a recent example showcasing how common this is: https://arstechnica.com/information-technology/2022/11/half-of-computer-repairs-result-in-snooping-of-sensitive-data-study-finds/ https://arstechnica.com/information-technology/2022/11/half-...

jcelerier 4y ago

I lost my encryption key for matrix recently and lost a few conversations because of it (despite saving them both as a file and as an email). Just this makes me want to never ever touch anything fully encrypted again with a ten kilometre pole.

gidorah 4y ago

I am technically competant enough to have full disk encryption and a whole bunch of other things. If I were to die, is my wife though? No. She is not. So if I want her to access stuff if I die, then that means me leaving documentation for her. Which doesn't really result in better security - how can I encrypt stuff I've had to literally print out. The ergonomics is a HUGE factor.

eternityforest 4y ago

At a certain point encryption becomes useless (Full disk encryption with a short password, or one written on a sticky note near the device, etc). I'm not familiar with how Mac does things, but some of those solutions prioritize security over reliability and store the keys in a crypto processor that can't be backed up, leaving no way to recover the drive if they break.