4 ms·

I’d be curious if it was easy (or even possible) to recover data from a FileVault encrypted drive, which any IT dept worth its salt could remotely wipe

by xref 3y ago

SOLAR_FIELDS 3y ago
I’d wager to agree, I don’t play in this space much but I can’t imagine MDM being unable to handle this kind of basic use case, and also for most companies the confidential data being worth enough to be more careful than relying on MDM. Sure if you work for a compay that builds weapons for the USG you probably need to worry about hardware chain of custody. But those people are not sending their employees home with laptops anyway. In other words, if you trust your employees enough to take that device home, whatever you have on there is probably fine to be handled by MDM
- d4mi3n 3y ago
  I'm of a similar mind. I also think the argument of this protecting the employee, while true, feels a it weak in the face of an employer deciding to leave a laptop they didn't adequately scrub with said ex-employee.
plugger 3y ago
I can't speak to FileVault, but Bitlocker and TPM can be quite easily defeated through sniffing the bitlocker key as it's transmitted from the TPM chip to the CPU to decrypt the drive on boot over the LPC, I2C, or SPI bus. Unless you enable TPM+pin for preboot auth you can't easily protect the data on a Windows PC, even with FDE.
- marcinzm 3y ago
  If there's a remote wipe done (one click in MDM software) then there is no key left.
- sam_lowry_ 3y ago
  Pretty much every company does preboot auth nowadays for Windows laptops. And remote wipe is also possible, as the side comment says. Letting the former employee keep the laptop is the default, IMO. Although, frankly, I am not sure I would want to keep mine... sitting on a pile of a dozen laptops accumulated over the years. And everyone watches porn on their on own devices anyway.
  - red-iron-pine 3y ago
    > sitting on a pile of a dozen laptops accumulated over the years. low power consumption and can probably run a couple of VMs, albeit not super well but well enough

I’d be curious if it was easy (or even possible) to recover data from a FileVault encrypted drive, which any IT dept worth its salt could remotely wipe

by xref 3y ago

I’d be curious if it was easy (or even possible) to recover data from a FileVault encrypted drive, which any IT dept worth its salt could remotely wipe

SOLAR_FIELDS 3y ago

I’d wager to agree, I don’t play in this space much but I can’t imagine MDM being unable to handle this kind of basic use case, and also for most companies the confidential data being worth enough to be more careful than relying on MDM. Sure if you work for a compay that builds weapons for the USG you probably need to worry about hardware chain of custody. But those people are not sending their employees home with laptops anyway. In other words, if you trust your employees enough to take that device home, whatever you have on there is probably fine to be handled by MDM

d4mi3n 3y ago
I'm of a similar mind. I also think the argument of this protecting the employee, while true, feels a it weak in the face of an employer deciding to leave a laptop they didn't adequately scrub with said ex-employee.

plugger 3y ago

I can't speak to FileVault, but Bitlocker and TPM can be quite easily defeated through sniffing the bitlocker key as it's transmitted from the TPM chip to the CPU to decrypt the drive on boot over the LPC, I2C, or SPI bus. Unless you enable TPM+pin for preboot auth you can't easily protect the data on a Windows PC, even with FDE.

marcinzm 3y ago
If there's a remote wipe done (one click in MDM software) then there is no key left.
sam_lowry_ 3y ago
Pretty much every company does preboot auth nowadays for Windows laptops. And remote wipe is also possible, as the side comment says. Letting the former employee keep the laptop is the default, IMO. Although, frankly, I am not sure I would want to keep mine... sitting on a pile of a dozen laptops accumulated over the years. And everyone watches porn on their on own devices anyway.
- red-iron-pine 3y ago
  > sitting on a pile of a dozen laptops accumulated over the years. low power consumption and can probably run a couple of VMs, albeit not super well but well enough