6 ms·

>>>Intermediate: >>> - Encypting your Entire Hard Drive with Truecrypt (Mac and Windows) Do people recommend this method, or is Apple's built-in full disk enc

>>>Intermediate: >>> - Encypting your Entire Hard Drive with Truecrypt (Mac and Windows) Do people recommend this method, or is Apple's built-in full disk encryption sufficient?

mistercow 15y ago
I would not put much trust in any encryption system whose source code I did not have access to.
- deleted 15y ago
  [deleted]
- joejohnson 15y ago
  I never get that argument. I could download TrueCrypts source code, but that would take forever to read, if I could even read it all. So I'm basically taking the internet's consensus that someone has read the source and it does what it says it does. Is this a safer bet?
  - derrida 15y ago
    Yes, especially with encryption. "Many eyes make bugs shallow". And of course someone has read the source, someone wrote it. But the number of eyes on the code would be more than closed source.
    - joejohnson 15y ago
      That makes sense. Thanks.
  - Ralith 15y ago
    Would you rather use a program vetted by a wide variety of unassociated security researchers, or one whose manufacturer merely insists it was very careful programming?
  - petercooper 15y ago
    My take on this is that if it's open source and lots of people are using it, malicious individuals will be scouring the source trying to find attack vectors which then, hopefully, would be more likely to become public than attack vectors in private software.
derrida 15y ago
I wouldn't trust Apple on security. They are currently producing computers with ports that have direct access to the RAM. Also, you can root a mac with physical access in about 10 seconds. (On startup CTRL-S , mount the hd, delete find and delete .Apple*, restart). There is also that issue with the Indian government. Also in the past they have had major problems with FileVault (search 'VileFault').
- deleted 15y ago
  [deleted]
- DanBC 15y ago
  > Also, you can root a mac with physical access in about 10 seconds. (On startup CTRL-S , mount the hd, delete .Apple, restart)* If an attacker has physical access to the machine there's very little you can do to protect it. There are some things you can do to make that harder, but general advice is "physical access == game over" for security.
- jcoder 15y ago
  Unless this allows you to access a Mac that has FileVault disk encryption turned on, without the key, it's a red herring. Also, today's FileVault is a completely different technology than the previous home dir encryption (which AFAIK was never broken, but had some frustrating limitations, mainly regarding backup).
  - derrida 15y ago
    You can retrieve the key if the computer is turned on by dumping the memory from a Firewire or Thunderbolt port. If these ports are disabled you could use the Cold Boot Attack. This is the same with all computers, it's just that Apple continue to make them with Thunderbolt. There may be other ways... 'Unlocking FileVault': http://www.youtube.com/watch?v=doGzuOYCNJE http://www.youtube.com/watch?v=doGzuOYCNJE
    - rdl 15y ago
      Apple has made some progress on protecting from DMA attacks -- when the screen locker is enabled, you can't do it. The kernel uses Intel VT-d for this; I'm not sure if Linux or Windows do the same yet. I knocked Apple a bit for security issues 2006-2009, but they've made a serious effort to fix things starting sometime in 2010 or 2011. I mean, iOS and the iPhone platform is probably one of the most secure mobile OSes now (RIM edges it out, but RIM sucks). OS X has added other security features as well, starting with 10.6.
rdl 15y ago
Filevault 2 is pretty good. It's built into the OS, so it's a lot more likely people will use it than to install another package. Obviously you need to make sure you have a good backup scheme in place, and escrow the decryption key somewhere (ideally, printed). There are some functionality advantages to Truecrypt (deniable volumes, etc.), but Filevault is pretty good. I'd feel equally comfortable with either one. (I'd prefer OPEL, the drive encryption on-controller, for performance reasons, but Mac OS X doesn't support that.) Once you do that, you have a lot of other things to worry about before "which widely accepted disk crypto package should I use for FDE" becomes the biggest question.
- lloeki 15y ago
  > (I'd prefer OPEL, the drive encryption on-controller, for performance reasons, but Mac OS X doesn't support that.) When available, OSX makes use of the hardware AES-NI capabilities of the CPU though.
- A_A 15y ago
  Has anyone used TrueCrypt for full-disk encryption on Mac, or MacBook Air (SSD)? Any experiences to share? Anything positive/negative /etc? Would appreciate comments, esp on compatibility with non-Mac devices. Thanks!
philip1209 15y ago
Correct me if I'm wrong, but doesn't Truecrypt for Mac not support full-disk encryption for the boot disk?

>>>Intermediate: >>> - Encypting your Entire Hard Drive with Truecrypt (Mac and Windows) Do people recommend this method, or is Apple's built-in full disk encryption sufficient?

mistercow 15y ago

I would not put much trust in any encryption system whose source code I did not have access to.

deleted 15y ago
[deleted]
joejohnson 15y ago
I never get that argument. I could download TrueCrypts source code, but that would take forever to read, if I could even read it all. So I'm basically taking the internet's consensus that someone has read the source and it does what it says it does. Is this a safer bet?
- derrida 15y ago
  Yes, especially with encryption. "Many eyes make bugs shallow". And of course someone has read the source, someone wrote it. But the number of eyes on the code would be more than closed source.
  - joejohnson 15y ago
    That makes sense. Thanks.
- Ralith 15y ago
  Would you rather use a program vetted by a wide variety of unassociated security researchers, or one whose manufacturer merely insists it was very careful programming?
- petercooper 15y ago
  My take on this is that if it's open source and lots of people are using it, malicious individuals will be scouring the source trying to find attack vectors which then, hopefully, would be more likely to become public than attack vectors in private software.

derrida 15y ago

I wouldn't trust Apple on security. They are currently producing computers with ports that have direct access to the RAM. Also, you can root a mac with physical access in about 10 seconds. (On startup CTRL-S , mount the hd, delete find and delete .Apple*, restart). There is also that issue with the Indian government. Also in the past they have had major problems with FileVault (search 'VileFault').

deleted 15y ago
[deleted]
DanBC 15y ago
> Also, you can root a mac with physical access in about 10 seconds. (On startup CTRL-S , mount the hd, delete .Apple, restart)* If an attacker has physical access to the machine there's very little you can do to protect it. There are some things you can do to make that harder, but general advice is "physical access == game over" for security.
jcoder 15y ago
Unless this allows you to access a Mac that has FileVault disk encryption turned on, without the key, it's a red herring. Also, today's FileVault is a completely different technology than the previous home dir encryption (which AFAIK was never broken, but had some frustrating limitations, mainly regarding backup).
- derrida 15y ago
  You can retrieve the key if the computer is turned on by dumping the memory from a Firewire or Thunderbolt port. If these ports are disabled you could use the Cold Boot Attack. This is the same with all computers, it's just that Apple continue to make them with Thunderbolt. There may be other ways... 'Unlocking FileVault': http://www.youtube.com/watch?v=doGzuOYCNJE http://www.youtube.com/watch?v=doGzuOYCNJE
  - rdl 15y ago
    Apple has made some progress on protecting from DMA attacks -- when the screen locker is enabled, you can't do it. The kernel uses Intel VT-d for this; I'm not sure if Linux or Windows do the same yet. I knocked Apple a bit for security issues 2006-2009, but they've made a serious effort to fix things starting sometime in 2010 or 2011. I mean, iOS and the iPhone platform is probably one of the most secure mobile OSes now (RIM edges it out, but RIM sucks). OS X has added other security features as well, starting with 10.6.

rdl 15y ago

Filevault 2 is pretty good. It's built into the OS, so it's a lot more likely people will use it than to install another package. Obviously you need to make sure you have a good backup scheme in place, and escrow the decryption key somewhere (ideally, printed). There are some functionality advantages to Truecrypt (deniable volumes, etc.), but Filevault is pretty good. I'd feel equally comfortable with either one. (I'd prefer OPEL, the drive encryption on-controller, for performance reasons, but Mac OS X doesn't support that.) Once you do that, you have a lot of other things to worry about before "which widely accepted disk crypto package should I use for FDE" becomes the biggest question.

lloeki 15y ago
> (I'd prefer OPEL, the drive encryption on-controller, for performance reasons, but Mac OS X doesn't support that.) When available, OSX makes use of the hardware AES-NI capabilities of the CPU though.
A_A 15y ago
Has anyone used TrueCrypt for full-disk encryption on Mac, or MacBook Air (SSD)? Any experiences to share? Anything positive/negative /etc? Would appreciate comments, esp on compatibility with non-Mac devices. Thanks!

philip1209 15y ago

Correct me if I'm wrong, but doesn't Truecrypt for Mac not support full-disk encryption for the boot disk?