4 ms·

Why are more people not using self encrypting drives?

varispeed 2y ago
Ages ago I had an external drive that had a controller with built in keys that encrypted the data in and out. Problem was that the controller was poorly made and one time upon connecting to the PC, the controller chip died and so the keys with it. It was impossible to recover the data, but the disk itself was perfectly fine. I bought a damaged drive with working controller and swapped it out and my drive worked again, however I had to format it, because new board had different keys. Since then I preferred to use software encryption and steered clear of drives that use any sort of hardware encryption. The risk of losing data was not worth it.
- arghwhat 2y ago
  All SSD's with OPAL are always encrypting your data. "Enabling" the feature just means that you change from a random on-device key to a key encrypted with your passphrase. (Whenever you wipe the drive through OPAL, you're just overwriting the key.)
TiredOfLife 2y ago
After this https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker-encryption/ https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks... Microsoft patched out support for self encrypting drives.
- arghwhat 2y ago
  Quite dumb considering this was an issue with pretty much a single, low-cost consumer vendor (Crucial?). If nothing else, use it in combination - the encryption of OPAL drives is always active anyway, all that changes when the feature is "active" is whether the key is stored as-is on the controller or whether its protected by a passphrase.
  - p_ing 2y ago
    Both Crucial and Samsung, which produce a significant number of OEM drives for the likes of Dell, HP, etc.
    - arghwhat 2y ago
      It was two entirely seperate vulnerabilities. The Crucial drive did not have any association between the encryption key and the passphrase, making it possible to bypass encryption. The Samsung drive had an issue where when setting a passphrase, wear leveling could cause the old unprotected key to still exist on a flash bank (not normally accessible) until that bank got reused. Only one of them is horrible incompetence - the other is bad but fixable and expires on its own after a bit of use.
      - p_ing 2y ago
        And in either case, it doesn't matter in the eyes of Microsoft. Drive manufactures couldn't be trusted -- and honestly, the amount of "awesome" software coming from component manufactures is pretty small. The drive manufactures software was making Microsoft look bad. The advantage of SED was small when we have AES-NI.
        arghwhat 2y ago
        True, Microsoft can't be expected to make software that is good for the sake of being good. Maybe they'll consider now Microsoft looks bad on their own - OPAL2.0 on modern drives is quite a different beast than what they pulled out of. Note that the advantage is still very large - easily 20% and an associated hit to battery life, depending on the specific cipher mode and access pattern. Without AES-NI it just wouldn't be practical to even consider AES-based FDE.
  - briHass 2y ago
    I like using OPAL on my low powered laptop (8th gen i3), since Bitlocker eats some of that prescious CPU. Testing showed the impact of BL to be about 20% worse for the write speed and somewhere around a few percent read. Not earth shattering, but for SATA3 era SSDs, it's not nothing either. The old 850 EVOs work well, and they're quality disks IME.
- OptionOfT 2y ago
  It's actually still in there. Now, drives with eDrive, as MS calls it, are becoming harder to find. It is no longer advertised (as native 4k sectors aren't either...). Soon it'll be dropped all together.
vel0city 2y ago
Seems like most of the big drive makers had pretty poor quality on the whole self encrypting part of it, at least last I saw a few years ago.
- kotaKat 2y ago
  I blame the mess that was Wave Systems and the shitty meddlingware they built to try to manage it all. The support experience was one of the absolute worst I’ve ever seen — and I was the guy on the end of the phone that had to say “thank you for calling Wave Systems Gold Support” having been given zero documentation into what the product even did, but being told we had to log tickets into MS Dynamics and pray that a Wave engineer would call a panicked locked out user back “soon”.
- slicktux 2y ago
  There are standards and a lot of the stigma comes for AT Password enclosures…

Ages ago I had an external drive that had a controller with built in keys that encrypted the data in and out. Problem was that the controller was poorly made and one time upon connecting to the PC, the controller chip died and so the keys with it. It was impossible to recover the data, but the disk itself was perfectly fine. I bought a damaged drive with working controller and swapped it out and my drive worked again, however I had to format it, because new board had different keys. Since then I preferred to use software encryption and steered clear of drives that use any sort of hardware encryption. The risk of losing data was not worth it.

arghwhat 2y ago
All SSD's with OPAL are always encrypting your data. "Enabling" the feature just means that you change from a random on-device key to a key encrypted with your passphrase. (Whenever you wipe the drive through OPAL, you're just overwriting the key.)

TiredOfLife 2y ago

After this https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks-bitlocker-encryption/ https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks... Microsoft patched out support for self encrypting drives.

arghwhat 2y ago
Quite dumb considering this was an issue with pretty much a single, low-cost consumer vendor (Crucial?). If nothing else, use it in combination - the encryption of OPAL drives is always active anyway, all that changes when the feature is "active" is whether the key is stored as-is on the controller or whether its protected by a passphrase.
- p_ing 2y ago
  Both Crucial and Samsung, which produce a significant number of OEM drives for the likes of Dell, HP, etc.
  - arghwhat 2y ago
    It was two entirely seperate vulnerabilities. The Crucial drive did not have any association between the encryption key and the passphrase, making it possible to bypass encryption. The Samsung drive had an issue where when setting a passphrase, wear leveling could cause the old unprotected key to still exist on a flash bank (not normally accessible) until that bank got reused. Only one of them is horrible incompetence - the other is bad but fixable and expires on its own after a bit of use.
    - p_ing 2y ago
      And in either case, it doesn't matter in the eyes of Microsoft. Drive manufactures couldn't be trusted -- and honestly, the amount of "awesome" software coming from component manufactures is pretty small. The drive manufactures software was making Microsoft look bad. The advantage of SED was small when we have AES-NI.
      - arghwhat 2y ago
        True, Microsoft can't be expected to make software that is good for the sake of being good. Maybe they'll consider now Microsoft looks bad on their own - OPAL2.0 on modern drives is quite a different beast than what they pulled out of. Note that the advantage is still very large - easily 20% and an associated hit to battery life, depending on the specific cipher mode and access pattern. Without AES-NI it just wouldn't be practical to even consider AES-based FDE.
- briHass 2y ago
  I like using OPAL on my low powered laptop (8th gen i3), since Bitlocker eats some of that prescious CPU. Testing showed the impact of BL to be about 20% worse for the write speed and somewhere around a few percent read. Not earth shattering, but for SATA3 era SSDs, it's not nothing either. The old 850 EVOs work well, and they're quality disks IME.
OptionOfT 2y ago
It's actually still in there. Now, drives with eDrive, as MS calls it, are becoming harder to find. It is no longer advertised (as native 4k sectors aren't either...). Soon it'll be dropped all together.

vel0city 2y ago

Seems like most of the big drive makers had pretty poor quality on the whole self encrypting part of it, at least last I saw a few years ago.

kotaKat 2y ago
I blame the mess that was Wave Systems and the shitty meddlingware they built to try to manage it all. The support experience was one of the absolute worst I’ve ever seen — and I was the guy on the end of the phone that had to say “thank you for calling Wave Systems Gold Support” having been given zero documentation into what the product even did, but being told we had to log tickets into MS Dynamics and pray that a Wave engineer would call a panicked locked out user back “soon”.
slicktux 2y ago
There are standards and a lot of the stigma comes for AT Password enclosures…