3 ms·

Quite dumb considering this was an issue with pretty much a single, low-cost consumer vendor (Crucial?). If nothing else, use it in combination - the encryptio

Quite dumb considering this was an issue with pretty much a single, low-cost consumer vendor (Crucial?). If nothing else, use it in combination - the encryption of OPAL drives is always active anyway, all that changes when the feature is "active" is whether the key is stored as-is on the controller or whether its protected by a passphrase.

p_ing 2y ago
Both Crucial and Samsung, which produce a significant number of OEM drives for the likes of Dell, HP, etc.
- arghwhat 2y ago
  It was two entirely seperate vulnerabilities. The Crucial drive did not have any association between the encryption key and the passphrase, making it possible to bypass encryption. The Samsung drive had an issue where when setting a passphrase, wear leveling could cause the old unprotected key to still exist on a flash bank (not normally accessible) until that bank got reused. Only one of them is horrible incompetence - the other is bad but fixable and expires on its own after a bit of use.
  - p_ing 2y ago
    And in either case, it doesn't matter in the eyes of Microsoft. Drive manufactures couldn't be trusted -- and honestly, the amount of "awesome" software coming from component manufactures is pretty small. The drive manufactures software was making Microsoft look bad. The advantage of SED was small when we have AES-NI.
    - arghwhat 2y ago
      True, Microsoft can't be expected to make software that is good for the sake of being good. Maybe they'll consider now Microsoft looks bad on their own - OPAL2.0 on modern drives is quite a different beast than what they pulled out of. Note that the advantage is still very large - easily 20% and an associated hit to battery life, depending on the specific cipher mode and access pattern. Without AES-NI it just wouldn't be practical to even consider AES-based FDE.
briHass 2y ago
I like using OPAL on my low powered laptop (8th gen i3), since Bitlocker eats some of that prescious CPU. Testing showed the impact of BL to be about 20% worse for the write speed and somewhere around a few percent read. Not earth shattering, but for SATA3 era SSDs, it's not nothing either. The old 850 EVOs work well, and they're quality disks IME.

p_ing 2y ago

Both Crucial and Samsung, which produce a significant number of OEM drives for the likes of Dell, HP, etc.

arghwhat 2y ago
It was two entirely seperate vulnerabilities. The Crucial drive did not have any association between the encryption key and the passphrase, making it possible to bypass encryption. The Samsung drive had an issue where when setting a passphrase, wear leveling could cause the old unprotected key to still exist on a flash bank (not normally accessible) until that bank got reused. Only one of them is horrible incompetence - the other is bad but fixable and expires on its own after a bit of use.
- p_ing 2y ago
  And in either case, it doesn't matter in the eyes of Microsoft. Drive manufactures couldn't be trusted -- and honestly, the amount of "awesome" software coming from component manufactures is pretty small. The drive manufactures software was making Microsoft look bad. The advantage of SED was small when we have AES-NI.
  - arghwhat 2y ago
    True, Microsoft can't be expected to make software that is good for the sake of being good. Maybe they'll consider now Microsoft looks bad on their own - OPAL2.0 on modern drives is quite a different beast than what they pulled out of. Note that the advantage is still very large - easily 20% and an associated hit to battery life, depending on the specific cipher mode and access pattern. Without AES-NI it just wouldn't be practical to even consider AES-based FDE.

briHass 2y ago

I like using OPAL on my low powered laptop (8th gen i3), since Bitlocker eats some of that prescious CPU. Testing showed the impact of BL to be about 20% worse for the write speed and somewhere around a few percent read. Not earth shattering, but for SATA3 era SSDs, it's not nothing either. The old 850 EVOs work well, and they're quality disks IME.