4 ms·
It was two entirely seperate vulnerabilities. The Crucial drive did not have any association between the encryption key and the passphrase, making it possible
by arghwhat 2y ago
It was two entirely seperate vulnerabilities.
The Crucial drive did not have any association between the encryption key and the passphrase, making it possible to bypass encryption.
The Samsung drive had an issue where when setting a passphrase, wear leveling could cause the old unprotected key to still exist on a flash bank (not normally accessible) until that bank got reused.
Only one of them is horrible incompetence - the other is bad but fixable and expires on its own after a bit of use.
- p_ing 2y agoAnd in either case, it doesn't matter in the eyes of Microsoft. Drive manufactures couldn't be trusted -- and honestly, the amount of "awesome" software coming from component manufactures is pretty small. The drive manufactures software was making Microsoft look bad. The advantage of SED was small when we have AES-NI.
- arghwhat 2y agoTrue, Microsoft can't be expected to make software that is good for the sake of being good. Maybe they'll consider now Microsoft looks bad on their own - OPAL2.0 on modern drives is quite a different beast than what they pulled out of. Note that the advantage is still very large - easily 20% and an associated hit to battery life, depending on the specific cipher mode and access pattern. Without AES-NI it just wouldn't be practical to even consider AES-based FDE.