5 ms·

To prevent disk cloning. A typical attack scenario here would be something like: 1. You leave your laptop in a hotel room. 2. Criminals / police break in and

To prevent disk cloning. A typical attack scenario here would be something like: 1. You leave your laptop in a hotel room. 2. Criminals / police break in and clone the drive. 3. They install a (physical) keylogger between your keyboard and the rest of the computer. 4. You return, turn the computer on and enter your password, which the keylogger transmits to your attackers. They now have both the drive contents and the password needed to decrypt them. You can mitigate this by using a TPM and storing the key there instead of deriving it from the password, but even then, an attacker is able to clone the drive first and get the key later. With this feature on, you can't clone the drive until you get that key.

Gigachad 2y ago
This seems like such a contrived scenario. If the police want your info, they just request it from all the tech companies. If they want something on your laptop, they will just arrest you and have you unlock it. They aren't action movie style disassembling your laptop and installing a key logger on the keyboard ribbon cable. They would need a custom one for every laptop and you could hardly fit something with wireless capabilities in there. When the $5 wrench works fine.
- eecc 2y ago
  But if the data is encrypted in the drive they can't either, unless the tech company has deployed a backdoor in their trusted software stack. In this scenario you're somewhat more protected, because the attack vector is just the vendor backdoor rather than the panoply of RCE infesting modern systems, and one would hope that access to the backdoor is closely regulated by laws and judicial oversight. It all goes out of the window (pun intended) when your foe is a soverein actor but let's be honest, all we really want is a decent lock for our front-door.
Asraelite 2y ago
Attackers with that level of sophistication could most likely bypass any protective measures the SSD has or find some other way to exfiltrate data, like installing a transmitter on your RAM. If that's your threat model, then an adversary getting physical access to your device even once should mean it's now unusable anyway, regardless of how secure you think it is. There's just way too many attack vectors.

Gigachad 2y ago

This seems like such a contrived scenario. If the police want your info, they just request it from all the tech companies. If they want something on your laptop, they will just arrest you and have you unlock it. They aren't action movie style disassembling your laptop and installing a key logger on the keyboard ribbon cable. They would need a custom one for every laptop and you could hardly fit something with wireless capabilities in there. When the $5 wrench works fine.

eecc 2y ago
But if the data is encrypted in the drive they can't either, unless the tech company has deployed a backdoor in their trusted software stack. In this scenario you're somewhat more protected, because the attack vector is just the vendor backdoor rather than the panoply of RCE infesting modern systems, and one would hope that access to the backdoor is closely regulated by laws and judicial oversight. It all goes out of the window (pun intended) when your foe is a soverein actor but let's be honest, all we really want is a decent lock for our front-door.

Asraelite 2y ago

Attackers with that level of sophistication could most likely bypass any protective measures the SSD has or find some other way to exfiltrate data, like installing a transmitter on your RAM. If that's your threat model, then an adversary getting physical access to your device even once should mean it's now unusable anyway, regardless of how secure you think it is. There's just way too many attack vectors.