8 ms·
I'd rather lose the laptop but have full disk encryption and keep my data secure.
by maqr 14y ago
I'd rather lose the laptop but have full disk encryption and keep my data secure.
- mike-cardwell 14y agoI have the best of both worlds. Turn my laptop on and it will automatically boot into Windows without even so much as a password prompt. From there I have Prey installed so I can track it. I never use this Windows installation though and it contains no valuable/personal data. It's effectively a honey-pot operation system. I have a Linux installation on there too (my "real" os) which takes up the vast majority of the drive and uses full disk encryption. I insert a USB stick at startup which contains the boot partition+loader and boot from that. I wrote it up here: https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sophisticated_Attacks https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sop...
- jorgem 14y agoNice. Has all this effort ever come in handy?
- mike-cardwell 14y agoNope. But then neither has my car insurance. ;) I've only been running this configuration for a little over a year anyway.
- jorgem 14y agoI speculate an ugly not-too-distant future: Mike crosses US border from Canada to US. Fancy government computers "lookup" Mike and flag his name because of suspicious posts on "hacker" news. Fun ensues, when agents discover hidden/encrypted partitions on computer. Computer impounded for further investigation. Mike has a bad day.
- dkersten 14y agoBut thanks to full disk encryption, his data is still safe from agents snooping through his cat photo collection!
- DanBC 14y agoThey just keep him in prison until he gives them a password. Luckily he's not identified as a terrorist. Because those people are subject to extraordinary rendition and intense interrogation techniques, and detained without trial.
- jorgem 14y agoMaybe this is a valid case for "security through obscurity". If you don't publicly proclaim you're doing something like this, who knows to look?
- NinetyNine 14y agoPair that with a slightly stronger form of data hiding by using TrueCrypt's hidden partition feature to encrypt the second OS partition. Just make sure not to ever boot into the honeypot os afterwards, or it could overwrite parts of the hidden partition. You can safely load the honeypot os by typing in the hidden password as well so that true crypt can load the proper partition boundaries.
- mike-cardwell 14y agoI'll just overwrite that partition with random garbage and use the Windows honey-pot OS for the duration of my visit, restoring when I get home. Well I might. Or I might not. Plausible deniability anybody?
- MichaelApproved 14y agoOnce they decide to investigate further, you won't have time or ability to wipe out the drive.
- ekoontz 14y agoThanks for the introduction to Prey. Just installed it!
- luser001 14y agoSo you shut down your computer (as opposed to suspending it) every time you transport your computer from home to office and vice versa etc?
- ryanhuff 14y agoWhat's so unusual about that? I almost never suspend my laptop.
- Jimmie 14y agoI almost never shut it down. Probably only once a month. Waking from sleep is faster and I don't have to re-open my applications and documents. Shutting it down would save a small amount of power but that's rarely an issue (I'd shut it down if I was flying somewhere). Are there some benefits to shutting it down I'm overlooking?
- rdl 14y agoWith SSD, on OSX, it's pretty fast to reboot. Most OSes can now be tuned to boot very quickly; the big thing was getting rid of the BIOS for EFI I think.
- mike_esspe 14y agoIf you suspend, you are vulnerable to reading decryption key from RAM (firewire, ram freezing). If you are doing full disk encryption, then only shutdown or hibernate are secure.
- mike-cardwell 14y agoMy encryption key doesn't live in RAM because I use TRESOR. It's hidden in the debug registers of my CPU. There is still going to be other sensitive information in RAM though which I wouldn't want to be accessed.
- mike-cardwell 14y agoAbsolutely. My previous laptop was a Macbook that I used to just suspend to RAM. When I decided to start taking my security/privacy seriously I decided I would start shutting down my machine when not in use. Even though TRESOR keeps my encryption key out of RAM, my RAM is still going to contain sensitive information when suspended. I can't suspend to disk because I've disabled swap. I did this because I use an SSD and wanted to avoid unnecessary wearing. I suspected that I might be frustrated by having to boot up my machine every time I use it, because I'd become accustomed to suspend to ram. It hasn't turned out that way. It doesn't bother me at all.
- wesley 14y agoHow much slower is an encrypted partition? (SSD) - Anyone have benchmarks?
- mike_esspe 14y agoModern intel CPUs have AES-NI which accelerate AES-decoding: http://www.remkoweijnen.nl/blog/2011/03/11/aes-ni-benchmarks/ http://www.remkoweijnen.nl/blog/2011/03/11/aes-ni-benchmarks...
- deleted 14y ago[deleted]