6 ms·
What if I lost my laptop?
- romeonova 13y agoMight want to take another look at the article to fix grammar/spelling.
- Murkin 13y agoMy third language.. will appriciate if you can drop me a line with corrections do @ itlater.com
- dudus 13y agoNot sure if this is a real email or a bad and rude joke
- obviouslygreen 13y agoConsidering the address is on the domain for the original post and the poster says it's his third language... perhaps, just this once, it's safe not to assume malice.
- Murkin 13y agoYep, real email. Not sure what the rude part was..
- johnchristopher 13y agoI think it's funny and clever use of his domain name. I suppose he uses it as a kind of action inbox /to-do later list.
- suhastech 13y agoAssuming my password is safe, I think keychain (on a Mac) takes care of almost all the issues specified. Except the source code
- caissy 13y agoHaving a full encrypted system solves all of those issues. If not, at least an encrypted home (such as what Debian provides with their default installation).
- unsignedint 13y agoI've tried the both of them and generally I found dm-crypt + LUKS to be superior. The problem of e-cryptfs (which I believe what Debian uses for home directory -- at least Ubuntu uses) limit usable file name length because of the way things are encrypted. While it's not often the case I would exhaust its length limitation, but if I do, it's bit frustrating...
- mowfask 13y agoThose possibilities are especially embarrassing since doing it a lot better takes little effort: TrueCrypt container which contains sensible project-data; .ssh somewhere on that container with ~/.ssh linking to it; Keepass for passwords, it's quite convinient. Maybe Pray or something similar, haven't set it up myself yet...
- baby 13y agoPrey really takes seconds to setup. No excuses ;) Don't forget to set it up so that a guest account is created as well.
- thibaut_barrere 13y agoI know that creating a guest account as a honeypot is the recommended technique, but I wonder if there are (Mac OS X) vulnerabilities to get access to your main account from the guest account (in which case full disk encryption would not protect the data). I guess in the end it boils down to: do you prefer to leak the data, or lose your laptop ? :-)
- dunham 13y agoThe built-in guest account runs on a separate copy of the OS, booted from the recovery partition. It is a limited OS image that only runs Safari. A normal account would require unlocking the disk, which would expose everything. Last time I looked at Prey (over a year ago) it didn't support installation to the recovery partition. But they may have added support since then.
- paxswill 13y agoIf you're already relying on OS X's FDE, it's not a huge step to link your laptop with iCloud. You can then do basically all the things you can do with a lost iOS device: beep, send messages, or wipe it (instantaneously if FDE is on, it just clears the keys).
- CoachRufus87 13y ago
- guylhem 13y agoSo basically, you didn't lost it. Good for you. Yet using full drive encryption + daily backups (or dropbox or google drive or whatever webfs) + having a spare machine at home (so that you can spare the trip to a computer store and have a machine readily configured) is necessary if you are a professional. You seem to have underestimated this last point, with your estimation of a full day to have a new one ready. Having a machine setup and ready can sure take hours - which might not be ok if you have a client waiting. Also, anything else may happen (car broke, computer shop closed / out of computers). I have noticed that when bad things happend, they tend to spiral out until sh*t hit the fan. Your $1k is a lowball estimate. Better have a spare one ready and waiting for you.
- Murkin 13y agoThere is a difference between a machine that is ready to help a client and one that has all my favorite xmonad hot-keys setup. Now a web-based ssh is enough to do 99% of the work. But true comfort takes time
- deleted 13y ago[deleted]
- jonknee 13y ago> There is a difference between a machine that is ready to help a client and one that has all my favorite xmonad hot-keys setup. Only if you don't take the few minutes to prepare. I have a Dropbox hosted bash profile that keeps all my favorites synced across machines, there's no reason why your hot-keys couldn't be stored similarly. (I have a real .profile for each machine, but its first line is `source ~/Dropbox/conf/bash_profile` which lets me override if necessary and apply machine specific instructions.)
- Murkin 13y agoSame here (only on github) My next machine will be Mac or Ubuntu 13.04. (and last time 10.10 -> 12.10 took 1 day).
- 13y ago
- dpcan 13y agoFull disk encryption. This is the first thing I do as soon as I get a new computer. The thought of losing one of my work systems terrified me before. Now I have peace of mind.
- MattRogish 13y agoDoes setting a Mac OSX(10.8) FileVault full-disk encryption + strong password obviate most/all of those issues? I have been somewhat cavalier when it comes to laptop security because of that...
- nvr219 13y agoI would recommend using TrueCrypt volumes so you can open them on machines other than OSX.
- aroman 13y agoThat really doesn't offer feature overlap with FileVault2's full disk encryption. Though using TC is a great alternative for specific disks and folders -- not an entire system from preboot through log-in.
- ajross 13y agoThe idea of transporting your encrypted data seems a little flawed. That opens another failure mode because of the inevitable need for key escrow (never trust a backup to what's in your brain). Yes, you can do that securely. But like everything else you probably won't. So either you'll goof and expose your keys accidentally, or (typically much worse!) you'll goof and lose data. It seems better to do your backups to a separately-secured environment, either with a distinct (and differently managed) encryption key, or just to a physically secure location without encryption (frankly my preference).
- ambiate 13y agoIf I lost my laptop, assuming I would have a backup of the past 15 years on it (like most devices I own), I would worry about the statute of limitations on cyber crimes regarding felonies for unlawful intrusion. When I was a teenager, we used to toy with trojans/viruses and infecting each other and playing wargames on one another in our group. Out of context, it could seem very malicious and non-educational. There are probably hard copies of this in my backups. (When 200MB hard drives were a luxury, and Windows 3.11 for workgroups was a way of life for poor people, and 20 mile walks uphill in snow to school...punchcards...AOL CD art...). Things really are so much different now. It seems like a couple of years ago that AOL was dominating the market. The IIS string vulnerabilities seem like months ago.
- cenhyperion 13y agoDaily backups, full disk encryption, and something like lastpass, onepassword, or keychain.
- quackerhacker 13y agoThanks for the reminder...now to passpharse my mainframe's ssh keys. Doesn't help that I have the rsas floating around on my iphone, ipad, putty,...hmmm I need to do a check like this on every device now.
- guelo 13y agoNot that these aren't legitimate concerns but unless it's someone like a coworker or a client I'm guessing 99% of thieves would have no idea what an ssh key or software code is. The savvier thief is just going to wipe the hard drive as soon as they can.
- jiggy2011 13y agoMaybe , but I could see the emergence of a savvier brand of fence who might pay extra for laptops with intact data on the basis that 1/100 has something worthwhile.
- jtbigwoo 13y agoI've told this one before, but I worked for a company that had a "lose your laptop and get fired" policy. They also had full disk encryption and remote wiping capability, but I guess someone up top thought a preventative policy was needed. I don't think anyone ever got fired and the policy was rescinded after a year, but it definitely clarified my focus when it came to keeping my laptop secure on the road.
- msh 13y agoso if you were unlucky and got mugged you would be fired, sounds like a really bad policy...
- dpcan 13y agoMy guess is top management may have been more worried about employees selling their laptops with trade secrets on them and then claiming they were stolen.
- jtbigwoo 13y agoIt was a bad policy for all sorts of reasons, but there had been a really careless loss the previous year. Something like a hundred thousand customer credit files were left on an unencrypted laptop in the back of a reeturned rental car. Like I said, they rescinded it before anybody actually got fired. You can usually learn more about the history of a company by reading its employee handbook than by reading its "About Us" page.
- jonknee 13y agoThe new policy should have been if you have unencrypted credit files on your laptop (or desktop) you are fired. That's the inexcusable behavior, not the loss of a laptop.
- feral 13y agoDoesn't sound like a good idea to me - what about the unintended consequences? If an employee's laptop goes missing, you want them to promptly notify IT, so that measures can be taken to plug any security holes. You don't want them to try to hide the loss - or even to delay, while they try recover the laptop themselves - which they might do if they believe they'll get fired for reporting it missing.
- mike_esspe 13y agoYou should always use disk encryption and shutdown(hibernate) your notebook while traveling. There is no noticeable performance degradation on modern hardware. Windows: Truecrypt Linux: dm-crypt + LUKS FreeBSD: gdbe MacOS: probably FileVault
- PetrolMan 13y agoIsn't hibernation actually a potential risk since the state of the machine is stored, which could potentially provide access to restricted files?
- unsignedint 13y agoIf swap (and hibernation blob) is encrypted, then you'll be OK. TrueCrypt (when used with Pre-boot authentication) will encrypted everything including swap, dm-crypt/LUKS would configure encrypted swap, and with FileVault (actually even without FileVault) MacOS configures itself to use encrypted swap.
- xenophonf 13y agoOn FreeBSD you are probably better off using geli instead of gdbe. Geli supports both XTS and CBC (similar to ESSIV) modes, features data authentication, and can operate on the root file system. I've used it to encrypt both UFS2 file systems and ZFS pools (see https://web.irtnog.org/~xenophon/blog https://web.irtnog.org/~xenophon/blog for my notes on combining ZFS and geli).
- xenophonf 13y agoEr, sorry, the old one is called gbde. My fingers must be hardwired for "gdb". ;-)
- VuongN 13y agoQuick plug here if you guys don't mind: our security product nCryptedCloud protect at-rest data in your dropbox account. Should you ever loose your laptop and want to make those dropbox files not readable on that device, all you have to do is remotely revoke the access key (from the device). Without access privilege, the data is useless. It's free for personal use. Let me know if you guys have any question or comments. -V.
- johnchristopher 13y agoI am being nitpicky but I couldn't find what that asterisk > * Yes we do all those and more, do you ? is referencing to.
- onosendai 13y agoEncrypting everything at the block level has gotten reliable enough that there are no excuses not to apply it to any and all kinds of mobile devices. With Ubuntu 12.10 onwards you have the option to use dm-crypt for full disk encryption baked right into the installer. With 12.04 and earlier you have to use the alternate CD, but it's still painless. Android also uses dm-crypt for its FDE implementation, also dead easy to enable. With a password manager for the rest of your passwords, and an SSH key for remote system access, you can manage everything only knowing three different passphrases. Using FDE precludes theft protection programs, obviously, since an attacker wouldn't have access to a live OS. But if you're willing to forego a bit of fun (see https://www.youtube.com/watch?v=U4oB28ksiIo https://www.youtube.com/watch?v=U4oB28ksiIo) and the chance to recover the hardware, you have a pretty solid guarantee that no one will get to your data. And, of course, daily backups, which is another can of worms. Personally I just rsync to a remote system and offsite that data periodically.