5 ms·

I'm a typical developer and I think I speak for the vast majority of people when I say that my concern is not with top level government agencies decrypting my h

I'm a typical developer and I think I speak for the vast majority of people when I say that my concern is not with top level government agencies decrypting my hard drive. My concern is with me losing my computer or having it stolen by a petty thief, in which case I feel that the proprietary built-in encryption tools offered by Microsoft and Apple are perfectly suitable.

mr337 12y ago
I agree that for keeping the TSA Joe out of a laptop is is great. The issue comes with educating non technical people, which this article feels like it is aimed at, with a enryption methods that we can't gurantee are sound. While it may stop petty data theft we have seen how these backdoors trickle down and before you know it your local police department is abusing it left and right. An example of technology that has been package and sold is the Stingray for cell phones. Even though this is more of a nasty feature of cellphones that the Stringray exploits what is stopping a BitLocker or OSX exploit to be commoditized?
- brandon272 12y ago
  Security involves tradeoffs. If you are a non-technical person with typical security needs, the encryption functions that are built into operating systems offer a lot of security with almost no tradeoff other than clicking a button to enable it. Once you start layering on additional requirements for the type of encryption you are using (e.g. has to be open source, has to be audited, needs to offer no evidence of installed OS, etc.), you are creating a myriad of hoops to jump through that a non-technical person is more likely inclined to just not jump through at all. If you are someone with security requirements that need to guarantee that no one will ever be able to access your data, including the police or feds who might have access to secret backdoors, I would hope it's common sense that you should be doing a lot more research on encryption rather than relying on a random security article aimed at non-technical people.
DanBC 12y ago
> when I say that my concern is not with top level government agencies decrypting my hard drive. It's great that you have risk-assessed your needs. It's a shame that the title says "like you mean it", and not "for tamper resistance against most people, but probably not well funded government agencies".
- brandon272 12y ago
  The title is off, but typically sensational. I wonder what disk encryption look like if you don't "mean it"?
  - sleepychu 12y ago
    ceaser cipher
  - DanBC 12y ago
    "Enclosed but not encrypted" is a nice article about bad encryption. http://www.h-online.com/security/features/Enclosed-but-not-encrypted-746199.html http://www.h-online.com/security/features/Enclosed-but-not-e... > A new generation of inexpensive disk drive enclosures using hardware encryption and RFID keys do not fulfil the promises of their publicity. The adverts claim 128-bit AES hardware encryption, but they don't tell us how it is used She does a nice write up.

mr337 12y ago

I agree that for keeping the TSA Joe out of a laptop is is great. The issue comes with educating non technical people, which this article feels like it is aimed at, with a enryption methods that we can't gurantee are sound. While it may stop petty data theft we have seen how these backdoors trickle down and before you know it your local police department is abusing it left and right. An example of technology that has been package and sold is the Stingray for cell phones. Even though this is more of a nasty feature of cellphones that the Stringray exploits what is stopping a BitLocker or OSX exploit to be commoditized?

brandon272 12y ago
Security involves tradeoffs. If you are a non-technical person with typical security needs, the encryption functions that are built into operating systems offer a lot of security with almost no tradeoff other than clicking a button to enable it. Once you start layering on additional requirements for the type of encryption you are using (e.g. has to be open source, has to be audited, needs to offer no evidence of installed OS, etc.), you are creating a myriad of hoops to jump through that a non-technical person is more likely inclined to just not jump through at all. If you are someone with security requirements that need to guarantee that no one will ever be able to access your data, including the police or feds who might have access to secret backdoors, I would hope it's common sense that you should be doing a lot more research on encryption rather than relying on a random security article aimed at non-technical people.

DanBC 12y ago

> when I say that my concern is not with top level government agencies decrypting my hard drive. It's great that you have risk-assessed your needs. It's a shame that the title says "like you mean it", and not "for tamper resistance against most people, but probably not well funded government agencies".

brandon272 12y ago
The title is off, but typically sensational. I wonder what disk encryption look like if you don't "mean it"?
- sleepychu 12y ago
  ceaser cipher
- DanBC 12y ago
  "Enclosed but not encrypted" is a nice article about bad encryption. http://www.h-online.com/security/features/Enclosed-but-not-encrypted-746199.html http://www.h-online.com/security/features/Enclosed-but-not-e... > A new generation of inexpensive disk drive enclosures using hardware encryption and RFID keys do not fulfil the promises of their publicity. The adverts claim 128-bit AES hardware encryption, but they don't tell us how it is used She does a nice write up.