I'm sure many of you have probably seen (online or in-person) the DEFCON 18 presentation, demonstrating what can happen if you steal a hacker's computer. For those who haven't, the link is below. It's quite an entertaining presentation.
(Warning: Video may be NSFW/NSFLE due to offensive language and some censored, full nudity.)
The video demonstrates how, after having his desktop computer stolen, one hacker used a combination of DynDNS updates and remote access services to recover the system and some data. However, as the presenter admits himself, this is only possible through leaving open what some may consider major security holes.
- The hard drive was not encrypted.
- The thief was able to use the system without authentication & authorization.
- Remote access services present a larger attack surface.
Had the system been secured more thoroughly, his data would have been very well protected. However, he would not have been as likely to recover the hardware. Hardware is something that directly equates to cold, hard cash. Data on the other hand, especially data that has been properly backed up to off-site storage, has less of a direct impact on one's bottom line - particularly for home users. In corporate environments, data theft can be a huge fiasco. However, for average Joe User, the risk can range from mild inconvenience to still-mostly-preventable identity theft, or just a general loss of some privacy.
How could one weigh the pros of hardware recovery against the cons of data loss, or vice-versa? Are there particular scenarios where each protection scheme particularly outweighs the other? Can there be a good compromise between the two - a scenario in which all of your data is tightly guarded, but your system is configured to be easily trackable?