Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).

learn more… | top users | synonyms

0
votes
0answers
4 views

Is automatic login with full disk encryption a risk?

I use full disk encryption on Linux and wonder whether there is any security risk ob having automatic login. In case somebody breaks the encryption of the drive, they can read all the data directly, ...
3
votes
4answers
84 views

How do I encrypt external drive with Password which is compatible with both Linux and Windows?

I wanted to encrypt my external drive with password, which is compatible in both Linux and Windows. Truecrypt is an option. But the development of it is stopped few months back. I came across ...
2
votes
3answers
38 views

Encryption while logged in

If I'm using full disk encryption on my home computer, and it's online, are the hard drive contents encrypted when I'm logged in and using the machine (from the perspective of an online attacker - no ...
3
votes
1answer
83 views

Hardware encrypted external HDDs

I'm planning to buy an external HDD with hardware encryption, namingly the WD My Passport Ultra 2TB. On the WD website the information about the encryption is sadly scarce so I'm asking here. How ...
1
vote
2answers
489 views

Why is VeraCrypt more secure than TrueCrypt?

TrueCrypt retired with a mysterious "Using TrueCrypt is not secure as it may contain unfixed security issues" (source) Yesterday Slashdot reported VeraCrypt as a better replacement (source) since it ...
5
votes
1answer
82 views

Secure Boot on Microsoft Surface Pro 3 (or modern PCs)?

Got a Surface Pro 3 today (it's awesome BTW!) and noticed in it's EFI that it's got TPM enabled, "Secure Boot" enabled (unsure what such an umbrella/catch all term actually covers) And then in ...
0
votes
1answer
34 views

Debian encryption is as safe as Truecrypt. Is this correct?

When I try to install latest debian to my pc, the wizard ask me to input a password to do FDE(full disk encryption). My questions are: What algorithm does Debian use? (Truecrypt = AES) Can I change ...
-1
votes
1answer
72 views

The best full disk encryption for Windows 8? [closed]

What is the best full disk encryption for Windows 8 now when TrueCrypt is not supported anymore? BitLocker needs Windows 8 Pro and that is quite expensive. And I don't trust Microsoft that much I ...
3
votes
0answers
35 views

Linux, TRESOR and XTS

I want to switch from using LUKS for full disk encryption to TRESOR. TRESOR tries to prevent cold boot attacks by storing the encryption key in the CPU's registers. It uses the kernel's crypto API for ...
-3
votes
0answers
80 views

What's the best free encryption alternative after Trucrypt has been discontinued? [closed]

I've been reading about a couple of promising TrueCrypt forks (VeraCrytp and CipherShed). Is there anything else you would recommend? Or which one to choose among the two?
37
votes
2answers
17k views

How secure is Ubuntu's default full-disk encryption?

How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it? If someone could at least provide a link to some documentation or article regarding that ...
1
vote
0answers
26 views

Full disk encryption on CentOS 6x - FIPS 140-2 compliant?

I'm using CentOS 6.5 on an existing server and am researching encryption options for compliance. SEDs are out since the controller in this older machine will not support them. That leaves full ...
2
votes
1answer
25 views

Security implications when setting the discard option in /etc/crypttab

Setting the discard option in /etc/crypttab has security implications. From the man page: Allow discard requests to be passed through the encrypted block device. This improves performance on SSD ...
1
vote
3answers
156 views

Samsung SSD 840 Evo Disk-Encryption

My question relates to the hardware encryption of samsungs 840 Evo SSD (maybe also other models): The theory: Samsung specifies that their SSD encrypts each data with AES by default. So if I choose a ...
8
votes
2answers
1k views

How does Android filesystem encryption work?

I'm interested in encrypting my Android devices for security in the (hopefully will-never-happen) event of the phone being recovered by an unknown/unauthorized person. How does Android filesystem ...
0
votes
2answers
43 views

How to decide whether to password protect key files in addition to full disk encryption

It is customary to protect certain critical files with a password. For example: PGP keys, VPN keys, password managers, etc. The practice dates back to before full disk encryption being common. These ...
2
votes
2answers
285 views

Using a TPM with Linux

I have the need for a company laptop (Dell e6540) that contains our java application on it to go out for evaluation purposes. For this reason I would like to make sure that the HDD is protected from ...
3
votes
2answers
798 views

Possible implementations of networked+encrypted filesystem

Is it possible to implement scheme where remote server just share its filesystem (or resizable container file in it) and it's locally encrypted and mounted? And what is best practical method? (On ...
0
votes
1answer
79 views

XTS vs AES-CBC with ESSIV for file-based filesystem encryption

In a blog post I recently read called "You Don't Want XTS," the author explains some of the pitfalls of using XTS to encrypt filesystems. Specifically, he recommends against ever sharing encrypted ...
0
votes
2answers
115 views

Store a file on a harddisk without root having access to it

Is there a way to store a file on a disk as a user so that even the root user has no access to it? I tried EncFS but that is no solution because the root user can switch to every user, so he/she can ...
1
vote
2answers
113 views

What happens after setting up HDD password?

I am wondering what happens when I set HDD password in my laptop (Samsung with ssd). I mean a given case. I have been having working system without any password. Then one day I decide to set up HDD ...
3
votes
2answers
126 views

Can full disk encryption make malware recovery more difficult?

Let us say that we have a computer with a fully encrypted disk. If it gets infected with malware, does this make it more difficult to use a LiveCD or other rescue option to clean it or restore it? It ...
0
votes
1answer
92 views

Securely wipe external drive with Windows only [duplicate]

Consider following 2 disk wipe procedures, using only vanilla Windows installation: First do a quick-format to make the disk appear empty, then do one of these: Just do full format of the disk. ...
34
votes
5answers
8k views

Are there any reasonable TrueCrypt forks?

Unfortunately, TrueCrypt may have been discontinued yesterday. I use LUKS on Linux, but I liked the fact that with TrueCrypt I had a portable solution across Windows, Mac, & Linux. TrueCrypt ...
5
votes
4answers
4k views

TrueCrypt -vs- MacOS encrypted sparse image - equally secure? Other alternatives?

I'm currently trying to find my personal best solution for storing passwords and other sensible data. Recently I've used 1Password on iPhone and Mac but I'm not really satisfied with its predefined ...
1
vote
1answer
795 views

Encrypted LVM as an alternative to TrueCrypt

In a weird announcement on the TrueCrypt page it says that the software is unsafe so we should migrate to BitLocker. If it is a prank it's sure not funny especially when it comes to data. Since I ...
6
votes
1answer
888 views

Are there other ways to encrypt files other then TrueCrypt and BitLocker [closed]

I don't trust BitLocker. Probably backdoored and relies on TPM which can be hacked according to DEFON. It also does not allow for hidden partitions or other advantages like TrueCrypt. With TrueCrypt ...
6
votes
7answers
5k views

Physical computer security, how to disable USB ports when the computer is 'locked'?

Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
2
votes
1answer
510 views

Is Dual Factor possible during boot with whole disk encryption on Mac FileVault 2

Mac FileVault 2 is the default disk encryption for newer Macs that occurs in the EFI pre-boot phase. The challenge here is that most smartcard drivers are loaded after the OS loads. Is anyone aware ...
0
votes
2answers
169 views

I need two separate hidden volumes in disk encryption. What are my options? [closed]

C: for system (Windows) D: for my files Makes much more sense to me than packing everything on the same volume, right? Is there a disk encryption utility capable of doing this? I don't know much ...
0
votes
1answer
124 views

Secure distributed storing and querying of [medical] data?

Comparing ways of distributing and securely storing and querying structured and schemaless data. Currently I am using MongoDB, but am looking into (Postgres|MySQL)&CryptDB, Cassandra and others. ...
0
votes
2answers
133 views

Ubuntu LVM LUKS Encryption

I've been reading about Ubuntu LVM Encryption, and I understand that it supports the use of Linux Unified Key Setup (LUKS) during installation, which is a block level encryption that encrypts the ...
2
votes
1answer
133 views

Decrypting FDE in Disaster Recovery

I saw a hot network question on SE, about Workplace Ethics - Do I give my password at work to my old boss after quitting?. My initial response (as are the answers in that question) is always NO. The ...
10
votes
2answers
3k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
1
vote
2answers
50 views

What is the security benefit of Per-File Encryption key architecture?

Are there any security benefits to having a different key(it is encrypted by a master key and that encrypted key is included in the metadata for the file) used to encrypt each file versus just one key ...
2
votes
1answer
227 views

Field-level encryption vs disk encryption for PCI compliance

We are in the process of setting up a PCI compliant server (with Firehost's help). We are using MongoDB as our primary database. I am having some concerns about the encryption, though. Are there any ...
3
votes
2answers
2k views

TrueCrypt vs “native” whole-disk encryption on Linux?

When preparing to encrypt an entire partition, is it better to rely on "native" whole-disk encryption (eg following this tutorial), or an external tool like TrueCrypt? The wikipedia article comparing ...
2
votes
2answers
164 views

How to encrypt entire HDD without any password prompts?

Before you dismiss this as silly, let me explain :) The only purpose of this encryption is to make the data inaccessible if the drive breaks down and I want to send it off for warranty replacement. ...
3
votes
0answers
856 views

OPAL Hardware Encryption on Linux [closed]

I recently bought a laptop with an SSD which complies with the Self encrypting Drive OPAL specification. I was offerd to setup encryption while installing Linux, but my guess was that this was going ...
16
votes
4answers
949 views

Is it possible to boot an encrypted server remotely and securely?

Imagine you have a server that is at a location which is not trustworthy. People might have physical access to the machine who are not supposed to look at the data stored on it. In this scenario I ...
11
votes
5answers
12k views

How secure is NTFS encryption?

How secure is the data in a encrypted NTFS folder on Windows (XP, 7)? (The encryption option under file|folder -> properties -> advanced -> encrypt.) If the user uses a decent password, can this ...
3
votes
2answers
672 views

How To Recover EFS Cert From Backup?

I made a backup of the old Win 7 Pro then did a clean install. But I forgot to export my EFS encryption certificate, so when after I restored the encrypted files from backup I could no longer access ...
1
vote
1answer
133 views

What does hardware full disk encryption imply?

I read the wikipedia article and few others, however I still don't have some things clear. The main question would be what does hardware full disk encryption imply for the user, however I have more ...
2
votes
1answer
117 views

Self-encrypting drives, certification for tamper-protection?

Consider a drive with Opal 2.0 support that works with Microsoft Bitlocker's "eDrive" feature. In this case, supposedly, the encryption key never leaves the disk (which might increase security, ...
1
vote
2answers
109 views

How to use ESSIV to avoid seeing repeated patterns?

I'm trying to implement an encrypted file-system. The file-system consists of 512-byte sectors. I encrypt/decrypt the contents of a sector as follows: Compute the SHA256 sum of the user password. ...
1
vote
1answer
176 views

Trusted Platform Module, daughterboard vs onboard TPM?

In many cases where a Trusted Platform Module (TPM chip) is employed, it is soldered directly onto the motherboard. Ostensibly the motherboard manufacturer is then solely responsible for integrating ...
1
vote
2answers
61 views

Hardware Dependent Encryption [closed]

I am looking for a Linux based encryption system (like Truecrypt) that has the ability to do the following: Encrypt a partition or external drive that it can only be read from the same computer ...
9
votes
7answers
2k views

Encrypt Virtual Machine in the cloud

I am no expert when it comes to security in virtualized environments. However a problem I always saw is: What happens if the host OS gets hacked and an attacker gains administrative privileges? How ...
8
votes
7answers
1k views

Is there any asymmetrically encrypted file system?

Is there a file system providing a directory where everybody can write, but only the directory owner can read the files? In theory it could be done by encrypting using the public key while writing, ...
9
votes
3answers
841 views

Is it possible to prevent a physical attack on full disk encryption?

I've been researching into some methods to ensure that disk encryption keys can't be stolen, and one that I've come across is called TRESOR. With this kernel patch, you can create a partition that is ...