Disk encryption is a special case of data at rest protection when the storage media is a sector-addressable device (e.g., a hard disk).
26
votes
7answers
30k views
Are there actually any advantages to Android full-disk encryption?
So, since Android 3, devices can perform boot-time, on-the-fly encryption/decryption of the application storage area (NOT the SDcard/removable storage) - essentially full-disk encryption. This ...
18
votes
6answers
888 views
What are the good use cases for disk encryption?
I've been researching disk/file system encryption, and on the surface it seems like a good idea for a lot of things. But as I dig further, the security it offers seems more mirage like than real.
...
16
votes
3answers
1k views
Are passwords in memory?
I have an encrypted HDD (dm_crypt). That's why I store my passwords in a simple text file. I usually copy/paste the passwords from it. Ok!
Q: If I open this text file then it goes into the memory. So ...
11
votes
2answers
5k views
Multi-boot with full hard drive encryption and pre-boot authentication
How would I set up a multiboot system which supports full hard drive encryption and pre-boot authentication.
I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. ...
10
votes
2answers
444 views
How to encrypt data on the server?
I have some data on the server (running Linux) which needs to be encrypted (company policy). This data is being served by an application running on this machine. Now I consider a few possibilities:
...
8
votes
5answers
5k views
How secure is NTFS encryption?
How secure is the data in a encrypted NTFS folder on Windows (XP, 7)?
(The encryption option under file|folder -> properties -> advanced -> encrypt.)
If the user uses a decent password, can this ...
8
votes
5answers
454 views
Encrypt Virtual Machine in the cloud
I am no expert when it comes to security in virtualized environments.
However a problem I always saw is: What happens if the host OS gets hacked and an attacker gains administrative privileges?
How ...
8
votes
3answers
859 views
What FDE (with hardware encrypted drives) for OS X works?
I'm trying to get all of our laptops doing FDE (as I'm sure lots of you are), and I've run into a problematic spot. Our Windows and Linux laptops are Dells, and they have some good BIOS integration ...
7
votes
4answers
2k views
What does Amazon's S3 Server-side encryption protect against?
Amazon's S3 storage service offers server-side encryption of objects, automatically managed for the user (Amazon's Documentation). It's easy to enable so I'm thinking "why not?", but what kind of ...
7
votes
2answers
1k views
For LUKS: The most preferable and safest cipher?
I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
6
votes
7answers
2k views
Physical computer security, how to disable USB ports when the computer is 'locked'?
Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
6
votes
6answers
508 views
How to protect data on a thumb drive
So I had a scare this past week (couldn't find my thumb drive) and figured I'd better put in some protection on my thumb drive.
What is the best way to encrypt the data on the thumb drive? I am a ...
6
votes
4answers
2k views
How effective is iPhone 3GS and 4 encryption?
My primary goal is to protect Activesync-based communication from being copied or stolen from an offline device.
In that context how effective is iPhone 3GS and 4 encryption?
6
votes
6answers
2k views
How secure is FileVault 2 while the computer is in sleep mode?
How secure is Apples disk encryption FileVault 2 when someone has physical or network access while the computer in sleep mode or is running a screen saver? Are there ways to circumvent FileVault 2 ...
6
votes
3answers
780 views
SSD (Flash Memory) security when data is encrypted in place
I'm surveying current techniques on flash memory security. I've learned that the non-in-place update of flash memories prevent us from adapting the same encryption techniques that we used on hard ...
6
votes
2answers
466 views
SSD Encryption - Difference between models
I understand that most SSDs which support encryption usually encrypt all data, but that only some actually encrypt the encryption key with a user BIOS password. This means that the models which don't ...
6
votes
2answers
562 views
Do Flash memory (SSD) architecture impacts encryption techniques?
I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique?
What are the problems I might ...
6
votes
1answer
1k views
loop-aes or dm-crypt for linux hard encryption?
loop-aes and dm-crypt are both used by partman-crypto for linux hard encryption, but dm-crypt needs no patch to kernel and is more supported.
dm-crypt keeps it's key on first hard block, is it a ...
6
votes
2answers
680 views
Is BitLocker on a virtual machine still FIPS 140-2 compliant?
BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance.
In a common setup, USB thumb drives can be used to unlock drives encrypted by BitLocker on startup.
...
5
votes
2answers
269 views
Erasing a hard-disk, encrypting it as alternative?
I was pondering about this, sometimes people ask me to erase data on their drive. So I use a shredding program, which takes a long time. However what if instead of shredding all the files, I'd just ...
5
votes
4answers
293 views
How do you guarantee that you don't lose a keyfile?
I am toying with the idea of adding keyfiles to various things I encrypt. However whats been keeping me from adopting them is garanteeing that I don't loose the keyfile while still keeping security.
...
5
votes
5answers
704 views
Is there any way to write-protect a USB or hide its contents from deletion without hardware modifications?
Data on external storage devices are not secure, I understand that. Despite hardware modifications they can still be hacked etc. However files can be hidden (steganography) or encrypted.
I'm ...
5
votes
3answers
896 views
Is it possible to infer that a hidden truecrypt partition is likely to be present
Truecrypt contains a feature that let's you create a hidden volume. It's said that it can't be proven if a hidden volume exists. However, is it possible to infer from the state of the data on the ...
5
votes
2answers
115 views
Full-disk encryption and theft mitigation?
Is it possible to combine the security of full-disk encryption (e.g. Truecrypt) with the honeypot-like performance of anti-theft tools (e.g. Prey)?
In other words, is it feasible to have both strong ...
5
votes
1answer
1k views
Using TPM for full disc encryption?
E.g.: Can I make a better full disc encryption with e.g.: LUKS using the TPM? How?
5
votes
1answer
839 views
Device versus file based encryption in TrueCrypt for a flash drive?
Are there security tradeoffs to be considered in deciding between encrypting an entire flashdrive with TrueCrypt versus storing a file encrypted container? The security goal is to be immune to the ...
4
votes
5answers
348 views
Encrypting a disk that has stuff on it?
Ok, so a pretty big disk ~1-2TB (90% full, multiple partitions + 2 operating systems on it), needs to be encrypted and zeroed-out, and it's a bit too much data for backing it all up before encryption. ...
4
votes
6answers
666 views
Is there any asymmetrically encrypted file system?
Is there a file system providing a directory where everybody can write, but only the directory owner can read the files? In theory it could be done by encrypting using the public key while writing, ...
4
votes
2answers
2k views
How expensive is it to guess a 15 character password, and should I be worried?
I'm currently using AES encryption (at home) on GNU/Linux (one of LUKS AES-256 variants with xts) and on Windows 7 (Truecrypt) with a 15 characters password (alphanumeric lowercase only plus _).
...
4
votes
1answer
301 views
How to encrypt an entire portable HDD, so that it cannot be read/written without the password for it?
I use a portable USB drive (Seagate FreeAgent Go Flex) to keep all my personal stuff, and though the HDD company does offer a password scheme to control access to it, that would work only on windows, ...
4
votes
2answers
239 views
Securing data on laptop's hdd
I was wondering which is the best way to secure/encrypt data in the hard disk on a laptop that runs Ubuntu Oneiric? Setting LVM encryption?
I am mostly concerned about having my laptop lost or what ...
4
votes
4answers
442 views
Are backups of truecrypt volumes with different pass phrases a security risk?
Lets say that I periodically change the pass-phrase on a truecrypt volume. The volume is regularly backed up, so my backup system has many copies of that volume, many of which have a different volume ...
4
votes
1answer
134 views
Accessing hidden partitons
I have two disks. They're both bootable and run Linux.
When I physically mount the disks, I can see scsi devices get added. /dev/sdb and /dev/sdc. However the partitions are not detected. I can't see ...
4
votes
3answers
149 views
Should a full disk encrypted hard drive on a live system be considered encryption at rest?
If you are specifying requirements that a certain classification of data be encrypted while at rest (on storage), should the requirement be considered met if the data is stored on an live (turned on) ...
4
votes
2answers
624 views
Have anyone tried to extract the encryption key from a SSD?
After reading this forum thread it does not sound like encrypted SSDs provide much protection at all - specifically encryption only occurs between the controller chipset and the NAND storage.
Why is ...
4
votes
2answers
243 views
Detect changes in /boot when using full disk encryption
When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
4
votes
2answers
1k views
Full disk encryption and multi-factor authentication
All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
4
votes
2answers
493 views
What cryptographic module does Sql Server 2008 use to run in Fips 140-2 compliant mode by default?
One can configure Sql Server 2008 to run in FIPS 140-2 compliant mode, in the same manner as running Bitlocker in FIPS 140-2 compliant mode. Which is to activate FIPS 140-2 compliant mode in the ...
4
votes
2answers
124 views
Can my /boot be compromised if I Suspend my notebook?
So if I use e.g.: LUKS, and I always suspend my notebook, then are there any methods to modify the unencrypted /boot? It contains the kernel!
Or if someone tries (evil maid) to modify the /boot then ...
4
votes
1answer
326 views
Can a Bitlocker To Go user pin be brute forced?
I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
4
votes
2answers
1k views
What does HP DriveLock do to your password?
While looking at various hard drive encryption methods, I discovered that HP's "DriveLock" is not quite the standard ATA security system. While I did get confirmation from HP that it does indeed use ...
3
votes
3answers
720 views
Securing my USB flash drive with Truecrypt and FreeOTFE
I want to know if I encrypt my flash with Truecrypt "Encrypt a non-system partition/drive" option and then mount it and then make a container with FreeOTFE on the Truecrypt encrypted drive and then ...
3
votes
3answers
253 views
Encrypting an email server's local drives or filesystems
Planning to deploy a remote hosted mailer (Zimbra based) I need to make sure the local data on the machine is encrypted. Currently, the plan is to use the built in LUKS to encrypt /opt/zimbra and ...
3
votes
2answers
1k views
Truecrypt hidden partition deleted original drive data
Help! I created a hidden partition within a harddrive encrypted using truecrypt, and instead of creating a second partition, it seems to have deleted all of my data instead. what did i do wrong? I ...
3
votes
3answers
587 views
Are there any hardware encryption solutions for my notebook?
I have a HP 6510b notebook.
Are there any solutions for hardware encryption? I mean I don't want to use software encryption like LUKS, but I don't want that that if my notebook gets stolen the ...
3
votes
3answers
1k views
TrueCrypt -vs- MacOS encrypted sparse image - equally secure? Other alternatives?
I'm currently trying to find my personal best solution for storing passwords and other sensible data. Recently I've used 1Password on iPhone and Mac but I'm not really satisfied with its predefined ...
3
votes
1answer
254 views
Full Disk Encryption within a VM, how secure is it?
Just a quick query on basically how to secure a VM for a home computer for a number of uses (such as securing work related data in a good enough fashion whilst in its native environment).
I'm not ...
3
votes
2answers
135 views
Remedy for not having filled the disk with random data?
Filling a large HDD with /dev/urandom prior to encryption can be extremely slow (even with netcat, multiple instances in parallel, etc) and for this reason I'm sure a lot of users skip this advice ...
3
votes
1answer
98 views
Is this a security risk for us to lost TPM or others to access to reset BIOS ?
In the previous post Physically secure the system case it is recommended to physically protect the system. But in case stolen laptops where intruder have physical access to TPMs. What are the security ...
3
votes
1answer
98 views
Recognizing PGP-encrypted disks
I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS.
I am interested to know how an encrypted partition/disk/file with a particular ...
