Tag Info

New answers tagged

0

This is equivalent to an evil maid attack, which compromises the (unencrypted) bootloader to capture your FDE password the next time you start your computer. This assumes the bootloader is kept on the same drive. If that's not the case (for example if you keep your bootloader on a removable drive) and you explicitly configure your computer to not boot from ...


1

In addition to Polynomial's answer it's worth noting that the network interfaces will still be up and active and any access through that route (shares, remote management services etc.) may permit access to stored data regardless of screen locking. Either remote network sessions, or someone plugging in a device to your network ports could provide a surprising ...


3

No, it's not secure. You're vulnerable to: Cold boot attacks (freeze memory and extract the contents, get BitLocker encryption keys and all your other sensitive data) DMA attacks via FireWire, CardBus, ExpressCard, Thunderbolt, etc. Installation of a physical keylogger (many laptop keyboards can be easily removed) or backdoor hardware. In general, if an ...


0

First off, there are ways to mount encrypted partitions without having to enter the passphrase manually or storing it on the system that is being protected. Look at Mandos for one example of this; it's basically a client/server application that stores the key to unlock the encrypted container separate from the container itself. An attacker would at the very ...


1

I recommend locking down GRUB and taking away access to the GRUB shell. GRUB manual: Authentication and authorisation (Archived here.) By default, the boot loader interface is accessible to anyone with physical access to the console: anyone can select and edit any menu entry, and anyone can get direct access to a GRUB shell prompt. For most systems, ...


2

This is normal. It's how EFS works. Although it is common to refer to file folders with the encryption attribute set as “encrypted,” the folder itself is not encrypted. When encryption is set for a folder, EFS automatically encrypts all new files created in the folder and all files copied or moved into the folder by using My Computer. (Source: ...


53

You’re misunderstanding what BitLocker is supposed to protect against. The goal of BitLocker is to protect your data from cold boot attacks (as explained in a Technet blog entry). When you unlock a volume protected by BitLocker, the system gains access to the keys necessary to decrypt the drive and behaves as if it was a regular drive. That is necessary to ...


20

Once you enter your password the drive behaves just like any other unencrypted drive, as the encryption becomes transparent to the OS. If you share your drive and other users/computers have the required permissions to access it, they will be able to do so and won't even know the drive was encrypted. Full disk encryption is designed to protect from offline ...


2

To use the kernel's crypto module to initialize the partition/disk do this: cryptsetup create --key-file=/dev/urandom eraseme /dev/sde dd if=/dev/zero bs=1M of=/dev/mapper/eraseme cryptsetup remove eraseme This initializes a crypto mapping named eraseme spanning the partition/disk using data from /dev/urandom as the key. Writes zeros to the mapping and ...


1

I think the following four approaches more or less cover all possibilities for what could be done: Use an expensive (in terms of CPU time) key derivation function. However slowing down the attacker by any factor this way will slow down legitimate attacks by the same factor. And realistically the attacker will be able to use more CPU power than is present ...


47

Chip-based banking cards typically use a 4-digit PIN. It would take at most a few hours to try them all if the card didn't protect against brute force attempts. The card protects against brute force attempts by bricking itself after 3 consecutive failures. The adversary does not have access to a hash of the PIN (there are physical protections in the card ...


2

Generation of a key and use of a pass-phrase is two different things. Keys, for example in asymmetric cryptography, are generated using entropy coming from the computer environment (like /dev/urandom, which might or might not be a good entropy source, but that's another debate). So the key itself has nothing to do about the pass-phrase. The pass-phrase will ...


2

I don't know if this is how Android does it, but a hardware-backed secure storage device can block repeated attempts that are made too quickly, making your assumption of 0.1 guesses per second invalid. Suppose it initially allows one attempt every 0.01 of a second, but it doubles the time between attempts with each failure after the first five. After a mere ...



Top 50 recent answers are included