Tag Info

New answers tagged

1

Disclaimer, my info is old, I haven't tried this in a while. If the disks support hardware based FDE or Bulk Data Encryption, and you have an integrated lights out or similar capabiltiy on your server, you can try booting to this utility and executing a secure erase. http://www.fitzenreiter.de/ata/ata_eng.htm (not free for commercial use, etc.) If I ...


0

Keep in mind the key to measuring security is not just entropy of the password, but the weakest link in the chain. In this case, physical security of the computer plays a part in addition to if the machine is on a windows domain. It is fairly trivial to reset any windows password using Trinity provided that you can mount a DVD in the drive and reboot the ...


5

I would still choose TrueCrypt for a matter of trust and the "many eyes" theory: After the "TrueCrypt scandal" everyone started looking at the source for backdoors. Currently there is an audit going on for TrueCrypt. Although they haven't finished yet and they have found vulnerabilities on the bootloader-full-disk-encryption feature, there is no evidence ...


1

This is a valid question. I believe the OS was originally created to be booted onto a cd/dvd and act as throw away media, that could be used in conjunction with a securely encrypted thumb drive for storage. There are methods you could use, infact LVM over LUKS encryption comes to mind (and sounds alot like what you're asking for) for full system (minus ...


3

Disk encryption requires the host to keep or derive a master key which is kept somewhere in memory so that's your biggest issue. I've implemented aspects of the SafeNet ProtectFile product and other smart-card stacks so I'm intimately aware of the challenges. Don't for a minute think you have any real security. There are "digital forensic devices" that ...


-1

I see two points: you can set a PIN for Smartcards to unlock. Unlike passwords, this PIN can't be offline brute-forced, as long as the smartcard isn't opened and modified. It has protections built in to prevent this. They are not impossible to break, but they offer very good protection. It depends on the configuration of the smartcard itself, but most ...


28

A smart card works by keeping a secret hidden and answering a challenge that proves it has the secret. It, theoretically, should never reveal that secret to anyone and it should be unrecoverable. There are some technical ways you might be able to get around it, but most of them are destructive to the card. This means you know if your smartcard has been ...


19

It's (theoretically) harder to duplicate a Smart Card. You can duplicate a USB drive easily. If I steal both, you are equally in trouble, but if I steal the USB, duplicate it, then replace it without you knowing, then you are in trouble and you don't know it.


0

I guess it depends on what your threat model is, if the NSA are after you as a person of interest, full disk encryption is the least of your problems, you should probably just stick to a one time pad and abacus. If you want to keep a potential thief from accessing your documents if your laptop should get stolen, any of the closed source full disk encryption ...


0

There's no real answer to that question other than that you cannot completely trust anything you didn't put together yourself. It's unfortunate, but true. I am certain there are many other available open-source options for WDE, which may allay some of your fears in trusting a company. Then again, some open-source software has been compromised by ...


1

There were many systems... you can find some references from the Wikipedia page. The core idea is always the same: make a "special" floppy disk such that it exhibits a peculiar behaviour that can be tested for, but not reproduced, with stock floppy disk drives. For instance, make tracks a bit thinner than normal, which allows you to put a bit more data on ...


0

Sounds like you've already got a handle on how it works (similar methods are still used to day for DVDs - over and above CSS). If you use the OS tools to try to read the device they will try to reconstruct a stream, but the programs actually used to read content, read individual sectors and either fail softly or skip sectors which have been deliberately ...



Top 50 recent answers are included