Tag Info

New answers tagged

1

Disk encryption requires the host to keep or derive a master key which is kept somewhere in memory so that's your biggest issue. I've implemented aspects of the SafeNet ProtectFile product and other smart-card stacks so I'm intimately aware of the challenges. Don't for a minute think you have any real security. There are "digital forensic devices" that ...


0

I see two points: you can set a PIN for Smartcards to unlock. Unlike passwords, this PIN can't be offline brute-forced, as long as the smartcard isn't opened and modified. It has protections built in to prevent this. They are not impossible to break, but they offer very good protection. It depends on the configuration of the smartcard itself, but most ...


24

A smart card works by keeping a secret hidden and answering a challenge that proves it has the secret. It, theoretically, should never reveal that secret to anyone and it should be unrecoverable. There are some technical ways you might be able to get around it, but most of them are destructive to the card. This means you know if your smartcard has been ...


16

It's (theoretically) harder to duplicate a Smart Card. You can duplicate a USB drive easily. If I steal both, you are equally in trouble, but if I steal the USB, duplicate it, then replace it without you knowing, then you are in trouble and you don't know it.


0

I guess it depends on what your threat model is, if the NSA are after you as a person of interest, full disk encryption is the least of your problems, you should probably just stick to a one time pad and abacus. If you want to keep a potential thief from accessing your documents if your laptop should get stolen, any of the closed source full disk encryption ...


0

There's no real answer to that question other than that you cannot completely trust anything you didn't put together yourself. It's unfortunate, but true. I am certain there are many other available open-source options for WDE, which may allay some of your fears in trusting a company. Then again, some open-source software has been compromised by ...


1

There were many systems... you can find some references from the Wikipedia page. The core idea is always the same: make a "special" floppy disk such that it exhibits a peculiar behaviour that can be tested for, but not reproduced, with stock floppy disk drives. For instance, make tracks a bit thinner than normal, which allows you to put a bit more data on ...


0

Sounds like you've already got a handle on how it works (similar methods are still used to day for DVDs - over and above CSS). If you use the OS tools to try to read the device they will try to reconstruct a stream, but the programs actually used to read content, read individual sectors and either fail softly or skip sectors which have been deliberately ...


3

No risk at all. A login prompt is only for preventing physical access to the computer. This protection role has been replaced by the FDE and the accompanying PBA (which is much more secure), so any attacker that would break or somehow bypass the FDE could bypass your OS login too. However, running as a limited user (with autologin on) and having a ...


0

If you want a "safe" solution, one where Windows does not offer to format the disk when you try to mount it, you need to use a format that is recognized by Windows. You could install Ext4 drivers on Windows, but this will only work for those machines with these drivers installed. You could use FAT32 or NTFS for the disk, and use Encfs or Truecrypt or ...


1

I don't think you understood what Windows did when it formatted the disk. When you plugged in the external drive, Windows couldn't read the filesystem (because it's encrypted) it therefore assumed the drive had no filesystem and offered to format the drive. You selected yes. Windows then deleted everything on the drive and overwrote it with a clean NTFS ...


1

Another option is to look at truecrypt's successors, like Veracrypt (https://veracrypt.codeplex.com/). They use Truecrypt as a base but claim to add some additional security improvements. Of course since they're new it still remains to be seen whether these projects will be able to support themselves in the long term and whether they'll remain secure, so ...


1

You can use dm-crypt drives, which have windows support as documented here: http://superuser.com/questions/584883/how-can-i-access-volumes-encrypted-with-luks-dm-crypt-from-windows


0

By principle (whether you are encrypting the disks with LUCKS or whatever), once you type in your passphrase the disks are decrypted and your security will no only depend on the security of your network.


0

To decrypt your data the person would need to compromise your system. If the person who compromised your system managed to run a keylogger or another program with admin rights on your system he could preform a memory(ram) dump and extract encryption keys from your computer. Keylogging your system or preforming a memory dump would lead to decryption of your ...


2

In the perspecive of online-attacker, then FDE is nothing. FDE is designed to protect against a offline attacker who copies your drive or steals your computer. Once the FDE is "unlocked", it will be accessible, regardless of if the computer OS is locked (Win+L) or whatever. The only thing that can protect against online attacker is good security in the form ...


1

On software encryption vs hardware encryption, read this comparison on Kingston's website, and your choice may be easy, but this is marketing language. I'm quite sure that Open Source software encryption like GPG is more secure. See this question: Is hardware based disk encryption more secure that software based?. The basic question is: from who do you ...


-1

Right from the project maintainer ... (credit to this thread) VeraCrypt not only enhances security over the original TrueCrypt through an increased iterations count, but it also solves all the serious security issues and weaknesses discovered so far in the source code. A good list of these weaknesses can be found in the ...


2

Only through code review and testing. Changes in iterations may indeed make those areas of the code more resilient to brute-forcing, but iterations are only a part of the overall architecture that needs to be considered.


0

Ubuntu is Debian based so this post might be relevant. Also I believe the default program for Debian is LUKS I believe you have an option of which algorithms to use. I believe RC4/AES with SHA256 is standard. How to re-encrypt disk with different password (standard Debian) How secure is LUKS? | A look at LUKS disk ecnryption Yes the entire drive is ...


6

Boot Process Secure Boot There are quite a few steps to booting Windows 8. Now secure boot in general means that the boot loader is only run if its integrity can be checked. In this case, if enabled, the UEFI is started before anything else and checks that the boot loader is signed by a trusted Certificate Authority. For an operating system generally ...



Top 50 recent answers are included