Encryption while logged in

Question

If I'm using full disk encryption on my home computer, and it's online, are the hard drive contents encrypted when I'm logged in and using the machine (from the perspective of an online attacker - no physical access - would only see encrypted data)? Similarly, what about when the machine is locked?

Answer 1

In the perspecive of online-attacker, then FDE is nothing. FDE is designed to protect against a offline attacker who copies your drive or steals your computer. Once the FDE is "unlocked", it will be accessible, regardless of if the computer OS is locked (Win+L) or whatever. The only thing that can protect against online attacker is good security in the form of firewalls, IPS and anti-virus software. The only way you can "lock" a FDE is to shut down the computer fully. Even Bitlocker wont "lock" when your inside Windows, only bitlocker does, is to ensure the boot path is uncompromised Before allowing decryption (secure boot + TPM), thus preventing circumventing the windows login process. If there security holes allowing online access to your data while your computer is logged off or locked, then your'e busted anyways.

Also encryption of indivual files is a good protection, provided you dont get a keylogger. Then you are smoked anyways. The most secure way you can protect a file against online-access, is to store it on a USB memory that is normally NOT connected to computer. Of course, you need to check everytime your computer is NOT compromised Before connecting this USB-drive. For the paranoid, I would suggest booting in a known secure OS, for example a OS that is placed inside a USB memory with a physical read-only button, or a live-CD. You dont need to encrypt the file if your threat scenario does not include offline attackers.

Answer 2

To decrypt your data the person would need to compromise your system. If the person who compromised your system managed to run a keylogger or another program with admin rights on your system he could preform a memory(ram) dump and extract encryption keys from your computer. Keylogging your system or preforming a memory dump would lead to decryption of your data.

Answer 3

In principle (whether you are encrypting the disks with LUKS or whatever), once you type in your passphrase the disks are decrypted and your security will no only depend on the security of your network.