0

So I'm installing macOS to my external hard drive partition, so I can have a 100% clean environment where I can engage with cryptocurrencies. (Exchanges, stable coins, protocols, putting actual money into various stuff)

Google says if I encrypt the disk partition, it won't boot up. (Rest of the disk is encrypted)

Which makes me question: Is this going to be safe?

Anyone can just plug the disk in to see the files in this un-encrypted partition of the disk, no? I'd have my login credentials stored encrypted but still its like having a laptop whose disk isn't encrypted AND without a login passport. Is this safe for my purpose? I don't trust 2FA of exchanges (heard of tons of people who got their funds stolen from exchanges despite properly setup 2FAs)

Improve this question
4
  • WRT, 'heard of tons of people who got their funds stolen from exchanges despite properly setup 2FAs' - Yes, this is true. One infamous example is MtGox, but there are many more. This is why you should store your own cryptocurrency, using a 'cold storage' address that you generate offline and that you control, as opposed to allowing the exchange to store your cryptocurrency.
    – mti2935
    May 8, 2022 at 2:23
  • This is not hard to do if you boot your computer from an ISO on a live-boot USB, and run a portable web-based wallet like coinb.in from another USB. If there is malware on your hard drive, it won't matter, because the system will not even mount your hard drive when you boot it from the live-boot USB. Then, you can go ahead and create an address, and store your private key on another USB, without ever enabling networking on the computer. This way, the USB containing your private key never touches a networked computer. That's an effective way to store your coins in cold storage.
    – mti2935
    May 8, 2022 at 2:43
  • @mti2935 can you do cold storage thing while putting money into something like ust with anchor protocol so you get paid 19%/yr? How would you take your money out in that case? (safely and quickly)
    – user277849
    May 8, 2022 at 12:36
  • I don't know much about these newfangled coins. But, with bitcoin, ethereum, etc. - Yes. You simply do what I described above, then buy the coins through the exchange, then immediately send them to the cold storage address. Then, just store the USB containing the private key someplace safe. When you want to spend the coins, just boot the computer using the live-boot USB, then run the wallet to create a transaction (signed using the private key). Then copy the transaction to another computer with a network connection, and just upload the transaction.
    – mti2935
    May 8, 2022 at 13:02

1 Answer 1

Reset to default
1

The point of encrypting the disk is so that data at rest can't be accessed. In other words, if the disk is physically stolen or tampered with (evil maid attack), or some malware tries to use or modify the connected disk when you intend it to be offline, encryption can make stolen hardware useless and tampering impossible.

If you don't have issues with physical security and you physically disconnect the disk when you don't want it accessed, then encryption doesn't increase your security.

If you don't encrypt the operating system volume and it is either physically tampered with or you leave it plugged in with another OS booted, it is possible someone or something could inject malware into it, which could affect your encrypted data next time it is accessed with that volume.

It is difficult to impossible to encrypt all of a disk, because if the boot pieces are encrypted, the firmware won't be able to boot the volume unless there is a mechanism to provide a decryption password to the firmware. On a PC, things like secure boot and TPM are used to verify unencrypted (but signed) boot pieces before booting them. Apple supports something similar, but I'm not aware of how it works.

All of this is independent of any security issues that might occur with a cryptocurrency exchange, and likely will not improve that situation.

Improve this answer
3
  • I have issues with physical security. So I guess I must partition the disk inside the macbook, so disk can be encrypted.... or I should format everything and do a clean install and NEVER install something from github or something from non-App Store? That would not be a good user experience in the long run
    – user277849
    May 8, 2022 at 12:42
  • Its a matter of risk management. What is the likelihood of the risk? What is the consequences of the risk occurring? Do the costs of mitigating the risk exceed the cost of the risk occurring? Now apply that: what is the likelihood of specific github or other apps not from the apple store containing malware and how much will it cost to not use those apps?
    – user10489
    May 8, 2022 at 16:49
  • @user277849 You might want to consider an approach whereby you keep your build as lean as possible on your every-day driver - just bare-bones build with just the essentials installed. This way, you can be reasonably sure that your system is not infected with any malware. When you want to play with something from GitHub or from another source where there is a greater chance of downloading an infected file - use a vm, or boot your computer from a live-boot USB specifically for this purpose.
    – mti2935
    May 9, 2022 at 0:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .