Skip to main content
110 votes

How to prevent a hosting company from accessing a VM's encryption keys?

You can't, plain and simple. If you don't trust the hosting company, you don't host with them. This is law #3 from 10 immutable law of security: Law #3: If a bad guy has unrestricted physical ...
Lie Ryan's user avatar
  • 31.5k
84 votes
Accepted

How can Android encryption be so fast?

Encryption happens in memory, not on the disk. You are misunderstanding how disk encryption works. It does not read the entire disk and replace it with a decrypted version. Rather, when a file or ...
forest's user avatar
  • 67k
74 votes
Accepted

Is it possible to tell if hard drive is encrypted?

We have two types of encryption here, "file based encryption" and "full disk encryption". There are documented forensics methods and software (e.g. EnCase) that help us detect the schemes and programs ...
Silverfox's user avatar
  • 3,417
74 votes
Accepted

Aren't keyfiles defeating the purpose of encryption?

If decryption only relies on the keyfile and this keyfile is readily available, there is indeed no significant security benefit in your setup. What you can do though is store the keyfile on a ...
Demento's user avatar
  • 7,495
63 votes
Accepted

Is a password-protected stolen laptop safe?

Is a password-protected stolen laptop safe? No. The immutable laws of security say: Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. It doesn'...
anion's user avatar
  • 1,117
57 votes
Accepted

Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?

No, Elcomsoft cannot break LUKS or Veracrypt. What they do is to guess the password. Any password-based encryption mechanism can be broken by guessing the password: this is not a flaw in the ...
Gilles 'SO- stop being evil''s user avatar
49 votes

How can Android encryption be so fast?

It doesn't decrypt the full disk at startup. Instead, it continously decrypts data as it is read from the disk when it is read from the disk, leaving the actual content on the disk untouched and ...
Anders's user avatar
  • 65.7k
47 votes
Accepted

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

At a high level, disk encryption is implemented using a data encryption key (DEK) and a key encryption key (KEK). The DEK is generated randomly and used to encrypt the drive, the KEK is derived from ...
AndrolGenhald's user avatar
45 votes
Accepted

Erased encrypted HDD, then secure erased 10% of it before selling it - is it safe?

Has the data been securely erased beyond any doubt? No. Does it matter in practice? Probably not, at least for any sensible domestic/company threat model. For the purposes of this answer I will ...
Polynomial's user avatar
  • 135k
44 votes

Is looking for plain text strings on an encrypted disk a good test?

No, this is not a good test, not at all. If you do the same with a zip file, or a docx, or a PNG, you won't see text strings, but the file is not encrypted. Not being able to see plaintext does not ...
ThoriumBR's user avatar
  • 54.6k
39 votes
Accepted

Why is it possible to bypass Android full disk encryption?

You seem to be confusing two different security features that are intended to protect against two different types of attacks. The three attacks you mentioned are to bypass the lock screen of the phone,...
Moshe Katz's user avatar
  • 1,370
38 votes
Accepted

Is laptop "secure sleep" mode theoretically possible?

Yes. It could be easily achievable, although it would require kernel support do this properly. In the suspend-to-RAM case, the key should be deleted from the RAM, and in the suspend-to-disk case, ...
peterh's user avatar
  • 3,030
22 votes

How to use FDE without needing to share the encryption password

It comes to this: You want to implement a DRM scheme. Many before you have tried, all of them failed. It is not possible to give something (hardware, data) to users and prevent them from using it in ...
Josef's user avatar
  • 5,993
21 votes

Is a password-protected stolen laptop safe?

Just to add a very simple answer here, I regularly boot a linux live cd/usb on friends' computers who have done something weird and need to recover files, and simply copy them over to an external ...
Tasos Papastylianou's user avatar
21 votes

Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?

While LUKS offers strong protection against brute force attacks by using thousands of iterations of a hash function during key derivation, we have significant advances in password recovery attacks ...
vidarlo's user avatar
  • 16.6k
19 votes

Full disk encryption vs home folder encryption - why should the former be chosen over the latter

I recommend Full Disk Encryption everywhere. Home folder encryption will cover a lot, but there are a few points missing: Data outside of home Some programs will write things on /tmp, log files are ...
ThoriumBR's user avatar
  • 54.6k
19 votes
Accepted

How to use FDE without needing to share the encryption password

According to my previous answer, suggestion by @logneck and a bit of google-fu, I came to the conclusion that it is possible to implement the scheme requested in the question with available tools and ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
18 votes

Is laptop "secure sleep" mode theoretically possible?

This would be a case for choosing Hibernate options over sleep. Sleep needs to keep the memory active, which allows for a quick boot; in sleep mode, the machine isn't completely off. In hibernate ...
ISMSDEV's user avatar
  • 3,280
16 votes
Accepted

What happens when a TPM chip breaks or fails?

The purpose of a TPM module is to ensure that there is absolutely no way to obtain the keys stored on it. Whether or not it actually fulfills that purpose is a topic for another question. For now let'...
Philipp's user avatar
  • 49.4k
16 votes

How can Android encryption be so fast?

There's no reason to decrypt gigabytes of files at startup. Android only needs to decrypt exact files it needs to load in memory on startup. FDE in Android doesn't encrypt the kernel, only the user ...
Therac's user avatar
  • 2,680
16 votes

How to prevent a hosting company from accessing a VM's encryption keys?

so that it would not be economically viable to spend time & resources to get them. I hate to break it to you, but you simply aren't that important. No-one knows you or your web app. So it's ...
Graham's user avatar
  • 671
15 votes

Is it possible to tell if hard drive is encrypted?

While you can't tell for certain, you can tell within a certain range of confidence. Encrypted data looks like white noise: each bit has exactly a 50% probability of being set, regardless of the rest ...
tylerl's user avatar
  • 83.6k
14 votes

What does LUKS header contain?

For your information, I can't answer "Authoritatively" because I am not the author/contributor of LUKS/cryptsetup/dmcrypt but a user. But my answers are following, What does LUKS header ...
arif's user avatar
  • 1,156
14 votes

Encrypting the /boot partition in a Linux system can protect from an Evil Maid Attack?

"Evil maid attack" is a catch-all term for any kind of physical manipulation to a device in the absence of the user. Encrypting the hard drive would protect you against two of such attacks: ...
Philipp's user avatar
  • 49.4k
14 votes

How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)

I completely agree with AndrolGenhald's high-level answer. In case you are interested in a complementary low-level walk-through of Android's storage encryption implementation: Android can do File-...
f9c69e9781fa194211448473495534's user avatar
14 votes
Accepted

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

Full Disk Encryption (FDE) systems (like Truecrypt, BitLocker and FileVault) encrypt disks at the level of disk sectors. This is an all-or-nothing approach, since the encryption drivers won’t ...
Overmind's user avatar
  • 8,899
13 votes

How to prevent a hosting company from accessing a VM's encryption keys?

In theory, you should be able to use the trusted hardware features of modern CPUs to run your disk encryption, or even your entire VM, inside a tamper-resistant part of the CPU, having all the data on ...
interfect's user avatar
  • 305
13 votes

Can I use VeraCrypt with an SSD?

VeraCrypt (or any other full volume encryption) can be (and has been for many years) used with SSDs. An attacker with the tools to access the drive metadata will be able to determine some things about ...
CBHacking's user avatar
  • 49.6k
12 votes
Accepted

Android FDE - Why is key stored in RAM at all?

I think you understand the concept wrong. The encrypted partition will not be fully decrypted on mounting, then stored somewhere on the device and then encrypted again (to save the changes) whenever ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible