110
votes
How to prevent a hosting company from accessing a VM's encryption keys?
You can't, plain and simple. If you don't trust the hosting company, you don't host with them. This is law #3 from 10 immutable law of security:
Law #3: If a bad guy has unrestricted physical ...
- 31.4k
85
votes
Accepted
How can Android encryption be so fast?
Encryption happens in memory, not on the disk.
You are misunderstanding how disk encryption works. It does not read the entire disk and replace it with a decrypted version. Rather, when a file or ...
- 66.5k
74
votes
Accepted
Is it possible to tell if hard drive is encrypted?
We have two types of encryption here, "file based encryption" and "full disk encryption". There are documented forensics methods and software (e.g. EnCase) that help us detect the schemes and programs ...
- 3,397
74
votes
Accepted
Aren't keyfiles defeating the purpose of encryption?
If decryption only relies on the keyfile and this keyfile is readily available, there is indeed no significant security benefit in your setup.
What you can do though is store the keyfile on a ...
- 7,429
62
votes
Accepted
Is a password-protected stolen laptop safe?
Is a password-protected stolen laptop safe?
No.
The immutable laws of security say:
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
It doesn'...
- 1,045
57
votes
Accepted
Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?
No, Elcomsoft cannot break LUKS or Veracrypt. What they do is to guess the password. Any password-based encryption mechanism can be broken by guessing the password: this is not a flaw in the ...
50
votes
How can Android encryption be so fast?
It doesn't decrypt the full disk at startup. Instead, it continously decrypts data as it is read from the disk when it is read from the disk, leaving the actual content on the disk untouched and ...
- 65.4k
47
votes
Accepted
How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)
At a high level, disk encryption is implemented using a data encryption key (DEK) and a key encryption key (KEK). The DEK is generated randomly and used to encrypt the drive, the KEK is derived from ...
- 15.6k
46
votes
Accepted
Erased encrypted HDD, then secure erased 10% of it before selling it - is it safe?
Has the data been securely erased beyond any doubt? No. Does it matter in practice? Probably not, at least for any sensible domestic/company threat model.
For the purposes of this answer I will ...
- 135k
44
votes
Is looking for plain text strings on an encrypted disk a good test?
No, this is not a good test, not at all.
If you do the same with a zip file, or a docx, or a PNG, you won't see text strings, but the file is not encrypted. Not being able to see plaintext does not ...
- 53.6k
40
votes
Is there a reason to use TrueCrypt over VeraCrypt?
Yes. Use VeraCrypt.
As of September 26th 2015, google's security researchers found a couple of vulnerabilities that affect TrueCrypt 7.1a and VeraCrypt 1.14
they are CVE-2015-7358 and CVE-2015-7359
...
- 501
39
votes
Accepted
Why is it possible to bypass Android full disk encryption?
You seem to be confusing two different security features that are intended to protect against two different types of attacks.
The three attacks you mentioned are to bypass the lock screen of the phone,...
- 1,360
38
votes
Accepted
Is laptop "secure sleep" mode theoretically possible?
Yes. It could be easily achievable, although it would require kernel support do this properly.
In the suspend-to-RAM case, the key should be deleted from the RAM, and in the suspend-to-disk case, ...
- 3,012
30
votes
Accepted
Is a file shredder/secure erase necessary when you have full disk encryption turned on?
I would still recommend using secure delete in your scenario. Should your machine be compromised when you are logged in (malware etc), full disk encryption will not protect you from a undelete ...
- 1,224
22
votes
How to use FDE without needing to share the encryption password
It comes to this: You want to implement a DRM scheme. Many before you have tried, all of them failed. It is not possible to give something (hardware, data) to users and prevent them from using it in ...
- 5,973
21
votes
Accepted
Breaching security of a notebook with full disc encryption when screen is locked
Can anyone point out any weakness in this setup, and if you do, how to
make it secure?
Hardware solutions exist which can grab your system's memory without needing your login. And that's pretty ...
- 72.7k
21
votes
Is a password-protected stolen laptop safe?
Just to add a very simple answer here, I regularly boot a linux live cd/usb on friends' computers who have done something weird and need to recover files, and simply copy them over to an external ...
21
votes
Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?
While LUKS offers strong protection against brute force attacks by using thousands of iterations of a hash function during key derivation, we have significant advances in password recovery attacks ...
- 15.5k
19
votes
Full disk encryption vs home folder encryption - why should the former be chosen over the latter
I recommend Full Disk Encryption everywhere. Home folder encryption will cover a lot, but there are a few points missing:
Data outside of home
Some programs will write things on /tmp, log files are ...
- 53.6k
19
votes
Accepted
How to use FDE without needing to share the encryption password
According to my previous answer, suggestion by @logneck and a bit of google-fu, I came to the conclusion that it is possible to implement the scheme requested in the question with available tools and ...
- 5,406
18
votes
Is laptop "secure sleep" mode theoretically possible?
This would be a case for choosing Hibernate options over sleep. Sleep needs to keep the memory active, which allows for a quick boot; in sleep mode, the machine isn't completely off.
In hibernate ...
- 3,270
17
votes
What does LUKS header contain?
I believe that the header results being 2MB large because of the Anti-Forensic splitter: the encrypted master key is splitted in several blocks to enhance the diffusion and make sure that it can be ...
- 401
16
votes
Accepted
What happens when a TPM chip breaks or fails?
The purpose of a TPM module is to ensure that there is absolutely no way to obtain the keys stored on it. Whether or not it actually fulfills that purpose is a topic for another question. For now let'...
- 49.4k
16
votes
How can Android encryption be so fast?
There's no reason to decrypt gigabytes of files at startup. Android only needs to decrypt exact files it needs to load in memory on startup.
FDE in Android doesn't encrypt the kernel, only the user ...
16
votes
How to prevent a hosting company from accessing a VM's encryption keys?
so that it would not be economically viable to spend time & resources to get them.
I hate to break it to you, but you simply aren't that important. No-one knows you or your web app. So it's ...
- 621
15
votes
Is it possible to tell if hard drive is encrypted?
While you can't tell for certain, you can tell within a certain range of confidence.
Encrypted data looks like white noise: each bit has exactly a 50% probability of being set, regardless of the rest ...
- 83.3k
14
votes
What does LUKS header contain?
For your information, I can't answer "Authoritatively" because I am not the author/contributor of LUKS/cryptsetup/dmcrypt but a user. But my answers are following,
What does LUKS header ...
- 1,146
14
votes
How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)
I completely agree with AndrolGenhald's high-level answer. In case you are interested in a complementary low-level walk-through of Android's storage encryption implementation:
Android can do File-...
13
votes
Encrypting the /boot partition in a Linux system can protect from an Evil Maid Attack?
"Evil maid attack" is a catch-all term for any kind of physical manipulation to a device in the absence of the user.
Encrypting the hard drive would protect you against two of such attacks:
...
- 49.4k
Only top scored, non community-wiki answers of a minimum length are eligible