New answers tagged

1

I think you are confusing two independent concepts. Full disk encryption protects a dead system, that is a non-running system. Once the system is running, FDE is no longer relevant. The running system has the same password risks and requirements as any other system as FDE no longer protects it.


1

Yes all passwords should have a standard that enforces a high level of entropy. If not for any other reasons than these two things: Contributing toward the randomness of the password hash via the source password, and secondly the principle of defense in depth. It is foolish to rely on single layers of defense against compromise. In fact I would argue that ...


1

There are a few reasons why you'd still want complex passwords, though, they're all a little situational. Local access or theft of your machine while it's on (or in sleep mode) but locked. A bigger problem for laptops or workstations in open offices/public areas, especially if you don't disable normal sleep and go straight to hibernate. Remote access via ...


4

I am not talking about password compromise, but if somebody gets my phone, he just needs to turn it on to get data decrypted, so what’s the point? For what cases is this encryption designed? I'm not sure from where you are quoting this statement, but it's false. Physical access to the device does not guarantee automatic decryption of the disk. From the ...


3

It's protected in the sense that malware cannot be installed on the unmounted encrypted drive. However it's still possible for the encrypted drive to be damaged or destroyed if the drive can be written. A simple dd to the raw unmounted drive can destroy it. ---- Edit ---- If the encrypted drive is a bootable drive, then there is an unencrypted boot ...


3

1 - Prevent data from the SAN falling into the hands of others Full Disk Encryption (FDE) with large, secure passwords, unique for each server. If the SAN is stolen, all data is encrypted. Unique passwords limits the damage if some passwords leaks. I would recommend FDE for everything (even OS files, public website data, everything), because it uses only ...


1

IMHO, your LUKS setup is OK: On internal drive, you only have /boot that is unciphered. The rest of the volume consists in a stack of LUKS + LVM, so it's ok. On external drive, everything looks encrypted. Just a small remark: 700MiB is a lot for a /boot partition....


Top 50 recent answers are included