When Full-Disk Encryption Goes Wrong | Hacker News Reader

When Full-Disk Encryption Goes Wrong

spaceisdisorienting.com

49 pointsAqua_Geek52 comments

This story is about full-disk encryption going bad, but it could just as easily be the hard drive dying, or another software bug that corrupts the disk.

If you have a Mac, get an AirPort Time Capsule. This gives you automatic, hourly backups. The importance of automatic cannot be overstated. If you have multiple Macs, they can all backup the same Time Capsule.

You can save a little money using an external hard drive, but how often are you (or your family members) going to remember to plug it in and run Time Machine? Once a week?

I'm not generally a Mac fanboy but damn if the Time Capsule isn't the most it-just-works backup solution I've ever used. I really want to find a similar setup for my Windows boxes.

While it's not "plug-and-play" like Time Capsule, Crashplan is pretty good. I've been using it for about a year now and so far its been working flawlessly for me. All my Windows boxes get backed up daily to my Synology NAS (note: this is a third party package, so your mileage may vary).

If you are using windows 10 there is a new backup feature that works similar to time machine, can backup to external drive or windows share I believe. http://windows.microsoft.com/en-us/windows-10/getstarted-bac...

Yep, ultimately it boils down to "have automatic backups."

FDE further complicates things, though, as if the volume master key is corrupted everything is lost. If my hard drive dies, there's a decent chance that a data recovery shop can recover at least some of the data.

If you have a Mac, get an AirPort Time Capsule. This gives you automatic, hourly backups.

If you're here, get a Tarsnap account. This gives you backups however you script them. They're versioned, deduplicated, and NSA-resistant.

Arq is another great alternative, which combined with Amazon Unlimited Cloud Storage, gives you the same benefits as Tarsnap for orders of magnitude less.

Are you talking about this? $59.99/year? https://www.amazon.com/clouddrive/home

And while I've got your attention, 1) are Arq backups encrypted and 2) can it back up via SSH to my own storage somewhere - like a cheap VPS with lots of disk space?

1) Yes. The format and encryption specifics are even documented: https://www.arqbackup.com/arq_data_format.txt

2) Yes. Although if you're after cheap space, Hetzner's storage boxes are the cheapest $/GB I've seen (https://www.hetzner.de/hosting/produktmatrix/storagebox-prod...), with Backblaze B2 close behind.

Any suggestions for an arq like software for linux? Something that does encryption, dedupe, and can target anything.

It gets kinda spendy backing up a whole drive with tarsnap doesn't it? It's blocked for me at work so I can't tell, but I thought it was operating on top of S3. At bare bones s3 pricing that would be $15 a month if I'm not mistaken, for 500GB.

The problem with some of the really nice solutions on HN, like Tarsnap and Rsync.net is that they're really expensive compared to the alternatives. Tarsnap is $0.25/GB, over 5x the price of standard, 99.999999999% durable S3. Rsync.net is ~8c/GB with the HN discount, still over twice the cost of S3.

Compare that to Backblaze or CrashPlan, which do all your PCs for $5/month.

>If you have a Mac, get an AirPort Time Capsule.

Or, if you are stingy and/or enjoy a bit of occasional sysadmin DIY, get a Linux box and configure it to look like a TC. There are plenty of tutorials out there, it's very easy.

Another popular alternative is Arq, which will back up to pretty much anything.

[0]: https://www.arqbackup.com/

Seconded. An AirPort Time Capsule is so worth the investment. I can't praise it enough and you can't get me to shut up about it. My wife and I had our Macbooks (our only computers) stolen this weekend and we are back up and running with new Macbooks with all our data intact. My only regret is not turning on FileFault, thinking it would make our computers slow.

Also, however you handle your backups, set up a calendar reminder for every month or two to check that they're running as expected. (Backup drive isn't full, cloud service account hasn't expired, correct directories still being backed up, files restore as expected, etc. etc.) I do this monthly, and more months than not I find something to fix on one of the computers in the house. I run multiple types of backups from full disk images to incremental cloud backups, so a loss of any one wouldn't be catastrophic, but it's still a good thing to stay on top of. Just had a hard drive die last week actually, although ironically it was a backup drive...

If the external drive stays plugged in, you can back up to it automatically. Good for a desktop (which can then serve laptops).

Time Machine likely makes sense for laptops, though it's got low storage capacity at the price.

> This story is about full-disk encryption going bad, but it could just as easily be the hard drive dying, or another software bug that corrupts the disk.

Not really. Those 4KB with the encryption key are EVERYTHING in full disk encryption. There's nothing equivalently important in unencrypted disks.

This is just another "I dont have a backup..." story. Let me provide better one:

1) full disk encryption

2) police takes your laptop

3) after six months you are asked to decrypt the harddrive

4) you dont remember 100 character password after all that time

5) you go to jail until you remember

My understanding was that you couldn't be held in contempt (presumably what they would charge you with) by simply exercising your right to remain silent (and not provide anything). Can someone comment on whether or not this is true?

http://www.nytimes.com/2016/05/06/technology/former-officer-...

http://arstechnica.com/tech-policy/2016/05/feds-say-suspect-...

Two things:

1. This is still murky law, still being explored... but I believe you can't be compelled to reveal something you know (your password) but could be compelled to reveal something you have (a key.)

2. Contempt of court I think is for 6 months at a time and has to be renewed, and regularly isn't renewed. If your hard drive contains crimes worse than 6mo of jail, contempt is a good way to go.

"This could never happen in America"

http://www.nytimes.com/2016/05/06/technology/former-officer-...

With apologies to patio11, Backup backup backup BACKUP backup BACKUP. There are many, many bad things that can happen to your data, which can be mitigated with proper backups. Also test your backups.

Important even if you're not using FDE, but by design FDE makes any data corruption significantly worse. Not an Apple specific problem, either. LUKS is actually specifically designed so that the master key is wrapped in a large all-or-nothing transform (anit-forensics) to make it exponentially harder to recover from a damaged header.

I'm not very familiar with FileVault, but does it not provide a recovery key when you set it up? (for writing down and stashing in a safe place or backing up to the cloud)

Every other FDE scheme I've ever seen does, accompanied by big scary "WRITE THIS DOWN. IF YOU LOSE IT, AND THEN YOUR DISK GETS CORRUPTED, YOUR DATA IS GONE FOREVER" warnings, and with good reason: yeah, if the master key sector is corrupted and you don't have a backup, you're screwed.

It does provide you with a recovery key, but that recovery key is useless if the file containing the volume master key is lost or corrupted (as happened here). In FileVault the recovery key is to protect you from losing your password, not from the system nuking the master key.

Ah, that's my misunderstanding then. I always thought the recovery key was the volume master key, for the purposes of guarding against accidents like this. Good to know that's not the case; I think I should go check up on my backup solution now.

You can generate a new recovery key anytime once the volume is decrypted/booted:

    sudo fdesetup validaterecovery  # check
    sudo fdesetup changerecovery -personal  # change

Obviously this doesn't reencrypt the disk, so you can guess how it works.

Usually, disk encryption is done by creating a master key, which is then encrypted again for every user, using the user's password in OSX's case, that is allowed to access the disk.

This way, the user never can retrieve the master key and access rights can be modified all while keeping the master key and thus avoid re-encryption on the drive if a new user is added/an old one removed/one changes his/her password.

Downside: if the master key goes boom, so do the data, with no chance of any recovery.

If losing the master key (or the passphrase that decrypts it, at least) does not result in the data being gone forever then the encryption isn't worth much, now is it?

The upside of this is that if you want to very quickly destroy your data, all you need to erase is the master key securely.

This is true for LUKS on Linux as well. Destroy the LUKS header, you data is now forever gone.

I have a feeling that $2000 recovery service would have basically said the same thing had they encountered a corrupt GPT record or HFS+ superblock in a fully unencrypted disk as well.

Misleading title, should be "When You Forget to Take Backups". FDE only (slightly) raises the stakes of not having backups by making a system (a little bit) more fragile.

OK recently my recovery volume's HFSJ file system became corrupted in a way that prevented booting, similar to this story. Nothing could repair it, not Apple's fsck_hfs (Disk Utility) nor Disk Warrior. I used dd to backup the recovery partition because I wasn't sure if it contained anything vital for unlocking the encrypted volume. And then I proceeded to nuke that partition (I actually formatted the volume from a Fedora live image, and that issues a trim command prior to the format; and I followed that up with removing the partition with gdisk, so for sure there is no recovery HD volume data at all on this SSD)

Using a separate OS X boot volume I created a USB installer of El Capitan, booted that, went to Disk Utility, asked it to unlock the encrypted primary volume, using just the normal passphrase, and it worked. I then went back to the main menu to reinstall the OS; i.e. installing over the existing (newer) El Capitan installation. The installer took forever but it reinstalled the (older) OS version of El Capitan, created a new Recovery HD volume, and did not erase any of my data. And I could boot afterward.

So too bad this guy's blog doesn't accept comments or I'd tell him this directly and there's a pretty good chance his data can be recovered intact.

What I think is the Core Storage metadata on the primary volume contains an encrypted copy of the DEK. I mean, why put the only copy on another file system and partition? That's risky. I'm willing to bet how Apple does it is similar to a combined LVM+LUKS header, except they appear to duplicate the metadata at each end of the partition. In between that plaintext metadata is a (huge) pile of ciphertext which is the actual primary volume, OS + apps + user data.

It's really important both to backup the FDE keys and have regular backups.

I lost a volume to BitLocker AES-XTS 256 earlier this year and luckily only lost a few days of work. I've since substantially improved my backups and even rotate a disk offsite weekly now.

"When you forget to backup your files" seems more appropriate.

What completely amazes me is how OS X doesn't warn users to backup that block, constantly, until it's done.

I use Arch, which is not beginner friendly, but the wiki states this in a big, red banner. I'd expect an end-user friendly OS to do the same once the password is set for the first time, and over and over again until the backup has been made.

Does Apple actually enjoy leaving all the user's data to chance?

The sad part about this story is that time machine backups on OSX are so stupid simple and easy that it's a tragedy he didn't have them set up.

It's an external USB drive I have plugged into my monitor. When I plug my laptop into the monitor at work it silently does its duty. I never even think about it until I need to recover a file that I just rm'd!

Sorry for being off-topic: my wife and I had our MacBooks stolen on the weekend and every ten minutes I think why in the hell didn't I have FileVault turned on. Our whole lives were on those laptops and I cannot even fathom what sort of fallout to expect with our data out there.

If you're lucky they'll just wipe the drive and use it for themselves.

You probably already know this, but just in case not: If you had Find My Mac enabled on those MacBooks, you can lock or wipe them [1]. I've read somewhere that if you select "lock" first, you can't then do a wipe. Not sure about that, tho. Good Luck.

[1] https://support.apple.com/en-us/HT204756

Yes, I did this the minute I realized what had happened. Both my Macbooks and my iPad are in the "Erase Pending" state. Not sure if I still get notified of the location if the thieves replace or wipe the drives before ever connecting to the Internet.

For my work computer I regularly clone the disk to a identical HDD in an external dock using CloneZilla. It runs at night. Along with incremental data backups I can swap in the cloned disk, copy in the diff and be up and running quickly. Just a tip :)

this is why you use actual FDE drives if you want FDE and not a software middleman. also what happened to the recovery key?

Or just design the FDE to store more than one copy of the encryption key.

Drives that claim to do encryption themselves have their own issues (like not actually using the user provided key for encryption and other crypto failures from developers & companies not familiar with how crypto is supposed to work).

Good times, hot swapping a laptop HDD to clear the password...

Honest question. What is this you are referring to? I've never heard of a "Full Disk Encryption Drive" and google isn't forthcoming.

There are HDDs and SSDs that do the encryption themself, rather than just being a dumb storage medium. You need to unlock it with the password or key when using it, and the disk will transparently encrypt and decrypt the contents on reads/writes.

One problem is that you have to trust the disk (manufacturer/firmware) to do this right. This is not so easy to verify yourself, and not all drives claiming FDE are equally secure. https://en.wikipedia.org/wiki/Hardware-based_full_disk_encry...

https://vxlabs.com/2012/12/22/ssds-with-usable-built-in-hard...

Trusted Computing Group (TCG) provides a TPM and OPAL spec. The more common term is SED (self encrypting drive) where FDE tends to be software (typically OS). FDE (full drive encryption) is probably better considered "volume encryption" since it applies to file system volumes. It's possible for other volumes and partitions on a drive to not be encrypted.

Many consumer drives are SEDs now. Check out the Samsung 840 EVO which is such a thing. It's always encrypting, it's just that out of the box it's always unlocked (i.e. it provides itself with the DEK at power on).

If the encrypted plist containing the volume master key is lost or corrupted the recovery key is as useless as your password.

More details here: https://eprint.iacr.org/2012/374.pdf

Reply on news.ycombinator.com