Comment by LWIRVoltage | Hacker News Reader

Comment by LWIRVoltage | Hacker News Reader

Parent Full thread

I have followed Veracrypt closely over the years and , while it works very well and seems to be a very capable effective option- I wish the MBR/BIOS vs UEFI thing wasn't a limitation

For those who don't know, -and this is more of the result of the EFI Boot partition scheme- before that, for MBR systems ,one can use Veracrypt to encrypt the entire System Drive - and this allowed a unique option that I have not seen anything else ever able to replicate- it enables an option that lets one hide an entire OS-

The Hidden OS option is restricted to legacy boot mode- and that's being more and more dissuaded in general- So i fear the airtightness of the Hidden-OS capability will no longer be reachable for consumers.

I had seen one effort on it - https://portswigger.net/daily-swig/russian-doll-steganograph...

and https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Schaub-Perfectl...

However, I have since then not seen anything on this sort of capability- and no other encryption software has focused on steganography and encryption/plausible deniability capabilities to this level.

It should be a common thing, I am not all that sure about the offerings on linux. But the openbsd project offers full disk encryption and a bootloader that handles it well.

Actually, this may be a common mistake I make. On openbsd if the project says something works it will usually be simple to set up and have a nice documentation. So I then think "Well if the tiny openbsd project can do it, it must be this easy everywhere" which is not true at all. The two cases that come to mind were booting off a softraid volume(hopefully this one is fixed) and setting up a netflow source. both of which proved to be trivial on openbsd and a huge pain in the ass on linux. The other common mistake I make is to use the openbsd man pages(they are just better) on linux and wonder why nothing is working right.

Probably less of a focus on it because VMs have become so cheap and easy, and you can just encrypt a VM.

I am refining an approach that allows for an OS to be hidden via a different method though. Using disk encryption with the key stored in the TPM, and by default booting into a virtualized OS with no hint that it is virtualized, unless a key combo is pressed at the boot screen to boot into the real OS - after a password is entered. Doesn't protect against everything but it can protect against a lot if deniability is the goal.

Reply on news.ycombinator.com