Hacker News Reader

Comment by joejohnson | Hacker News Reader

>>>Intermediate:

>>> - Encypting your Entire Hard Drive with Truecrypt (Mac and Windows)

Do people recommend this method, or is Apple's built-in full disk encryption sufficient?

Filevault 2 is pretty good. It's built into the OS, so it's a lot more likely people will use it than to install another package.

Obviously you need to make sure you have a good backup scheme in place, and escrow the decryption key somewhere (ideally, printed).

There are some functionality advantages to Truecrypt (deniable volumes, etc.), but Filevault is pretty good. I'd feel equally comfortable with either one. (I'd prefer OPEL, the drive encryption on-controller, for performance reasons, but Mac OS X doesn't support that.)

Once you do that, you have a lot of other things to worry about before "which widely accepted disk crypto package should I use for FDE" becomes the biggest question.

> (I'd prefer OPEL, the drive encryption on-controller, for performance reasons, but Mac OS X doesn't support that.)

When available, OSX makes use of the hardware AES-NI capabilities of the CPU though.

Has anyone used TrueCrypt for full-disk encryption on Mac, or MacBook Air (SSD)?

Any experiences to share? Anything positive/negative /etc? Would appreciate comments, esp on compatibility with non-Mac devices.

Thanks!

I would not put much trust in any encryption system whose source code I did not have access to.

I never get that argument. I could download TrueCrypts source code, but that would take forever to read, if I could even read it all. So I'm basically taking the internet's consensus that someone has read the source and it does what it says it does. Is this a safer bet?

Yes, especially with encryption.

"Many eyes make bugs shallow".

And of course someone has read the source, someone wrote it. But the number of eyes on the code would be more than closed source.

That makes sense. Thanks.

Would you rather use a program vetted by a wide variety of unassociated security researchers, or one whose manufacturer merely insists it was very careful programming?

My take on this is that if it's open source and lots of people are using it, malicious individuals will be scouring the source trying to find attack vectors which then, hopefully, would be more likely to become public than attack vectors in private software.

I wouldn't trust Apple on security. They are currently producing computers with ports that have direct access to the RAM. Also, you can root a mac with physical access in about 10 seconds. (On startup CTRL-S , mount the hd, delete find and delete .Apple*, restart). There is also that issue with the Indian government. Also in the past they have had major problems with FileVault (search 'VileFault').

Unless this allows you to access a Mac that has FileVault disk encryption turned on, without the key, it's a red herring. Also, today's FileVault is a completely different technology than the previous home dir encryption (which AFAIK was never broken, but had some frustrating limitations, mainly regarding backup).

You can retrieve the key if the computer is turned on by dumping the memory from a Firewire or Thunderbolt port. If these ports are disabled you could use the Cold Boot Attack. This is the same with all computers, it's just that Apple continue to make them with Thunderbolt.

There may be other ways...

'Unlocking FileVault': http://www.youtube.com/watch?v=doGzuOYCNJE

Apple has made some progress on protecting from DMA attacks -- when the screen locker is enabled, you can't do it. The kernel uses Intel VT-d for this; I'm not sure if Linux or Windows do the same yet.

I knocked Apple a bit for security issues 2006-2009, but they've made a serious effort to fix things starting sometime in 2010 or 2011. I mean, iOS and the iPhone platform is probably one of the most secure mobile OSes now (RIM edges it out, but RIM sucks). OS X has added other security features as well, starting with 10.6.

>They are currently producing computers with ports that have direct access to the RAM.

You mean, like every device with PCI slot or FireWire port? It's hardly just Apple that provides DMA.

Rooting Windows doesn't take too long either, and to get data (the real reason to root a device) it's not like it's necessary. Just pull the HD and plug it into another machine - you already have physical access. Physical access == game over, unless you have good encryption, and the kind of machine or OS makes no difference.

The FileVault issues are a good point, though I don't know what changes have occurred since full-disk encryption came out with 10.7. VileFault's attack vector readme lists DMA (true on any DMA device, though easier on some) and reading unencrypted data to look for passwords - only DMA seems viable with full disk encryption.

Enabling FileVault disables Firewire/Thunderbolt DMA access when the screen is locked, or always when a firmware password is enabled.

    pmset -a destroyfvkeyonstandby 1 hibernatemode 25

That command will disable light suspend mode. When the lid is closed, the laptop will hibernate, writing its memory to disk (encrypted) and power off, clearing the encryption key from memory.

Correct me if I'm wrong, but doesn't Truecrypt for Mac not support full-disk encryption for the boot disk?

Reply on news.ycombinator.com