Hacker News Reader

Comment by rdl | Hacker News Reader

Best current practice for crossing "hostile" borders remains wiping all data off the devices, traveling with them in close to factory state, then bringing them back to your baseline once inside the country. It's a little tricky and a bit of a pain, especially if you have a lot of stuff you want to download (for me, I usually work with VM images, so I need to download many many gigabytes, and hotels often have bad Internet). It also makes "getting any work done on the plane" a real pain.

(There's also the "travel loaner laptop pool" concept, and the restricted access for remote people. Works a lot better for an organization than for individuals; this would be kind of an interesting appliance or service for individual professionals and for SMBs.)

View on HN

By the way, I hear you can't really "wipe" data on SSD drives. I don't remember why exactly though. Probably some fault-tolerant mechanism. Or maybe it's what NSA has been asking HDD OEMs to make from the beginning.

Most new SSD drives, e.g. Samsung's or Intel's, have transparent encryption (no matter if you set it up or not,) and you are able to "format" your drive by wiping the container with the encryption key, effectively making all data on the drive appear as random noise as long as the encryption algorithm, e.g. AES-256, isn't broken.

Hummm not really

Just write data up to its size. Multiple times, just to be sure

Read it from /dev/urandom

Unfortunately this isn't adequate. Drives contain "extra" storage space above rated capacity, as well as reduce delivered capacity, which gets periodically unmapped by wear leveling, or due to errors, etc. This is a bigger deal on SSD than on spinning-rust, but even with rust, it was an issue (esp with 4K sectors, or when worried about things like keys).

It's certainly better than nothing, but not sufficient practice in a business or high-security-professional environment.

An attacker is willing to load custom firmware onto the drive, or to move the chips into a new device, or otherwise read it out raw, and will have access to more material than your dd can write.

The standard should be "can I prove this will work reliably, given all the layers beneath me", and for that, the only adequate answer is physical destruction. You could possibly design a drive where you're guaranteed to know if everything is fully deleted, and as long as you trusted the design/implementation/current-status, you could rely on it, but then you'd have a $100k 100GB SSD. So much easier just to replace old drives, or to guarantee that nothing interesting every touched the disk unencrypted, or ideally both.

"Drives contain "extra" storage space above rated capacity, as well as reduce delivered capacity, which gets periodically unmapped by wear leveling, or due to errors, etc."

Yes, that's why you fill it multiple times. But yes, you can have information leaking in a sector that went bad and was remapped

But the good thing about SSDs as well is that they're much easier to destroy, just microwave it, or provide an excess voltage to it (may need more work than simply connect the power input to wires coming from the wall)

I believe (but can't find offhand) there are drives which have physical-destroy as a normal interface-accessible command. i.e. "set off the thermite".

A lot of SIGINT/COMINT gear designed for field use had magic destructo-capability designed in, too. I think after the USS Pueblo, especially.

The issue with a traditional erase: ie write random bytes to the disk 7 times. Is writes to SSDs wear them out a bit. If you erase disks a lot its going to wear out sooner.

There are tools called "Secure Erase" that use special functions on the disk to wipe it without wearing it out.

The mechanism of SSD storage has limited writes before it breaks, to make the disk workable the controller takes the write instruction and behind the scenes, puts it somewhere on storage which isn't wearing out.

This means your attempt to write the same address 7 times actually goes to 7 different storage locations and the original data might still be stored wherever it first landed.

You can fill as drive with random numbers. That would be immune to any file system's and/or device's optimizations.

In reality there is no sufficiently-safe way to wipe drives today. If you really care, you destroy the drive. With AES-NI, there's little excuse for not doing disk-crypto-by-default, so if the drive never saw unencrypted data, and your data is only slightly to moderately sensitive, you could probably get away with logical deletion and then a precautionary drive-level or multi-pass overwrite, but if it's something genuinely high security, no sane policy allows drives to leave in any form but dust.

(Within an organization at the same security level, deletion and then wipe is enough to re-issue a laptop, but not going from top researcher to intern, and certainly not from inside to outside.)

Reply on news.ycombinator.com