Comment by MichaelGG | Hacker News Reader

Comment by MichaelGG | Hacker News Reader

Parent Full thread

OneNote is awesome. I'd use it more, but I can't figure out a way to encrypt it while still getting sync. If they offered some built-in password protection, so that the contents were safely encrypted on-device and the hosting aspect just sync'd blobs, hey, awesome.

They could even implement a differential update mechanism, just encrypt the deltas before uploading. (After careful review, since that might introduce some sort of crypto weakness.) I'd even be satisfied if some of the metadata wasn't encrypted.

Otherwise, I don't feel comfortable in having a detailed, personal, life journal. I want something I could access from various devices and record internal thoughts, while minimizing the possibility of anyone including close friends, getting access.

OneNotes default appears to be "hey, we'll drop this, unencrypted, in your Live sign-in default storage".

What if you put your notebook file on a Bitlocker'd drive?

It is Bitlocker'd, plus EFS'd (just in case my TPM gives up the keys - it's unclear if the password is mixed in to derive key material or not). And I'm getting a new SSD with "Encrypted Drive" support, so the keys are never in-memory (although again, I don't know if the key is just sitting in an easily-accessible chip on the disk, or if my password combines for key material).

And then EFS on top of that, and each VM has its own encryption as well. So even a full compromise won't hurt the VMs I'm not using at the time.

But it doesn't help since OneNote's online slick-access-from-anywhere, doesn't do crypto AFAIK. So all my transparent crypto protect my local device, but OneLook uploads the notebooks unencrypted to SkyDrive.

Daaaaaaamn you must have some awesome secret files!

Not particularly. Anything really secret I probably wouldn't put on that computer. I just don't see why other people should be allowed to access my data.

The biggest win, I think is the internal "e drive" encryption, so that a RAM dump doesn't spill keys. That even somewhat mitigates Lightning DMA attacks. (Although the attacker could just hijack the OS at that point.)

Reply on news.ycombinator.com