Comment by mrsteveman1 | Hacker News Reader

Comment by mrsteveman1 | Hacker News Reader

Parent Full thread

They do actually, but it's part of a DRM system [1] rather than something that would be trustworthy for privacy and file security purposes. It's apparently still being used by some Windows Phone devices.

More on topic though, while there may not be a "simple" or trustworthy solution using built-in encryption on cameras or SD cards, it should be possible to create a (small, or "prototype sized but usable") device to sit in the middle of the electrical connections of the SD slot on any camera, and a normal SD card. The device would transparently encrypt video footage or pictures sent to the card. Would be an interesting side project.

I've used the Beaglebone's USB client and host ports, along with the Linux USB gadget drivers and LUKS, to do something similar to transparently encrypt USB sticks, it wasn't particularly fast (8-9MB/s) but it was usable :)

[1] http://en.wikipedia.org/wiki/Secure_Digital#DRM_copy-protect...

Do you have a git repo or blog post with code/info about your Beaglebone passthrough setup? I wanted to do something similar a while ago but never got to it.

I may have written a tiny script to automate part of it at the time but I probably just did it all manually as it's quite simple. I haven't setup a blog for this sort of thing yet, but the minimum steps required to make it work is just a few high level commands:

1) Create a LUKS volume on a connected USB stick/drive (cryptsetup luksFormat /dev/sda1)

2) Open the LUKS volume with a standard name for step 3 to use (cryptsetup luksOpen /dev/sda1 securestick)

3) Load the g_mass_storage USB gadget module and point it at that LUKS device (modprobe g_mass_storage file=/dev/mapper/securestick)

That's basically it, for testing it can be done very easily without scripting.

The end result is a transparent encryption device for USB drives. Plug the beaglebone in to a laptop's USB port and it will show a standard USB mass storage device available for formatting and mounting, unaware that the actual storage is encrypted, and neither the password or LUKS master key will ever be in the laptops RAM (a useful property of this setup).

This could of course be automated with some scripting, and made quite fancy (touchscreen keyboard to unlock the LUKS stick at boot time and load that gadget module properly).

Some beaglebone distros load a gadget module at boot time with their own scripts, but it should be possible to automatically unload it where that is the case.

Reply on news.ycombinator.com