Hacker News new | past | comments | ask | show | jobs | submit login

I hate to be trendy when it comes to security, but home directory encryption makes "Evil Maid"-type attacks much easier. If I have 5 minutes with your laptop, I can replace/backdoor any system binaries you rely on and give the device back to you. It's much safer to encrypt everything, even after you know that someone crazy like Joanna can come by and backdoor your MBR. http://theinvisiblethings.blogspot.com/2009/10/evil-maid-goe...



tptacek put it best,

"The reality is, nobody is going to physically attack your laptop (just don't bring your work machine to Black Hat). But there is an unacceptably high probability that your laptop will get stolen; for instance, you will often leave it in your car, where anyone with a cinderblock can get it in under a minute.

[Encrypted home directories are] about the guy with the cinderblock, not about stopping Joanna Rutkowska from installing a keylogger."

http://news.ycombinator.com/item?id=885291


Yes, evil maid is still possible. It does not however trump the basic use case: lost or stolen laptop. In those simple and common cases, the homedir data remains safe. For now, the hassle of a fully encrypted drive is greater than the benefit of protection from doing so, particularly when the MBR type attacks you mention don't remove the evil maid vulnerabilities.


One downside of encrypting everything is that you're providing attackers with a very large body of known plaintext.


One upside of spending millions of dollars on cryptography research is that this is unlikely to help even the most able of your adversaries.

Also, the NSA does not really want to see your porn stash. They captured it as it was being downloaded.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: