[sf-lug] Full Disk Encryption options?

[Rick Moen]

Quoting Erich Newell (erich.newell at gmail.com):

> I never referred to my solution as "simple"...just "as simple as it
> gets".

Although I'd call "control physical access" a far closer approximation
to "as simple as it gets", the real point is that your solution is
ineffective, because it ignores the obvious flaw that in fact _would_ be
exploited in the exact threat scenario you describe.

You would hardly be the first software person I've seen disregard
gaping physical security problems.  I've seen it incessantly for decades.

> The solution of "always know where your towel (laptop) is"...doesn't
> make muster for anyone who has one lick of sensitive data on their
> respective computing devices.

Did you bother reading what I said, earlier?  I said:  "Read contracts
attentively, know whom you're dealing with, and know your threat
models."

The particular threat model my _own_ anecdote concerned was a CTO who I
(correctly) believed to be tapping all corporate LAN traffic, and who 
I expected might easily stoop to compromise at either the hardware or
software level of my work-issued workstation.  However, in point of
fact, nothing security-sensitive ever has lived on any of my laptops:
All files of personal interest are on my server or in physically
protected storage elsewhere.

Encrypted storage (at various levels) is _indeed_ a reasonable measure
to deal with some other threat models -- but not, as I quite clearly
said several times, the one that Kristian happened to have raised for
discussion.  

If you refuse to understand why, and wish to believe that encrypted
volumes are security magic pixie dust like any number of other software
people, go right ahead, but my interest in discussing the matter with
you ceases at that point.

> Unless the drive is wholly encrypted, it is pretty trivial for me to
> completely pwn your laptop with a few minutes of access...

So, you get to learn the secret of how Xubuntu PPC gets installed.
Congratulations!  Good luck selling that on the streets of Moscow, by
the way.  Write if you get work.

> If you are referring to the really lame PS2/USB dongles.

Get real.

> You show me any such device that works on a laptop....

Here's a 1997 design, with schemetic and list of parts, for one that
requires about $5 worth of parts at Jameco's inflated full-retail
prices.  You would of course put it inside the case, spliced in to the
internal keyboard connectors.  The parts are now, eleven years later,
actually a good bit smaller than the photo shown.
http://www.keelog.com/diy.html

I'm sure there are better and more modern implementations.  Go hire a
PI, if you want one.

> Once again...what does locking your laptop in your friend's car do for
> the security of the data on your device?

Xubuntu?  Has it become a deep, dark secret when I wasn't looking?  ;->

And by the way, you really don't understand the concept of threat models
at all, do you?  Oh well.  This _too_ is traditional among software
people.

> For the rest of us....

For values of "the rest of us" not including Kristian, whose scenario
your so-called solution failed to address.  Thus, once again, my point.

> Actually, I am quite open to being convinced.

No, what you're apparantly open to is endlessly wasting my time.  We're done.