You must log in or register to comment.
Remember, always print your recovery code to pdf and save it to the same drive. This way, when it happens, you’re forced to only use Linux.
I had this happen to me with a hardware-encrypted bitlocker drive. I was forced to buy a new SSD, actually.
You couldn’t reformat?
When using Opal (hardware encryption), it locks down the drive. Not even a secure erase would wipe/release the damn thing.
So this process didn’t work? https://www.intel.com/content/www/us/en/support/articles/000037389/memory-and-storage/data-center-ssds.html
It would have if I actually had the PSID 🥲
It was an expensive lesson to take photos of my new drives and store the PSID and serial numbers in KeePass.
I thought Windows wouldn’t let you save it to the same drive? Its been a while, granted. But i had to plug in a USB or print it out.
It is clever enough to not let you save the key to the same drive that’s encrypted. If you print to PDF the print dialogue box doesn’t care where you save the PDF.
Ahh, never knew that!
So malware wasn’t enough, Windows wants to be a ransomware too?
Edit: I can already see it now. “Locked out of your files? For a small fee or our premium subscription, you can restore encrypted files that we lost.”
I Always save the bitlocker info on a usb drive, in case of… I had to type the 40 or so digits a couple of time!
My wife asked me to help her with her Windows laptop one day. She was stuck at the bitlocker prompt and of course didn’t remember enabling it or being given a password. I was like, WTF, they’re just randomly turning this on by surprise now? LOL
Luckily she was able to eventually get it unlocked by calling MS support.
I like the “encryption, but we have the keys” approach. Makes it very secure, especially since MS never had any security breach or leak, ever.
It’s obviously mainly supposed to protect against basic thieves in this configuration.
Some some needs to do a “what if Microsoft bought Signal” parody
by calling MS support.
Which hopefully wasn’t a 1-800 number flashing obnoxiously on the screen. 😂
The bit locker key is saved to the Microsoft account of the user who set up the computer. I was messing with Linux on my new laptop and learned the hard way when it refused to boot back into Windows.
My favorite was finding out that bit locker was enabled on a forced update. The key was saved to the Microsoft account that was used to set up the lappy. Except, I didn’t use a Microsoft account because I’m not some tech marionette lemming who needs Gates hand shoved up my ass to tell me how to use my fucking computer. So I used a local account and disabled bitlocker via bios.
Nothing was lost, but it was still a pain in the dick hole.
If you can access the bios just factory reset it.
I have a feeling this is such an overcomplicated setup
This ‘encrypt’ everything is such a waste of CPU and energy. Plus “oops, all your files are gone, tee hee.” HTTPS everywhere is fucking stupid. More complexity for zero benefit.
HTTPS isn’t only about encryption; it’s about talking to the right servers.
Great for my banking website.
Not at all important my my IOT sensor network.
Not EVERYTHING needs to be HTTPS
Yes, everything needs to be https. https prevents tapering with traffic.
You think your data is secure with HTTPS? There’s always an undisclosed vulnerability somewhere.
Patches solve specific issues but they do nothing for overall security.
I don’t think there is any vulnerability in https. There are know limitations but https itself is fine. If you are talking about TLS vulnerabilities then we have much more to worry about. To compromise the content on a page someone would have to brute force TLS very fast which isn’t feasible with today’s computer. Today’s computer would take at least a few million years. But I have scene estimates that say long past the heat death of the universe.
Even if https was full of holes it still would be better than http. Http has zero tamper protections or encryption. Companies like AT&T used to tamper with traffic to various purposes and it was feasible for them to do so.
TLS 1.0 was released in 1999 as an upgrade from SSL 2.0 and 3.0.
And these days we’re on v1.3 - https://www.cloudflare.com/learning/ssl/why-use-tls-1.3/
Notice anything? There’s always a flaw. The general public hasn’t discovered it in TLS1.3…yet
And again, Banking websites, some stuff makes a lot of sense to use encryption.
Just not everywhere.
TLS could be the most flawed system on Earth and it would still be better than no TLS. Plain traffic is just that, plain. I can do whatever I want to your web browser as I can arbitrarily change the contents of websites. I can make a page be full of ads or do more malicious things such as replacing a page with a phishing site or running something like beef which allows me to have full control of a browser and to pull all information. I could also exploit any vulnerabilities in the browser to do privilege escalation although to be fair major security CVEs are rare.
This is literally a community about privacy. I don’t understand why you wouldn’t want https. It works out of the box and it is implemented pretty much everywhere. If a site doesn’t use it that site isn’t really worth using as it take very little time to setup with Let’s encrypt.
Stop spreading bullshit!
Oh look, we’ve found a security ‘researcher’. Mad that your job only consists of making other people’s job harder?
Try the DMV, that’s also a great place to work where you can inflict misery on others.
Valuable zero days aren’t exposed. They’re sold. If someone wants your data they will get it. HTTPS means nothing except huge amounts of wasted CPU cycles and energy.
You’re simply dumb.
Once again you seem to be calling for not bothering with any security effort of there’s even a remote chance of some other vulnerability happening.
The whole point of security is that it’s always a multi-layered thing. Nobody sane is pretending that encrypting web traffic with HTTPS is a panacea that’s going to solve all your data security needs. But it is sure as hell a million times better than having all of your data transmitted in the clear, with absolutely no assurance that you’re are talking to the system you think you’re talking to, or that the data hasn’t been tampered with in transit.
And don’t pretend https is a huge burden. It’s dead simple to get SSL/TLS certs, and the additional load of encrypting and decrypting the traffic is barely even a rounding error on modern CPUs.
Don’t use HTTPS on your IOT sensor network then.
Nobody is forcing you to use HTTPS man
Move the goalposts some more. I never said forced.
You know how I know you don’t know anything about security or computing?
Because I have reasonable views about security drawbacks? That when I see a vulnerability, I also look at the whole situation and decide if that’s an acceptable risk, rather than screaming “Security issue!” at the top of my lungs and pretending that patching this one vulnerability somehow makes a difference when there’s always another found the next week??
Security isn’t free, it costs us by making it harder to get work done. “Security researchers” only know how to cover their ass. I can do that without their shrieking cries of wolf.
"Might as well not bother patching this actively-exploited security vulnerability, there’ll just be another one in the future, " LMAO
On a laptop you bring everywhere I think it’s ok if you seriously think somebody might try to steal your data. On a desktop computer with the drive screwed onto the motherboard who’s going to steal it?
You lack nuance in comprehension of complicated subjects. Are you a security researcher?
Get out of here glowies!
You should triple encrypt your HD.
Just to be sure.
Once with a strong hash and random password is enough. (Assuming luks2)
But what if… there’s a vulnerabilty…‘spooky noises’
Computers are always getting faster so it always necessary to stay well ahead of the curve. The big shift recently was the that the default hash switched to defend against massive GPU farms. The modern hash requires a lot more memory but as AI pushes memory to increase we are now potentially seeing machines that can break the hash. To my knowledge that is theoretical and would require a significant amount of hardware but never underestimate the budget of the government.
