Re: [tlug] Bits to Bits, Dust to Dust, Ashes to Ashes

[Michael Reinsch <mr@example.com>]

Hi!

On 22.12.2005, 14:04 +0900 Josh Glover wrote:
> On 22/12/05, Michael Reinsch <mr@example.com> wrote:
> > Simply use a cryptographic file system in the first place...
> 
> Good idea, if time will de-classify your sensitive data.
> 
> But the key to an encrypted filesystem *will* eventually be
> brute-forced, so if you have data that needs to stay secret for more
> than, say, 5 years (factoring in Moore's Law and as-yet-undreamed-of
> advances in cryptoanalysis), you had better not rely solely on crypto.

I think you can add several layers of security there. 

First one would be this famous hard disk password, we discussed already
some time ago. But I assume here your BIOS can handle this correctly...

While this probably does not impose a big problem for someone who really
wants to get your data (if someone like that exists), it keeps most
people away to have a look. If you want to dispose the hard disk, this
might be also an option...

So the second layer of security would be an encrypted file system. While
it probably only protects your data for some time, you still have to put
in a lot more effort to get to the data. Before disposing such a hard
disk, overwriting the encrypted content with random bytes still seems a
good idea.

For data you really need to keep secret for a longer time, you probably
want to use an additional stronger mechanism like PGP/GPG/SMIME. That
would be the third layer.

I'm not adding the crypto stuff for final disposal of the hard disk -- I
think there are much simpler ways like opening the hard disk and using
some nice, strong magnet -- but to avoid data leakage in other cases
like someone stealing your hard disk or computer. 

This of course does not cover data leaks through other means, while the
computer is running and working with this data...

-- 
  Michael Reinsch <mr@example.com>                      http://mr.uue.org/
------------------------------------------------------------------------

Attachment: signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil