Is your PC encrypted?

I do understand the downside of whole disk encryption, but I do it anyway. Mainly because I have been in IT for so long, and have seen the consequences of lost/stolen laptops and the info on them. Even stuff that people don't really bother protecting (temp files, or deleted files) can spell big trouble.

I am lucky though... I am capable to do my own PC support, so other than bug fixes or something extremely esoteric, I am usually doing just hardware issues. If I have to hand a laptop to get repaired, I will copy the data off, erase the drive via TRIM or DBAN, toss a basic OS on there so the techs have something to work with. Then, when the laptop is returned, I'll erase the drive again, reload from an image.

For me, whole disk encryption is the lock on the front door. If the laptop is stolen, with encryption, it is "just" a hardware loss that I had. Without, it is both hardware, and data that has fallen into the wrong hands.

As for a RAM freezing attack, my latest MacBook Pro, it would be fairly hard to do, as the chips are soldered on the motherboard, so I am not really worried about that, or TEMPEST attacks, especially with how relatively low value the data I stash on the laptop is.

1492, thank you for that post. The downside of whole disk encryption regarding repairs is not one I had considered.

Regarding some of the other points, thieves are not all stupid, and they are well aware that RV owners will tend to have assets. Yes there's a lot of diversity in our community, but few of us are living hand to mouth. Were I in the ID theft business, people owning luxury assets would be attractive.

Yes I do encrypt all my PCs. But as downtheroad mentioned, only key folders and not whole disc encryption. One of the reasons being that for my PCs, primarily notebooks, that are still under warranty, it would be necessary for repair techs to have admin privileges in most all instance.

This aspect of warranty repair is one I doubt most PC owners even think about? That computer service techs essentially have free reign of your personal info. And don't doubt that techs do check your confidential files? Even former Apple store techs admitted looking into customer personal files. Which is a reason to keep personal files encrypted, requiring a separate password key.

If you do whole disc encryption, the tech will need the private key info in order to get access in many cases. So a thief may not be able to breach your personal files, but some you assume you could trust do?

I essentially encrypt all My Documents files, Firefox profiles (contains my non-financial passwords), Thunderbird profile (emails), Chrome profile, Dropbox, and photos. My financial passwords database are double encrypted with separate applications. I don't bother encrypting music or video files.

I also auto backup my encrypted container to an external USB drive encrypted container. Also, my full system restore images are also encrypted.

Encryption itself doesn't provide complete protection. Unencrypted personal info can also be cached in your pagefile.sys file, and other activities could be stored in your registry. I have my PC settings set to dump my pagefile.sys file to the Recycle Bin, which can be securely deleted. It may also be a good idea to occasionally securely erase your empty disc space. This can take a long time, so best done overnight. With modern hard drives, only 1-2 passes is generally all that is necessary to make files unrecoverable. Anything over 3 passes is overkill.

Also, don't assume that just deleting files off SSD drives will make them unrecoverable.

Nonetheless, the small inconvenience of having to input 2 passwords or keyfiles at startup, versus just your user account, is a small price to pay for extra security of your personal info.

Campfire Time wrote:

GordonThree wrote:
some kid grabs your laptop, hops on a motor cycle and plugs in a charger, they get to a work space, hose the ram sticks down with freon, remove them from the laptop and put 'em into a gizmo that dumps the contents to a usb drive. Search the contents for the big keys (they stand out), and poof encryption is gone.

Methinks you've watched to many episodes of CSI Cyber. Sure, this "could" be done. But seriously? Steal a laptop from a random person and go through all that just find out all it has is baby photos and bank info for for an account with $500 in it?

Yes, these kind of things can happen. But they are targeted attacks and are hitting victims they know have valuable data on their machines. Criminals are lazy. There are far easier, and less glamorous ways to obtain that data without providing fodder for exaggerated TV shows. It's exactly why phishing emails haven't gone away.

Who said anything about a random person. For all I know the OP is a retired partner from a VC firm or General Electric engineer for that matter. As fictional as my example sounds like something from your CSI shows, the technology is quite simple and easy to put together given the right connections and motivation.

GordonThree wrote:
some kid grabs your laptop, hops on a motor cycle and plugs in a charger, they get to a work space, hose the ram sticks down with freon, remove them from the laptop and put 'em into a gizmo that dumps the contents to a usb drive. Search the contents for the big keys (they stand out), and poof encryption is gone.

Methinks you've watched to many episodes of CSI Cyber. Sure, this "could" be done. But seriously? Steal a laptop from a random person and go through all that just find out all it has is baby photos and bank info for for an account with $500 in it?

Yes, these kind of things can happen. But they are targeted attacks and are hitting victims they know have valuable data on their machines. Criminals are lazy. There are far easier, and less glamorous ways to obtain that data without providing fodder for exaggerated TV shows. It's exactly why phishing emails haven't gone away.

It is password protected and unless you know Jack the odds of discovering the password are kind of low.. And not.. Not that Jack, another Jack and I never mention his last name ever on line.

joebedford wrote:
No.

And my meta-data doesn't contain locations.

He may have been referring to EXIF, which I'd call meta-data.

Work laptop is Bitlockered.

Personal Linux laptop is encrypted, but I did it out of curiosity. Not sure I'd bother with it again.

I run Bitlocker on my Windows 7 work laptop. I have the internal drive and two external usb drives encrypted. Make sure you have the key backed up to another location. It will not unlock without the key. I had to reimage when I had to reboot for system updates and did not have the key. For some reason, bitlocker sensed the system changes as a potential threat so it required the key. Normal reboots do not need key.

No.

And my meta-data doesn't contain locations.

I use multiple protection methods, mainly focusing on defending my stuff against a physical theft.

1: BitLocker with a TPM if available is what I use to keep the data away from the meth-heads if the machine is stolen. On the Mac, I use FileVault.

2: For backups, on Windows, I copy files to a BitLocker protected external drive. On Macs, I use Time Machine, as well as a utility that uses zbackup to copy all documents to a backup repository.

3: For virtual machines that are sensitive, I just click the "encrypt" button in the VM program, set a password, call it done.

4: For client data that is sensitive, and only accessed rarely, it goes into a VeraCrypt volume, and is protected with a cryptographic token. That way, even if someone pulls the decryption keys out of RAM, the stuff I am obligated to keep secure stays locked out of reach out of bad guys.

5: For cloud backups, I use Boxcryptor. This way, if a cloud account gets compromised, all files are protected.