Anybody Using Full Drive Encryption?

**Rob M** · 28-01-2008, 18:39

Is anybody using full drive enryption (either hardware/software), either at home or in a corporate environment?

If so I'd be really grateful if you would give me your thoughts on the products you're using at the moment.

Thanks,

Raist

SMHarman · 28-01-2008, 21:27

We use Credant Mobile Guardian here. I don't know much about it apart from it acts fairly seamlessly with Microsoft windows domain authentication so is transparent to me.

Though you can screw it up by changing the password locally when not attached to the corp network. Tech also have to be careful with domain migration and changing user names as well.

The Jackal · 28-01-2008, 21:34

Well encrypting files is not important unless you have some really sensitive information...

Then again the MOD and HMRC didn't encrypt their files either

On a serious note how about cryptoloop /api under linux ?

cookie_365 · 28-01-2008, 22:38

Let me guess - you're a public sector employee and you need to find a way of getting around The Great Laptop Lockdown but still keep your job?

dragon · 28-01-2008, 23:36

I did look at encrypting my laptop since I travel with it quite often but haven't gotten around to trying to do it yet.

I believe i need to create another partition, modify the kernel and copy the OS onto the encrypted partition or Install from scratch with the disk encrypted (Fedora8)

The Jackal · 29-01-2008, 09:02

erm that doesn't make sense....

If you're booting an encryted fs at boot you're essentially making it visible without a password. All you'll need is the root password or worse still boot into single user mode.

If I were doing this..

/ unencrypted for speed

/data encryted. After you boot up you'll need a password and ssh key to mount it. For extra security I would put my key on a usb stick

**Rob M** · 29-01-2008, 09:48

Quote:

Originally Posted by cookie_365

Let me guess - you're a public sector employee and you need to find a way of getting around The Great Laptop Lockdown but still keep your job?

Nope, guess again.....

[Anyway, the way that I understand the Public Sector's 'Great Laptop Lockdown' is that they're not allowed to use anything unless it's 'approved' - that kinda rules out most of the products that are likely to be recommended here]

---------- Post added at 09:48 ---------- Previous post was at 09:47 ----------

Quote:

Originally Posted by CrC-3rr0r

Well encrypting files is not important unless you have some really sensitive information...

Define 'sensitive':

Personal data relating to me, my employment, my home.
Web site history.
Emails.
Pictures of family and friends.

The list goes on and on.....

The Jackal · 29-01-2008, 09:58

Quote:

Originally Posted by Raistlin

Define 'sensitive':

Personal data relating to me, my employment, my home.
Web site history.
Emails.
Pictures of family and friends.

The list goes on and on.....

So nothing important then that would effect national security

**Rob M** · 29-01-2008, 10:31

Quote:

Originally Posted by CrC-3rr0r

So nothing important then that would effect national security

Doesn't mean I shouldn't protect it.

We all make a big fuss (and I use 'all' loosely) when the Government loses our data, yet the majority of us take no steps to protect our own information on our own systems.

Aragorn · 29-01-2008, 11:31

Raist, last time I looked into it I settled on Truecrypt as a container based encryption system for personal data. The main reason for that is it works on Linux and Windows, allowing me to have a secure folder on USB that can be shared with my work laptop and Fedora at home.

**Rob M** · 29-01-2008, 11:32

Yeah, I quite like truecrypt and have used it for quite a while.

I'm trying to get info on full drive encryption products at the moment though.

Thanks

dragon · 29-01-2008, 14:40

I just set it up on my Laptop, but changed from Fedora to Debian the Debian installer sorted it for me.

On the desktop I had to manually partition so not to erase the windows partition. Its a case of setting up an encrypted partition then setting up an LVM containing the Swap/Root partitions.

Only thing thats unencrypted on laptop is /boot although you can move that out to an external drive, On desktop i haven't encrypted the data drive yet (need to move stuff first) but i might do in the future.

colmm · 29-01-2008, 15:02

Drive Encryption is really good, if used with personal data, ie the computer that were lost, there is no easy way around it, in some technologys the manufacter of the chip (what it encodes to encription) can only access your data (only accessable by police), no other way. NO other way..!

grandmaster · 29-01-2008, 15:46

Quote:

Originally Posted by Raistlin

Yeah, I quite like truecrypt and have used it for quite a while.

I'm trying to get info on full drive encryption products at the moment though.

Thanks

I thought Truecrypt did full drives..i'll have to rtfm....

**Rob M** · 29-01-2008, 15:59

Quote:

Originally Posted by grandmaster

I thought Truecrypt did full drives..i'll have to rtfm....

It can do full drives, but it can't encrypt the OS/Boot drive.