On Thursday 24 February 2011 15:42:25 Ron Johnson wrote: > On 02/24/2011 08:30 AM, Boyd Stephen Smith Jr. wrote: > > On Thursday 24 February 2011 07:03:23 Ron Johnson wrote: > >> On 02/24/2011 06:22 AM, Brad Alexander wrote: > >>> Also, please remember, when the system is running, the filesystem is > >>> *decrypted*. Encryption is not going to protect you when the system is > >>> running. > >> > >> So what you/we need are apps which integrate GPG. That way, files > >> are only decrypted when necessary. > > > > Depends on what you are trying to defend against. Full-disk encryption > > is meant to defend against physically stolen or confiscated servers, > > drives, or laptops from being accessed. When a laptop is on, it is > > generally being closely observed, so when it is stolen it is usually > > off. Servers and drives > > Except that many laptop users suspend or hibernate their machines > for faster startup. With sleep (suspend to RAM), the disk remains unprotected; key material is in RAM, among other things. I don't recommend sleeping unless you *know* you'll be back to actively using the system before your battery drains; it can lose data in rare instances. Usually this entails keeping your laptop nearby, although not necessarily the focus of your attention, so there is some increased risk of theft. From what I understand, it is possible to disable the ability to suspend the laptop. This can be used to avoid this extra risk. With hibernate (suspend to Diks), the disk is protected; key material is not in RAM (nothing is). You'll need to provide the passphrase in order to resume. Key material is never written to disk unprotected by the kernel implementation(s) of full-disk encryption; this is a well-known way to "accidentally" subvert the entire purpose of full-disk encryption. Using "safe-sleep" (suspend to both), the disk remains unprotected until the battery drains or (if the ACPI and the kernel is smart enough) it switches to a hibernate state. I'm not sure how well Squeeze (in particular) supports this mode at all; it is common under Mac OS X. uswsusp did have some support for this in Lenny, but I think that package or at least that feature is going or has went away. -- Boyd Stephen Smith Jr. ,= ,-_-. =. bss@iguanasuicide.net ((_/)o o(\_)) ICQ: 514984 YM/AIM: DaTwinkDaddy `-'(. .)`-' http://iguanasuicide.net/ \_/
Attachment:
signature.asc
Description: This is a digitally signed message part.