Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
Security Encryption Operating Systems Software Windows

Bitlocker No Real Threat To Decryption? 319

An anonymous reader writes "The Register is running a story called 'Vista encryption 'no threat' to computer forensics'. The article explains that despite some initial concerns that lawbreakers would benefit from built-in strong encryption, it's unlikely the Bitlocker technology will slow down most digital forensic analysts. What kind of measures does one need to take to make sure no one but yourself has access to your data? Is Bitlocker just good enough (keeping out your siblings) or does it miss the whole purpose of the encryption entirely?" One would hope an international criminal mastermind could do better than the encryption built into Vista.
This discussion has been archived. No new comments can be posted.

Bitlocker No Real Threat To Decryption?

Comments Filter:
  • by SpaceLifeForm ( 228190 ) on Monday February 05, 2007 @09:32PM (#17898918)
    Well, he could, but he likes to do things slowly so that most people won't notice.

  • Pinky... (Score:5, Funny)

    by Lithdren ( 605362 ) on Monday February 05, 2007 @09:36PM (#17898950)
    Brain: Are you thinking what im thinking?

    Pinky: I think so brain, but Vista locked up and we lost all the missle launch keys we stole from the NSA.

    • by jd ( 1658 )
      I was thinking more along the lines of Emma Peel's quip to beware the diabolical masterminds, but I guess Pinky and The Brain works just as well here. :)
    • by Anonymous Coward on Monday February 05, 2007 @11:13PM (#17899758)
      Pinky never thinks what Brain thinks. It would be more like:
      Brain: Pinky, are you pondering what I'm pondering?
      Pinky: I think so, Brain, but how are we going to find deep-fried pants at this hour?
      Brain: I-- (sigh) just hand read me that encryption key from the screen there.

      (Pinky is jumping back and forth and balancing on different pens, he falls backwards and hits the computer. Brain sighs at his own destiny of having to live with such a buffoon. Pinky dusts himself off.)

      Brain: Where did you even get all those pens, anyway?
      Pinky: Microsoft is giving them away! They sent ten free pens to every household in the world. (Confused) I'm not sure why, maybe because their computers are always breaking... you know, one time I was...
      Brain: Nevermind that, Pinky. Just read me the encryption key from the monitor.
      Pinky: What, you mean this TV doodad?
      Brain: (sigh, sarcastically) Yes, Pinky. From the "TV doodad."
      Pinky: Ooook, it says (pause)
      Brain: Yes?
      Pinky: Well that's what it says. It says (pause)
      Brain: It says what, Pinky?
      Pinky: Now I just told you what it says Brain, don't make me repeat myself!
      Brain: (sighs, walks over to computer) What? No... No... (increasingly dismayed, anxious, ears/eyes droop down) This can't be... (Checks wires behind computer frantically)
      Pinky: What's the matter, Brain? Is the TV thing gone cuckoo? I blame Rosie...
      Brain: Quiet, you nitwit! I think Vista's frozen up. We've lost the encryption keys!
      Pinky: Frozen Vista? Ooooooooooh what flavour is it Brain? Grape-a-melon? I loooove Grape-a-melon...
      Brain: (sarcastically) Yes, Pinky, it's Grape-a-melon. (shakes head) Look, you know who's to blame for this, don't you?
      Pinky: Ummmm.... The Flying Sausage People from the tea cup in outerspace?
      Brain: (sigh) No, Pinky. (dramatically zooms in on his face) BILL GATES! He must've figured out we were trying to take over the world, and he wants it for himself!
      Pinky: Gee, Brain, how'd you think he figured that out?
      Brain: I don't know. Maybe he has a television and watches the fine Warner Brothers cartoon productions. (Pinky & Brain grin at camera)

      (Commercial Break)

      (Scene: Pinky and Brain riding the bus)
      Pinky: Narf! Brain, where are we going again? Candycane Island?
      Brain: (sigh) We're going to Redmond to find Bill Gates to steal his plan to take over the world!
      Fat tourist passenger in front of them: That's funny! The wife and I are going to see their fabulous dog park!
      Brain: I see. Would you excuse me a moment? (takes a magazine and makes a makeshift "wall" blocking the tourist's face from looking at him)
      Pinky: (looking out window) Ooooooh, that's a big building! What's that?
      Brain: (not looking) That's Microsoft Campus, and it's more than just a building--
      Pinky: But what's that giant towering doodilly with the spinning whatchamacallit on top?
      Brain: (looks out window) I told you, Pinky, it's-- Good Lord! Microsoft has built a mind control tower!

      (Commerical Break)

      (Scene: Bill Gates in Microsoft Mind Control Tower)

      Gates: (Nerdish evil laugh) They said I was crazy! All those people that called me a nerd! (adjusts glasses, pocket protector) Well now we'll see who the nerd is!
      Ballmer: (foaming at the mouth, shirt sweat-stained, resembling a dog more than a man) YEAH! GET 'EM BILL! GET 'EM! MAKE 'EM PAY! RRRRRRRRRRR!!! (throws chair)
      (Gates looks over the control panel. There is a knob to hike the world's pants u
  • by netsfr ( 839855 ) on Monday February 05, 2007 @09:36PM (#17898954)
    just by knowing its no "real threat to decryption"
    • Re: (Score:2, Informative)

      by Anonymous Coward
      Well, if you read the article you wouldn't fall for a sensationalist headline like that.

      The article basically says that if law enforcement can get the encryption key, or get the password to log on to a running machine with an encrypted hard drive, they can access the contents.

      Wow...what an insight.

  • by User 956 ( 568564 ) on Monday February 05, 2007 @09:39PM (#17898984) Homepage
    What kind of measures does one need to take to make sure no one but yourself has access to your data?

    Do what works for pirates. Bury it.
    • ??AA (Score:3, Funny)

      by Wilson_6500 ( 896824 )
      So _that's_ why the ??AA are having so much trouble backing up those statistics about unlawfully copied movies/CDs/etc.--the copies have all been buried!
    • by deander2 ( 26173 ) *
      Do what works for pirates. Bury it.

      isn't that just security through obscurity? ;p
  • I use TrueCrypt (Score:5, Insightful)

    by AusIV ( 950840 ) on Monday February 05, 2007 @09:40PM (#17899002)
    I don't really have any "sensitive" information on my computer, but I've played around with a program called TrueCrypt. TrueCrypt is open source, so you can be sure there aren't any hidden keys. It has the added bonus of plausible deniability - the entire partition is encrypted and the bits past where files were are random. You can create a hidden partition that gets lost in the random bits, so you have to know its there (and know the key) to find it.

    Really though, I'd say Bitlocker is probably adequate for most purposes. If you're concerned about siblings, co-workers, rival companies, etc. it will hide your data. If you're trying to hide something from legal authorities, you'd best find another way to hide your data.

    • by nganju ( 821034 ) on Monday February 05, 2007 @10:00PM (#17899186) encrypted and the bits past where files were are random...

      Are you sure you didn't run it on your post?
    • Missing the point (Score:5, Insightful)

      by jmorris42 ( 1458 ) * <> on Monday February 05, 2007 @10:11PM (#17899296)
      > If you're trying to hide something from legal authorities, you'd best find another way to hide your data.

      But this is the point of the article and the discussion. Law enforcement and the software vendors who supply them are making a bunch of handwaving "not a problem" noise but this just puts the question onto teh table for discussion, it doesn't even start to answer it.

      The question: Is BitLocker safe for really secure work? Which breaks down to smaller questions. Even when used correctly, with a TCPM chip and a good passphrase and good logoff/umount displine is the implementation and design sound? Or is this just a FUD campaign to keep the coppers buying EnCase? Is BitLocker vulnerable to attacks that other encrption solutions would defend against?

      Because while, despite the Daily Hate here on Slashdot, America isn't a police state and the innocent have little to fear from their governemt unless they are crimelords, terrorists or that most dreadful scourge, a kiddie porn fiend But that isn't much comfort for the billions of huddled masses yearning to breath free in the unfree parts of the world. PGP was a godsend to political dissidents around the world, is BitLocker a useful tool for them as well or a trojan horse to help despots fill their forced labor camps with the fools who trust it with their secrets?
      • Not really (Score:3, Insightful)

        by duffbeer703 ( 177751 ) *
        The point is -- if BitLocker is percieved to be vulnerable, it's essentially worthless. For many companies, the prospect of getting the ability to encrypt desktops without additional software can save a ton of money by allowing the firms to lease PCs.

        If you have PCs with personal data on them, you must destroy or forensically wipe the hard disks before turning them back in to the leasing company -- which is expensive because it requires manual intervention or reduces the value of the asset.

        If you can count
      • by bky1701 ( 979071 )

        Because while, despite the Daily Hate here on Slashdot, America isn't a police state and the innocent have little to fear from their governemt unless they are crimelords, terrorists or that most dreadful scourge, a kiddie porn fiend But that isn't much comfort for the billions of huddled masses yearning to breath free in the unfree parts of the world.

        You are using the old "if you don't have anything to hide you need not hide anything" fallacy. I guess since you don't want watched in the bathroom we can ass

    • Re:I use TrueCrypt (Score:5, Informative)

      by nmb3000 ( 741169 ) <> on Monday February 05, 2007 @10:21PM (#17899356) Journal
      I use TrueCrypt

      TrueCrypt [] is pretty cool. In addition to making an encrypted partition/drive, you can create a file that gets mounted as a drive once you've accessed it. This is what I usually do and it's handy for using it on a USB key or if you need to send some files via email/FTP. You can also have it use one or more files for the decryption key for the volume instead of the standard text passphrase.

      The GUI is quite good, lots of choices on encryption algorithms, and there's nothing cooler than using sol.exe as your decryption key :)
      • Re:I use TrueCrypt (Score:5, Informative)

        by Anonymous Coward on Monday February 05, 2007 @10:29PM (#17899426)
        Seconded. There's a sort of chain mail floating around on piracy sites regarding truecrypt, the covers some of what has already been mentioned here. I wonder if someones up to a viral marketing campaign or something.

        FWIW here it is:

        Peace for the paranoid.

        If you have files on your computer that are very personal, embarrassing or plain illegal, you probably want to use encryption. There are a number of solutions out there, both free and commercial. My recommendation goes to truecrypt ( [] ) which is free, open-source and very easy to use.

        Truecrypt can create a file on your computer that has to be "mounted" to a drive letter (like F:) before it can be read. It then shows up under 'my computer' much like a CD player or something, ready for use.

        The file itself can be named anything and placed anywhere on your hard drive, or a CD, USB key etc. And if you analyze it without having the pass-phrase it will look like a random sting of numbers.

        The default algorithm for truecrypt is AES, which the US department of defense deems strong enough even for 'top secret' documents.

        How to use truecrypt is well enough described on the website. Go to [] and click 'Beginner's Tutorial'.

        I'd like to add some notes though:

        Pick a strong password. You have up to 64 characters so use a whole sentence. A quote from a movie or a line of a song works well. If you want something shorter go for something purely random.

        You can strengthen it further by using keyfiles. Any file that never changes can work as a key file. Now you adversary not only have to crack your password, but also has to know which files on your HD to give as key files.

        It's overkill for most situations, but if you keep some home made MP3-files on a USB drive and use these for keys you have the dual protection of something you must have (USB key) plus something you must know (pass phrase).

        If you live in a country where use of encryption is in itself illegal, or considered suspect do the following:

        * Use the hidden volume feature of truecrypt. This creates two volumes baked into one, with different passwords. If you are forced to reveal the password you can give out the one to the wrong volume.

        (Where you have conveniently stored some embarrassing but perfectly legal Pr0n. What if you were to die suddenly and your mom got your computer! Plausible deniability).

        Another similar option, is to simply create another encrypted volume with some non-critical stuff in it. This gives you an easy out if someone asks why you are using an encryption program.

        * Hide the volume file itself. Give it a name and location that is similar to a TMP or system file like 'WINDOWS/Temp/~GH7876.tmp'. Given that the file itself doesn't advertise what it is finding it becomes very very hard. Many applications dump random stuff in tmp dirs. Another nice place is hidden folders beginning with $ in the WINDOWS dir. These are uninstallers for windows update, but they are almost never used. Be creative.

        I think this is better than keeping it on a separate medium like as CD (why did you burn a block of random numbers to CD, huh?). especially if you need to work on the files.

        * You can use TrueCrypt in 'traveler mode' which means you don't have to install the program itself. You can keep it on a CD or something. I find this awkward though.

        Most of the above is overkill to me though. How far to take it is a trade-off between convenience and paranoia. But it's not illegal to use encryption in most of the world so there is no particular reason to obfuscate it. Better to be prepare with a good answer if someone asks. Either way, unless you have NSA on your ass, your adversaries will never get into your files without your pass-phrase.

        Help out by copying this text and spreading it around. Help people protect their privacy.
      • Re: (Score:2, Interesting)

        by ohsoot ( 699507 )
        Be careful when using truecrypt on a USB flash drive. []

        The above link is the official explanation, but the jist of it is on a USB drive with wear leveling the drive will evenly spread data over the entire drive to extend the life of the drive. This means that truecrypt can not ensure that the old header is overwritten if you do something like change the password on the drive.

        My understanding is that if you encrypt the entire USB drive and never change the passwo
    • It has the added bonus of plausible deniability

      You will excuse me, I trust, if I remain skeptical of "plausible deniability."

      • by AusIV ( 950840 )
        This page [] does a better job explaining it than I did.

        The first encrypted volume is obvious. If someone can find the drive, it's quite clear that the data is encrypted. The plausible deniability allows you to give up the password for the first encrypted volume. There can also be a second volume that is indistinguishable from the random bits that fill the empty space. If you know it's there and know the password for that volume, you can open it and mount it. If you don't know it's there, you could keep writi

    • by KWTm ( 808824 ) on Monday February 05, 2007 @11:28PM (#17899880) Journal
      One major advantage of TrueCrypt: works on both Linux and Windows. Can't remember if there's a Mac version. Nope, there isn't. Here's the TrueCrypt web site [].

      Having researched TrueCrypt and compared the alternatives, I have started using it routinely. It's not so much that I have something to hide, or that what I want kept private requires as strong an encryption as TrueCrypt. It's more than I simply want a convenient way to encrypt something, forget about it, and not have to worry about it later.

      My personal financial data resides in a TrueCrypt volume. To lock up all of those files, I just umount the volume, and that's it.

      I also wanted to make an offsite backup of our more valuable personal data in case of disaster, such as a fire that burns down our home, destroying the backups stored at home. For example, we have some digital photos with some irreplaceable priceless memories. So I decided to burn them onto DVD and have my relatives, who live out of town, hang onto copies. But relatives can be nosy, and interspersed in the photos could be things I don't want other people to see, from badly taken photos that "make me look fat" to photos of bank statements and legal documents for which we wanted to store a non-paper copy.

      So, I created TrueCrypt volumes of the appropriate size to burn to DVD, and then stashed our photos inside. We've got about 4 years' worth of photos (JPEGs) on two (different) DVDs with our relatives in two locations.

      I don't want to encrypt something with cheap encryption, and then worry 4 years down the road when someone discovers a flaw in the scheme. You might ask, "What? Are your non-geek relatives going to go about cracking your encryption?" You never know. What if I become someone --let's not say famous, but prominent? Say some sort of social activist fighting for software freedom? Who knows what could happen to my offsite backup DVDs in 4 years --suppose some hired maid accidentally dumps them in the trash, and are noticed by the neighbourhood trash-diving geek? What if some big company or other enemy happens to get their hands on copies and try to use some embarrassing photos to pressure me? I want to be able to rip off my tinfoil hat and laugh, "Don't be ridiculous! That would never happen!"

      TrueCrypt gives me that peace of mind. Among its other features is multiple scheme encryption. Are you worried that AES might get cracked next year? Encrypt with AES, and then encrypt the result with Blowfish.[1] Or Twofish first, then CAST5. TrueCrypt offers multiple options, and it does not store the result anywhere. How does it know that you used AES-then-Blowfish encryption? Because it tries all of the schemes one by one. It tries AES alone with the password you gave. Doesn't work. Tries Blowfish alone. Tries about half a dozen other single-encryption schemes. Then it tries the multiple combinations: Blowfish-Serpent, then AES-Blowfish, etc., going down the list until something works. If nothing works, then it concludes that you entered the wrong password.

      It's not a perfect solution, and one drawback with TrueCrypt is that I can't use it on my work computer where I don't have administrator rights. But otherwise it has all the advantages I'm looking for: secure, cross-platform, on-the-fly, open source freedom ... and most of all, it's usable: it exists and is easy to use. Because, much as crypto-security fascinates me, I don't want to tinker all the time.

      Just like a screwdriver: when I want to use it, I don't want to have to Google for user manuals. I just want to do what I need with it, and not have to think about it.

      [1]: Incidentally, the advantage of AES-with-Blowfish is *not* that you can't crack Blowfish even after the AES on your TrueCrypt file is cracked. Once your AES crypto is cracked, the password is known and the same password will be used for the Blowfish decryption. (Remember, TrueCrypt is open source --once the
    • Re: (Score:3, Insightful)

      by mpe ( 36238 )
      Really though, I'd say Bitlocker is probably adequate for most purposes. If you're concerned about siblings, co-workers, rival companies, etc. it will hide your data. If you're trying to hide something from legal authorities, you'd best find another way to hide your data.

      If "legal authorities" can recover the plaintext then it won't be too long before "rival companies" and "criminal gangs" will have the same ability. It's just a matter of how insecure the least secure police department is.
  • by Wesley Felter ( 138342 ) <> on Monday February 05, 2007 @09:50PM (#17899096) Homepage
    This article has little to do with BitLocker; it's just repeating what should be a well-known fact: unless a security mechanism is used perfectly, it is vulnerable. People rarely use security perfectly.
  • Hey, clever idea! (Score:3, Insightful)

    by PCM2 ( 4486 ) on Monday February 05, 2007 @09:51PM (#17899108) Homepage

    From the article:

    Getting to machines while they are still turned on and taking a forensically sound copy is an option even in the absence of USB Keys, Karney explained. "Even though the logical volume is encrypted the OS works on top of an abstraction layer. We can see what the OS sees so that it's possible to acquire data on a running Vista machine even when it is running BitLocker."

    Hey, there's a clever idea! I wonder where they thought up that one? I'm glad to see people aren't spending all their time worrying about Vista's DRM...

  • by GFree ( 853379 ) on Monday February 05, 2007 @09:51PM (#17899110)
    Just before leaving the house every day, I perform the following steps:

    ME (in Picard's voice):
    Computer, establish a security
    code for access to all data query

    Enter code.

    ME (in Picard's voice speaking at a breakneck speed):
    Four, one, three, three, six,
    eight, Tango, one, eight, one,
    one, seven, one, Charlie, four,
    Victor, three... eight, eight,
    eight, zero, Foxtrot, six, one,
    five, three, three, five, nine,
    five, seven, lock.

    Security code intact for all
    data query functions.

    After that, it's just a matter of initiating a cascade force field sequence as I head out the door.
  • The article is long on airy handwaving, "not a problem in the real world" , "Don't worry be happy!" stuff. Specifically, while they minimize the possibility of someone using BitLocker correctly on trusted hardware, just what will law enforcement do when they start running into Thinkpads (with the Trusted Platform chip) combined with suspects smart enough to use a decent length passphrase? Is there a way in? If the crypto is implemented correctly it should be damned near impossible; as hard a nut to crac
  • by Fred Ferrigno ( 122319 ) on Monday February 05, 2007 @09:58PM (#17899182)
    If you read past the headline, the heart of the article is not about the technological changes in Vista, but the behavior of common criminals. The forensics guys know from past experience that people don't bother to use all of the features available to them. Even if they do, seizing the computer itself (hopefully while it's on and the user is logged in) means they can do whatever the user would do to access the data.

    A USB key is a neat trick to keep the wife away from your pr0n collection, but it won't do you much good if the FBI can force you to hand it over.
    • by B.D.Mills ( 18626 ) on Tuesday February 06, 2007 @02:08AM (#17900890)

      A USB key is a neat trick to keep the wife away from your pr0n collection, but it won't do you much good if the FBI can force you to hand it over.
      Many pets are microchipped these days, right?

      (evil grin)

      Make the unlock code the microchip code for your evil, bad-tempered cat that scratches everyone but you. To unlock your computer, use a USB microchip reader to read your cat's details.

      If you have to hand over your USB code to the authorities, just give them the cat.

      It may not stop the authorities from accessing your data, but it will sure make it more interesting for them to do so. Especially if the unlock code is a hissing, spitting, scratching ball of feline fury.
  • Summary of article (Score:4, Interesting)

    by Anonymous Coward on Monday February 05, 2007 @10:01PM (#17899202)
    Just to save everyone the time....

    "If you don't use encryption technologies properly, they will not serve it's purpose."
  • by Class Act Dynamo ( 802223 ) on Monday February 05, 2007 @10:07PM (#17899248) Homepage
    One would hope an international criminal mastermind could do better than the encryption built into Vista.

    Really? Personally, I would hope they write their plans on slips of paper and stash them in a shoe box. I really do not wish any success for criminal masterminds...except maybe Dr. Claw. I really thought Inspector Gadget was obnoxious.
  • "it may well be doubted whether human ingenuity can construct an enigma of the kind which human ingenuity may not, by proper application, resolve." (etext [])

    It was true in 1843; it is true today. Why, exactly, do people continue to be deluded in gambling real money on the belief that some company supplying some cryptographic technology has people in it who are smarter than everybody else in the world?
    • by DamnStupidElf ( 649844 ) <> on Monday February 05, 2007 @11:33PM (#17899910)
      It was true in 1843; it is true today. Why, exactly, do people continue to be deluded in gambling real money on the belief that some company supplying some cryptographic technology has people in it who are smarter than everybody else in the world?

      Encryption is merely the process of protecting data for a given amount of time against an attacker with assumed resources. Obviously any infinitely smart attacker with an infinite amount of time can break any encryption method, but no one alive today will be able to break AES-128 within the next 50 years at least, and only then with a major mathematical breakthrough that would probably benefit humanity more than just the broken cipher. If we can't find a mathematical solution to breaking AES, it would take Moore's law approximately 100 years before computer technology was sufficient to break AES. 128 bit key lengths and longer were chosen explicitly to deal with the case that Moore's law will continue unabated and that mathematical breakthroughs are possible.

      To put it in practical terms, every DES encrypted message is easily breakable now, but no one is really worried. DES encrypted data is now pretty much worthless. A lot of people overestimate the value of the data they encrypt, and often it's really only necessary to keep secret for a few years or decades at most. Even so, I doubt there will ever be an end to encryption, because even if P=NP there will be problems that are harder to solve than to pose. Such problems can be used for encryption as long as the ratio between the work to encrypt and decrypt is faster than breaking it by a sufficient margin which can usually be increased by lengthening the keys.
  • by qzulla ( 600807 )
    "Sometimes people use file wiping utilities or other tools but often they are not configured properly. People accept the default settings, which can leave fragments of data."

    Change defaults.


  • I call FUD (Score:5, Insightful)

    by kestasjk ( 933987 ) * on Monday February 05, 2007 @10:11PM (#17899302) Homepage
    All of these "BitLocker" vulnerabilities aren't actually BitLocker vulnerabilities, they're full-disk-encryption vulnerabilities. They apply just as much to my FreeBSD GBDE protected partition as they do to BitLocker, there's nothing new or even interesting in this article. (The summary "No Real Threat To Decryption" is misleading, because there is nothing about decryption in there.)

    The article says that if the user was using a USB key to unlock the drive, or was in a corporate environment, investigators would be able to get access by taking the USB key or co-operating with the business owners.
    It says that if the computer was on they could get access to the disk. That's only if the computer isn't locked of course, and if you were under investigation you would think the criminal would quickly press [Windows key]+L as the police burst in.
    Clearly The Register has been doing lots of research to produce this article; they should try and get it published in a crypto journal.

    Most importantly they seem to have completely missed the point of drive encryption; it's to protect against theft, not "investigators". Would Microsoft have built the technology into Vista in the hope that more criminals under investigation would buy Vista?

    If you're being investigated no drive encryption is going to help; if they want access to your system they can just as easily use hardware keyloggers. They'll have the evidence they want long before they let you know you're being investigated.

    If you want a good reason to bash BitLocker how about; it's expensive, and there are free alternatives that are just as good for guarding your data against theft.
    • by jd ( 1658 )
      Yes, no, maybe. If you look at the claims made by the 2DEM [] developers, you can discover some information from any encrypted file/disk that uses a block cipher that uses a simple chaining mode. There is no reason to believe Microsoft used a particularly sophisticated encryption mode, there is no reason to believe that other whole-disk systems use only simple chaining modes.
  • TrueCrypt (Score:2, Insightful)

    by Nova88 ( 946603 )
    My recent run of paranoia got me using TrueCrypt (Free and works good!).
  • It's a tough job. (Score:4, Insightful)

    by straponego ( 521991 ) on Monday February 05, 2007 @10:12PM (#17899312)
    Given physical access, or even a logon, to a machine, it's pretty difficult to have reliable encryption. Let's take a simple case, the machine is off and somebody has yanked the hard drive. Okay, with something like TrueCrypt you can secure a partition fairly well. But you'd better be sure that all of your sensitive information is on those secure partitions. I think this is harder in Windows than anywhere else, but it's not trivial under *ix either. For example, under Linux, assuming no malicious programs were running when the OS was under your control, just things like, you're going to be worried about things in /tmp, /var, /home, etc, and your swap partition/file. So, really, the only sane thing to do is encrypt everything-- if you're that worried. But then you have a performance hit, it's less convenient, etc.

    I think it makes more and more sense to use a VM, if you're concerned about security. You can restore it to a known safe initial state, and you can encrypt its entire world. It seems like a pretty big advantage... oh, and of course, you can move your secure environment to other host machines. Uh. Which may not be all that secure themselves, but hey. I told you this wasn't easy :)

    Normally I'm all for bashing MS, but I have yet to see a great solution for this anywhere. So... if any of what I wrote above is new to you, I'd advise that you not trust your Doomsday Device plans (or, more likely, goat porn) to any OS's convenient built-in crypto.

    • Re: (Score:3, Insightful)

      by Kjella ( 173770 )
      I think it makes more and more sense to use a VM, if you're concerned about security. You can restore it to a known safe initial state, and you can encrypt its entire world.

      Sure. But what happens when the VPC/VMWare/KVM process is swapped out to disk? You're still running the risk of data leak, if a much smaller one. Not to mention that a compromised host OS (it's unencrypted, remember) can do whatever it wants with your input and output (or if it's really clever, just access the data itself once you've unl
  • by alexandre ( 53 ) * on Monday February 05, 2007 @10:13PM (#17899316) Homepage Journal
    Want to encrypt your disk securely?
    Take a look at LUKS [].
    It now comes standard in the latest Debian Etch installer :)
  • Does it have the same problem I've seen with most encryption types:
    It totally fails if you know the contents of something that should already be on there that you want to decrypt? So if you have a reference string, and its location, it becomes trivial to compute the key?
    • Re: (Score:3, Interesting)

      by daeg ( 828071 )
      Depends. If you're faced with something like a TrueCrypt volume, even knowing a single file will get you pretty much nowhere. The entire volume is full of random bits, in fact, written data looks just like random data. So even if you knew there was a file.txt with contents "HELLO WORLD", you have a lot of data space to comb through. Throw into that mix that the entire file system is encrypted -- hell, you may not even know what file system you're looking for.
    • Does it have the same problem I've seen with most encryption types:
      It totally fails if you know the contents of something that should already be on there that you want to decrypt? So if you have a reference string, and its location, it becomes trivial to compute the key?

      What you are referring to is called a "known plaintext" attack. Any real encryption algorithm is immune to it.

      In fact, for an algorithm to be considered secure, it's assumed that you can choose any plaintext ("chosen plaintext" attack), fe

  • I had all my max-secure stuff in a .zip file, renamed and XORed with a command-line character. This was stored on a small partition I'd "remove" from the chain as needed.

    Never got caught.
  • by octaene ( 171858 ) <> on Monday February 05, 2007 @10:38PM (#17899512) Homepage

    ...that most computers won't have either the Trusted Computing Module (TCM) chip or the super-duper expensive version(s) of Vista that come with BitLocker. And even if some consumer did have all that, he'd have to figure out how to enable and configure it.

    The majority of Windows users stick with the defaults. No barrier? 'Course not, because it won't be heavily used...

  • The feds will always have access to everyone's pr0n collections. These things (disk encryption) are only really good at keeping petty thieves away from your data. The truly motivated will always break your encryption key.

    I'd like to know how Apple's FileVault does in comparison. Is it better, worse, about the same?
    • >The truly motivated will always break your encryption key.

      Only if you have a moronic key. Any modern encryption technique is secure against anyone but a deity if you are careful.
  • who honestly believe Microsoft didn't provide some backdoor to bitlocker for the NSA, CIA, FBI, IRS, RIAA, MPAA and anyone wlse who can cook up some excuse to claim they need it.

    We should do a Slashdot Poll on this one.
    • by davmoo ( 63521 )
      We should do a Slashdot Poll on this one.

      Why? Asking the Slashdot community for an objective opinion about Microsoft is like asking the congregation at a Jewish Synagogue for an objective opinion on Adolf Hitler.
  • by Matey-O ( 518004 ) <> on Monday February 05, 2007 @11:55PM (#17900072) Homepage Journal
    Having just completed a Forensics bootcamp, I was frankly amazed at what the current state of the art practices are in password cracking. Even the smallest commonly used keys would take a Computer for Every Person On the Planet 300,000 years to brute force crack.

    Face it, you ain't gonna get there with more horsepower.

    But, the guy's a Bronco fan? Index and add it to the dictionary. Enter his wife, daughter, marriage date, favorite car, and pets. The dictionary generation software has taken great strides in Making lists of MuffySpot1996 type entries.

    Not enough to crack your password? Hmm. Better hope you didn't use it with another program that happened to write it's ram to swap. The forensics tools index EVERY number and word on the drives you enter into evidence. Evidence can be data from your iPod, cellphone, and PDA. It can be from the exchange server and it can be from

    Is he Russian? Add the russian dictionary to the search.

    So, here's what we have: a Custom dictionary, Russian and English dictionaries, an index of every unique character string captured on all removable and non-removable storage.

    That's a lotta chinks in the armor. And Crooks usually aren't that smart.

    It was a very enlightening class. During the lab it _easily_ guessed my tier two and three didn't get my tier one Passwords, but I didn't enter all my evidence for submission either.

    • Re: (Score:3, Insightful)

      For high-end passwords I've been steering people toward five- or six-word Diceware [] passphrases. If physical dice are completely random, then that's 64.5 or 77.3 bits of entropy. An attacker could read them out of swap space, plant a keylogger, or analyze the timing of your keyclicks, but they're outside the reach of clever guessing or feasible brute force.
    • by Kjella ( 173770 ) on Tuesday February 06, 2007 @07:21AM (#17902542) Homepage
      Most people pick a crappy passphrase, when in reality it's not that hard choosing a good passphrase. Start off with a passphrase, plain english and something you'll remember by heart:


      Throw in the following three things:
      1) Capital letter
      2) Number
      3) Special char


      Now remember the "special words": rinGg, dark666ness, bin!d, you'll find those much easier to remember in context.

      The length kills any brute force attack, with the added "typos" the number of permutations is huge, killing any dictionary attack. In fact, this one is probably way overkill already.
  • by Schraegstrichpunkt ( 931443 ) on Tuesday February 06, 2007 @02:16AM (#17900930) Homepage

    In some ways, the issue boils down to who is more knowledgeable about the use of encryption or other security technologies: investigators or the targets of investigation,

    In other words, Microsoft really hasn't learned much about security over the last 10 years. They still design security systems that are prone to operating in insecurely. This looks like the "Do you want to run this ActiveX control?" dialog all over again.

  • by Dirtside ( 91468 ) on Tuesday February 06, 2007 @03:35AM (#17901348) Journal

    One would hope an international criminal mastermind could do better than the encryption built into Vista.
    Oh yeah? Who do you think wrote Vista, eh?
  • by rlp ( 11898 ) on Tuesday February 06, 2007 @09:16AM (#17903216)
    Simply edit the bitlocker.conf file and make the following change:

    Change the field:




Experience varies directly with equipment ruined.