Lain Security Policy
lainchan / sec

----------------------------------------------------------------------
John Rain · 2018-11-09 14:40

Sticky thread is locked. Post collective knowledge on policy, tools to
make recommendations for lains.

----------------------------------------------------------------------
BloodCat · 2018-11-09 14:40

>Threat: Confidentiality of Laptop Contents may be threatened by a
local attacker capable of seizing machine. The local attacker may be
an APT with advanced forensic knowledge but has not broken modern
cryptosystems. The disclosure that there is an encrypted disk is
itself not a problem , plausible deniability is not required.
>Security Posture: Mitigation
>Policy: Local Storage will be full disk encrypted to prevent
unauthorized disclosure of information.
>Tools:
<Linux
luks (Linux Unified Key Setup) - an in kernel open source full disk
encryption solution. Allows whole partitions to be encrypted and
unlocked via keyfile  or pass phrase. Allows more than one passphrase,
and modifications exist that allow a dummy nuke passphrase.  Does not
allow for dummy containers.
<Windows
Veracrypt - An open source fork of TrueCrypt. Supports full disk
encryption for Windows. Allows key files and passphrases. Provides
limited plausible deniability by having a dummy file system that can
be decrypted. If your threat model includes government action through
propetary ISVs you shouldn't be using Windows. Using an open source
FDE solution can help migitate that threat by avoiding backdoors
written explicitly into bit-locker, but cannot avoid targeted attacks
remotely, such as via Windows update, if such attacks exist.
<OS X
Veracrypt - not capable of full disk encryption. An open source
solution that will allow you to create a volume and choose what is
encrypted.
>Alternatives:
<Linux
Encrypted File System - ecryptfs allows the encryption of a file
system rather than a block device. This allows one to avoid encrypting
the entire disk, and to choosing individually what to encrypt.
<Windows
Bitlocker - A Propetary solution from Microsoft. Its commonly
deployed, and well supported, but if your threat model includes the US
government, you might wonder if there are not any backdoors
Dell Data Safe / McAfee Full Disk Encryption ... - You would be
absolutely retarded to use any of these products. They are not well
supported. Proprietary. Offline decryption for repair is a nightmere.
< OS X
File Vault 2 - the default solution, proprietary, does support full
disk encryption. Do not use if your threat model includes US
government acting through apple.
>Advantages:
- Local Attacker cannot simply read file system
- Local Attacker will have more difficulty locally backdoor OS.
However, encrypted boot partitions can be used to trojan kernel for
next boot, this can be mitigated.
>Disadvantages:
-Makes repair take longer if system doesn't boot, and sometimes
impossible. - Having your disk full disk encrypted can prevent repair
tools from accessing the disk to fix configuration issues, integrity
issues that prevent system from booting. For operating systems like
Windows 10 that fail updates and don't boot routinely this is
nightmerish.
-Makes Data Recovery near impossible, and threatens data availability
If your hard disk should begin to fail encrypted, you may find
yourself trying to restore a backup you don't have. Make sure you make
routine backups with full disk encryption to mitigate the enhanced
difficulty of data recovery.
-Makes operating system minorly slower
Now there is a tiny overhead on reading / writing files. Largely
unnoticeable.
-Because computer is unusable to random stranger, computer will
probably be reset immediately if stolen and chances of recovery, and
especially recovery with data are slim. (See famous talk about stolen
server recovered by dynamic dns and remote access software)

----------------------------------------------------------------------
Tyrell Wellick · 2018-11-12 22:02

>>6301
Wherever you copied this from, it's retarded, and you're a
chucklefuck. Nobody here is going to be "threatened by a local
attacker" who is also an APT (the term APT doesn't even fuarrrking
make sense in the context of a physical attacker). Nobody has broken
modern cryptosystems, which is why they're modern cryptosystems. We
don't call KASUMI a modern cryptosystem despite relatively widespread
use, because it's broken.

In conclusion, just use fuarrrking FDE.

----------------------------------------------------------------------
Morpheus · 2018-11-13 20:02

>>6325
>"threatened by a local attacker" who is also an APT (the term APT
doesn't even fuarrrking make sense in the context of a physical
attacker)
Go through a US border, or bring your laptop to china as a business
man.
>In conclusion, just use fuarrrking FDE.
Retarded. Understanding what FDE does, and what it doesn't do is
important. FDE can have disadvantages and understand them is important
to understanding how to mitigate them. For instance, having a backup
plan with FDE is essential if availability matters at all.
>chucklefuck
You are actually the reason this post in necessary. People ranting
about 1 size fits all security technologies without understanding what
trade offs are being made misunderstand what security is.