Anyway, if you rely on BitLocker in TPM mode (boot without PIN), you should know that anyone can steal your computer, sniff 32 bytes off of the LPC bus, stick them into libbde, and decrypt your disk. Yes, it's that easy. Solder 7 wires to $favorite_fpga_board, decrypt drive.
Yes, except I use a different (much longer) FDE passphrase that is not my normal unlock code (this is possible on rooted devices). Also FDE encrypts *everything*, including all metadata, so I'm immune from "someone used the wrong data class" bugs.
-
-
The problem with FBE and all the DE stuff (and what iPhone does too) is that it's quite secure if nobody made any mistakes all the way through the stack; everything has to work together perfectly. A security flaw could make the whole thing moot, as we've seen many times.
-
With FDE I know that the storage is cryptographically bound to the long and not crackable passphrase, period. As long as the much simpler code from that to the storage crypto is secure, if my phone is off, you aren't getting any data out of it.
- Show replies
New conversation -
-
-
Metadata is DE encrypted on the Pixel 3. I think reading DE data would be pretty hard on it, and reading CE (assuming eg a 6-digit random PIN) very very very hard.
-
If you can compromise TrustZone then you can easily compromise both DE and CE. A 6-digit PIN provides ~zero cryptographic security, it all relies on the Keymaster implementation for both CE and DE.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.