So apparently it's 2019 and @Lenovodc *still* insists on having a broken in-warranty enterprise HDD returned (even though that would be a massive data protection violation) or else they charge for the replacement.
I am not amused.
-
Show this thread
-
Maybe it makes sense to FDE *all* servers now, purely as a warranty bullshit countermeasure. I wonder if you can stick the decryption key in a random UEFI variable (for systems without a TPM). It just has to not be on the drives.
6 replies 2 retweets 14 likesShow this thread -
Are TPM modules not common on DC equipment or just prohibitively difficult to use/administer?
1 reply 0 retweets 0 likes -
They're just an added cost option. TPMs are basically useless for unattended boot because if you *really* want the key you just hook up a logic analyzer and sniff it out. I've done that with BitLocker.
1 reply 0 retweets 0 likes
So the threat model isn't much different from just having the key in a UEFI variable, against a skilled attacker. And the goal here isn't to protect against physical access attacks, it's just to keep the drives encrypted.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.