Lennart: Linux Comes Up Short Around Disk Encryption, Authenticated Boot Security

[sophisticles]

If you're using Windows 10 the way that Microsoft intends, your login account is linked to your cloud account. Sure Windows 10 is not uploading 2TB of data (unless you put it in OneDrive). But who knows how secure your cloud account really is?

Besides that, Windows 10 is constantly sending lots of information about usage to Microsoft. Even if they're not getting your top-secret information, they're still getting much more information about you then they deserve.

I can assure you that my Win 10 installation is not linked to any account, MS or otherwise.

As for sending MS information, you do know that you can disable the built in telemetry very easily, don't you?

I had similar concerns when Win 10 first came out, and I eventually realized how misplaced they were.

I am currently working on a 3rd degree, this one in cybersecurity, trust me when I say Win 10 is sending nothing to MS, I have Wireshark installed, i have sniffed packets, monitored all the network activity passing through my router, nothing is happening.

Now my Android phone, yes, I do know it's spying on me but in all honesty but I don't do any banking or online purchases with my phone and at times the spying has come in handy.

[Chugworth]

Microsoft sells OneDrive subscriptions to private individuals, businesses and government bodies. You seriously think they would even be able to sell to the latter two segments if OneDrive was ridiculously insecure and could be easily compromised?

Everybody loves to make wild allegations about how "<insert name of commercial cloud storage provider> is insecure", and yet can never ever provide any concrete examples when challenged to "provide indisputable proof to show that <insert name of commercial cloud storage provider> is insecure".

Oh wow, what an argument. I don't know how secure Microsoft's cloud service is, or anyone's cloud service. I don't know how their cloud software is designed, and I don't oversee the operations of their datacenters. That is precisely why I don't trust them.

[sophisticles]

Personally I hate full disk encryption because I have been burned by both LUKS and Win 7's Bitlocker.

With LUKS I have had partitions and full disks that became unencryptable after I created the LUKS/Ext4 with Ubuntu and decided to move to Fedora, tried to unlock it, something went wrong and I was never able to unlock the partition again.

On Win 7, something went wrong with the system being powered down during a power failure, when I went o start the system up it said unable to unlock disk and that was that.

Fortunately in both cases I had backups, but I still have a LUKS partition I forgot the password to and can't get in.

I was also using Gocryptfs for a while, but the config file became corrupt and there went all that data.

Now I use file obfuscation and individual file encryption, so for instance my tax and banking related files are zipped up with encryption, that file is then encrypted with AES Encrypt and then the file is named with something like "great football game" and put on a thumb drive that is hidden somewhere.

[billyswong]

Just quoting this, but it seems a semi-common sentiment here. There are a number of countries where being a dissident is a one-way ticket to a reeducation camp, where the state has ample computer security expertise, and where your laptop may disappear at customs for some period of time before being brought back.

The fact that the FDE on linux prevents casual copying is irrelevant, an attack scenario from the 90s. Far easier to simply insert code into the bootloader which

1. Hides its function
2. Records the FDE key or user password
3. Modifies the OS to send this information at network initialization

I have no doubt that there will be responses here that this is far-fetched Mission Impossible nonsense, who have been so embedded in Linux for so long that they are unaware that such bootkits are straight out of everyday Windows XP life in 2010. I used to do volunteer computer security work for "undesirables" headed to such countries and on multiple occasions found bootkits that affected OS function.

I rather suspect that the responses to Poettering's post here are going to be divided into those who have used MacOS FileVault and/or Windows Bitlocker-- and who generally agree with Poettering-- and those who are ignorant to what a proper, scalable, usable, and effective FDE looks like.

How exactly do you install a keylogger on an encrypted drive?

You don't keylogger to the drive. You install keylogger as a physical device, hiding inside the laptop. Keyboard, mouse, touchpad, monitors, all peripherals can be eavesdropped without cracking a storage drive. While it is indeed far more troublesome than pure software solution such as hacking the bootloader, it is still doable.

I am uninterested in Secure Boot related drive encryption NOT because I think pure software based drive encryption is safe enough against national attack. I am uninterested because Secure Boot derived drive encryption is still helpless against national attack. If national attack doesn't seems this hardware sophisticated and software only so far. It is just because there are not enough people running their computer in those secure boot hardened encryption mode. If the number of such people rise to mainstream, hardware keyloggers will prevail.

The only way to win against national attack to personal computing devices is to beat those nations up, literally.

[bemerk]

I think both bitlocker, which Linux can handle nowadays and luks, which is integrated with the distros installer, work fine for me and are a lot better than not using anything at all.
I think we need more work on the bios/uefi side and make it opensource and modular to reduce the attack surface and allow for measured boot on all Mainboards, not just old server hardware where core boot works.

[Sonadow]

Oh wow, what an argument. I don't know how secure Microsoft's cloud service is, or anyone's cloud service. I don't know how their cloud software is designed, and I don't oversee the operations of their datacenters. That is precisely why I don't trust them.

Right, it all comes down to "i have every right and entitlement to walk into an organisation's HQ and demand to see their development practises and trade secrets, and if I can't i'll just claim that their products are insecure just because".

It's really refreshing to see that an average person thinks his personal interpretation of security is more airtight and sound than the large businesses that literally stake their reputation on ensuring their cloud services are operational and secure enough to be served globally.

[Danny3]

How about systemd developers make that application firewall that I'm waiting for years ?
Or an application cointainer for each program or script that is started to properly isolate and contain them ?
systemd has a init manager, a process manager and a network manager
I think it could be possible to contain and control an application's access to webcam, mike, network and location (the precise one with Wifi networks around).
Why is this possible only on Android and not on Linux itself ?

As for encryption, why should we rely on closed hardware ?
TPM and Secureboot, really, who owns the encryption keys, who has them ?

[ddriver]

I strongly agree with Lennart on the per-user encryption - that's something I really like about MacOS, for example, and would love to see in the Linux world as well.

I do per-user per-process per-file opened by process for my software stack, so I don't have to care about what it sits on. If it is secure - there is no harm, if it is insecure - I still did the best I could to mitigate that.

[sedsearch]

As usual Lennart wants to incorporate TPM into his pet project systemd and has gargled out a lot of words to justify this change.

Whatever. That day is not far when government will be issuing encryption keys for manufacturers and people will have to authenticate their ID just to comment on, or even connect to, the internet, or use their own hardware. (And people who disagree may make their own internet, or hardware<o^o>)

[cynic]

my data are definitely not worth such complex attacks described by Lennart so I'm reasonably sure that won't happen to me.
anyway, as a regular LUKS user, I'd like very much to be able to use my FIDO2 usb key as an additional security factor to unlock my disks.