Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This is a follow up on a previous thread from last year (What software should I use to encrypt my hard drive?): any more thoughts on whole disk encryption? I'm getting a new laptop and am willing to spend some money for a straightforward, easy to implement disk encryption method.

I already use Truecrypt, which has the advantage of being open source and free, but am worried that it may be somewhat clunky to implement for whole disk encryption. It seems on face value, that Bitlocker may be the easiest to use solution, enough to warrant upgrading from Windows 7 Professional to the Ultimate version. On the other hand, I've also seen people use PGP as well.

Also, do any of these programs interfere with the ability of the system to go into hibernation or standby mode or have problems with solid state drives?

share|improve this question
2  
If you're going to reference a prior question, it would help to link to that question so we all know which particular one you are referring to. –  AnonJr Jul 22 '10 at 20:41
    
The prior thread is superuser.com/questions/127/… –  andrewj Jul 22 '10 at 21:38
    
the point of bit locker is that it uses TPM, one of the advantages of TPM is that you dont need a complex password as dictionary attacks are thwarted by the physical implementation of an electronically enforced maximum number of retries. –  user83892 May 31 '11 at 23:23
1  
Truecrypt isn't difficult to use at all for full disk encryption unless you have multiple OSes involved. If you're full disk encrypting a standard Windows install, it's not very difficult. –  ultrasawblade Jun 1 '11 at 1:26
add comment

6 Answers

If you're already using TrueCrypt, there's no compelling reason to switch at this point in time. Most people find BitLocker easier to implement, and if you have the appropriate edition of Windows 7 there's nothing wrong with using it. Its been a long time since I last looked at PGP so I can't really comment there.

In the end you'll do better to focus on making sure things like master passwords are sufficiently complex and hard to guess, that you're locking the logged in account when you're not there, and watching for other commonly missed vectors of attack. You'd be surprised how many "securely encrypted disks" are compromised by having weak authentication measures or are left logged in...

Ultimately the best solution is the one you use. ;)

share|improve this answer
add comment

Using PGP right now in our environment. PGP will prompt for authentication coming out of hibernation as well as system boot, but not from sleep. Not sure about BitLocker or TrueCrypt. I'm looking at evaluating BitLocker right now.

share|improve this answer
add comment

I have tried both PGP and Bitlocker and found that both are easy to implement, but Bitlocker asks for a recovery key every time there is a change in the hardware — it looks like this:

BitLocker Recovery Key: 402853-586311-176957-360866-697576-425466-365607-689666

This key needs to be with you all the time in case the system asks for it, which I find very difficult to memorize or keep comparing to passwords in PGP.

I have seen Bitlocker ask for this key more than once during my Bitlocker tests.

Other advantages of PGP over Bitlocker in my opinion are:

  • You don't care what MS OS you are running, if you had to read your drive from a different machine (all you have to do is to install PGP software and you are ready to go)
  • You can configure more than one user to access the drive (ex. admin and the regular user)

Disadvantages are maybe in recovering a damaged OS since Windows doesn't have PGP drivers embedded and therefore Windows can not access the drive.

share|improve this answer
    
You can use Group Policy (or local policy) to relax BitLocker's paranoia level about checksum changes to bootloaders etc., reducing the likelihood of it prompting you for the recovery key for no apparent reason. See: technet.microsoft.com/en-us/library/ee706521(v=ws.10).aspx –  Zac B Sep 7 '12 at 15:17
add comment
  • truecrypt is more fit for file system encryption. Pgp is too generic for this, i haven't used bitLocker

  • there might be an overlap, but truecrypt favours symmetric encryption schemes, while Pgp is more oriented for signature, and public key cryptography certificates. If you are really paranoid about quantum computers breaking public key cryptography in the next 10 years, stick with symmetric key encryption schemes (default on truecrypt)

explain where do you see potential clunkiness; truecrypt is in fact designed with partition and whole-disk encryption in mind

share|improve this answer
add comment

You can use truecrypt from linux, but I don't think microsoft bitlocker is compatibile with linux.

And... I guess truecrypt is TRULY SECURE (fbi, cia, coud't decript some hardisk after 12 months)

while bitlocker is NOT TRULY SECURE, it can be hacked.

share|improve this answer
3  
How so? Can you provide a reference to back up your claims? –  slhck Apr 30 '12 at 13:17
1  
I can: hackaday.com/2010/02/09/tpm-crytography-cracked Heck, even Microsoft admits it: windowsteamblog.com/windows/b/windowssecurity/archive/2010/02/… However, that's a pretty involved and delicate hack. I wouldn't worry. –  Zac B Sep 7 '12 at 15:19
add comment

What makes you think that bitlocker is not secure? It has been developed by the recognized team and has no known backdoor issues. Any PC may be "hacked" with a sloppy user, it does not matter what WDE software is used.

As far as what crypto software use for the whole disk encryption, three mentioned here (PGP, TrueCrypt and Bitlocker) are good and should safe enough for everyday use. PGP and TrueCrypt are developed fpr both Win and Mac, while Bitlocker is for Win only. I would add to the list SecureDoc full disk encryption from Winmagic that works well on both Mac and Win machines.

Also bear in mind that you choice of encryption software on the first machine will influence its use on the consequent computers.

share|improve this answer
    
References would make this more authoritative –  soandos Oct 21 '12 at 0:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.