0

I’m about to get a new laptop. I’d like to have some basic security to prevent access to my data in case of getting lost or stolen.

At some point I will replace the hard drive with a self-encrypting SSD, until I do I'd like to get a better idea on the security of my data if I set a hard disk password from the BIOS. Is this something that is easily defeated?

1
  • Yes, you take out CMOS battery and the password is gone.
    – Davidenko
    Feb 24, 2015 at 7:24

2 Answers 2

1

Instead of thinking about encrypting your full disk, I would recommend you instead look at specific data in a secure way. Meaning—for example—I am using Mac OS X. My main hard drive is not encrypted. I use GPG/PGP for some mail interactions, but it is mostly in the clear. What I do care about and secure I keep stored on encrypted disk images I can create within Mac OS X’s built-in “Disk Utility.”

If I need to decrypt that data, I just mount the disk, enter my password and access it. And when I am done, I just unmount it and there that is.

Now let’s say someone stole my system. Maybe they could glean some info from my mail, but not anything worth anything… They would not know my keychain password. And as for encrypted disks go, even less so… They wouldn’t be able to mount those disks and do anything.

So my advice to you is even if you are not using Mac OS X, maybe you should reassess your overall security mindset and footing. Remember: Security is a mindset more than it is simply one “mega” tool you install or setup. Encrypting your whole boot disk—which can be at least 50GB for most people—is a bit overkill. But carefully maintaining and securing the data you feel is most sensitive is a more practical way to go.

1
  • The real advantage of FDE is that you do it once and then don't have to think about it again, it just works. The actual disadvantage is that if it's ever stolen it will likely be dumped as not worth the risk selling. There go your chances of it ever being recovered. Likewise for encrypted Email ... are you sure you have never forgotten to encrypt an email ... your stalker is. Feb 24, 2015 at 8:40
0

Assuming it's a proper harddisk password it's not usually secure for spinning hard disks. The password you enter is stored in some non-volatile ram/flash on the drive and the drive rejects data access commands until you send one that matches.

Basically it just means you need special hardware (a serial port) to remove the password.

https://blacklotus89.wordpress.com/2013/11/27/ata-security-lock-2/

Some flash drives OTOH do use the password as part of the on disk AES encryption that they use to implement the 'Secure Erase' functionality properly.

For a spinner you'd probably be better using "Bit-locker" (if available) or Truecrypt (if you're not completely paranoid). Possibly even for a flash.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .