1

I dual boot Linux/Windows 8. In Linux, where I usually work, /home is encrypted, /swap is encrypted, and sensitive files are redundantly encrypted on top of that.

Printing, however, doesn't work on the Linux side, so I need to boot to Win 8 to do that. Win 8 can't see the encrypted files, so I need to decrypt them to some temporary location before printing.

Even if I put the decrypted files on an external drive (on which I will use srm or similar forensic-level-delete tools), I'm concerned that Windows will, at some point in the printing process, write the unencrypted data to the unencrypted Win 8 NTFS partition somewhere, making it theoretically recoverable by someone.

Anyone have any insight on if I should be concerned? If so, how to get this done securely?

| improve this question | |
  • I'm wondering what's so sensitive it needs to be encrypted point to point, yet be printed out on paper – Journeyman Geek♦ Nov 10 '13 at 9:51
  • Admittedly rare, but e.g. printing out online account details for non-technical relatives to have as a backup of in case of death, etc. Obviously a security risk to print it out, yes. But I'd be more comfortable with a printout in a safe than data lying around a windows install. – user272901 Nov 10 '13 at 22:06
1

No, it is not safe unless you have the Windows system disk encrypted and unless you use pre-boot authentication.

The Windows Print Spooler stores the print jobs into temporary files at multiple places. See, for example:

You have several options:

  • Make the printing work in Linux. (not sure if possible)
  • Install Windows into an encrypted virtual machine. Then you will even be able to configure Linux to print using the Windows as a print server.
  • Encrypt the Windows installation system disk and use pre-boot authentication.
  • After every printing, safely delete all temporary files and wipe the unused disk sectors. This would be the worst method - the slowest one and least trustworthy.

BTW when transferring files between systems, why don't you use a multi-platform encryptor like TrueCrypt? From Linux you can mount the Windows partition and have the TrueCrypt container there.

| improve this answer | |
  • Also be aware of that some printers internally store print jobs to a harddrive. Besides that many printers secretly print steganographic watermarks so your sensitive printed data could possibly be identified with your printer and print time. – pabouk Nov 10 '13 at 11:08
  • Great answer, thanks. I'm going with a VM (which itself is in an ecrypted directory). – user272901 Nov 10 '13 at 22:06
  • re: TrueCrypt et al. -- nice to know it's there, thanks, but I don't even want access in Windows if it's going to leave insecure copies lying around. (For general file sharing, i have plenty of unencrypted shared partitions.) Just for the record, I infer from your answer that Linux is trustable not to spool unencrypted versions when printing files (assuming /home is encrypted)? – user272901 Nov 10 '13 at 22:08
  • I do believe you can do FDE on windows with truecrypt – Journeyman Geek♦ Nov 10 '13 at 23:17
  • @user272901: I am sorry, I did not evaluate security of the Linux machine. The printing system (CUPS) and the components the system uses will create temporary files containing unencrypted information at least in /var/spool/cups*/ and /tmp/. Certainly if you are concerned about security you should encrypt the complete drive (not just some directories). In some Linux distributions (i.e. Ubuntu) you just select the option during installation. Other major distributions have multiple tutorials on the Internet. – pabouk Nov 11 '13 at 7:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.