I just ordered a new machine. The old one is not encrypted, but before I now receive the new one I wanted to ask about a strategy for the new encryption. My main fear is loosing the password and making the system inaccessible for myself.

So, what I have is my main machine, which will run Windows 8, the backup HDDs (currently my main machine is a laptop, so those are USB), and my android device. I also own a yubikey, but I don't use it at the moment.

I want the main machine asking the disk password before I can boot. How I would do this is not decided yet, but I think it doesn't play a role for my question. Second one is a password for the user accounts. This usually will only be my account, but maybe there will be a guest account. Then the backup HDDs have to be encrypted too. And lastly, the android device needs another password.

So, there are several passwords that should be long and cannot be forgotten. The yubikey could store one static password, and the second slot could be used for a 2-factor-auth for my windows-account, but how can I safely store the other passwords? They should be long, but I don't want to type in the password for the external disks every time.

My current idea is the following: The machine starts, and I let the yubikey enter a static password to decrypt the main disk (maybe for truecrypt or something). Windows boots, I can now use 2-factor-authentication to login. A script started after login could then enter the password for the external disks and mount them. (Which would, the password would be stored on the main HDD.)

Is this safe, or is there a better way to do?

(I hope I explained this well and the question fits here.)

closed as primarily opinion-based by Ƭᴇcʜιᴇ007, Breakthrough, Moses, random May 7 '14 at 21:06

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Your password would be stored in plain text in the script so that would defeat the purpose no? – Sorean May 5 '14 at 20:11
  • Yes, this is true, but it would be encrypted with the password for the primary disk. Not ideal, though. Do you have a better idea? – FreXxX May 7 '14 at 17:43

There are several issues here.

Firstly, I don't believe that TrueCrypt will work with Windows 8.1. Rather, it does work but cannot be used to encrypt the boot partition due to issues with the UEFI BIOS. If you have W8.1 Pro or Enterprise, you can use Bitlocker. Otherwise, you will need another, paid for, tool.

@JKM has already mentioned the issue with a script.

A better way would be to use something like Keepass to keep passwords. You would still need to sort out the boot disk password and the Windows password and a Keepass password. But you can use Keepass to run scripts that can be passed the user id/password securely. So Keepass would keep your USB disk passwords and be able to mount the drives.

I use something similar. I have a number of Truecrypt files that I mount as virtual drives when I need them, Keepass has entries that will automatically mount the files as drives when I need them. I only need to remember the password for Keepass.

  • Truecrypt will work with Windows 8.1 if you use BIOS and not EFI to boot. This basically limits you to a 2TB system drive, and you don't get secure boot. Truecrypt can automount additional drives if you use the same password. – Zoredache May 5 '14 at 23:25
  • Thanks @Zoredache, I should have said about using BIOS but this is often not an option now that many PC's come with only UEFI enabled. Reusing passwords is not good if you want to maintain the best security as password reuse allows key comparison. – Julian Knight May 6 '14 at 5:13
  • Yes, Keepass sounds good. Didn't have it in mind when I thought about encryption, only when thinking about web passwords. Anyway, what do you in case you loose your primary password? @Zoredache Thanks for the info! – FreXxX May 7 '14 at 17:45
  • I don't lose my important passwords, I create multiple copies and put them in safe places. One copy goes in a sealed envelope in a fire-proof safe at my mom's house that only I have a key for. One copy is in a keypass data stored on my iPad, and one copy goes into my memory. – Zoredache May 7 '14 at 17:52
  • @FreXxX, you DON'T loose the primary!! Make sure you've got it committed to memory and use it regularly for at least a month (I believe it takes at least 30 goes over a period of time to truly memorise something). I use a pattern (actually a couple) so I know roughly what the pass phrase SHOULD be, if I'm really tired I might get it wrong a couple of times. Zoredache's idea is also good. Keep the master somewhere safe, especially so that next of kin can get it should they need to - also leave instructions! – Julian Knight May 7 '14 at 22:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.