[Full-disclosure] Fwd: how to get johnny to encrypt (his hard drive)



usability is the foundation of good security

---------- Forwarded message ----------
From: coderman <coderman@xxxxxxxxx>
Date: Mar 29, 2006 10:30 PM
Subject: how to get johnny to encrypt (his hard drive)
To: cypherpunks@xxxxxxxx


thoughts on making this simpler?

0. insert new second disk of equal or greater size
1. boot from trusted cd/dvd ISO image
2. insert USB memory stick (or two if you want a backup)
3. enter new password / passphrase (see good password howto)
4. agree/confirm to copy over empty / target disk
5. wait as new disk is encrypted via loop-aes, keys are stored on
password protected USB image, all existing OS data* on source disk is
copied to encrypted volume on new disk.
6. reboot into new encrypted volume and copy back over original source
hard disk with loop-aes and store keys for this disk on USB image.
7. Johnny gets a data backup with his privacy.

* ubuntu, knoppix, slackware, linspire and centos supported. a
windoze or other partition (vfat, ntfs, etc) can be copied and mounted
under a new installation of the previously mentioned linux OS'es on
the new encrypted disk. (if one of these linux flavors is not already
installed)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: Is my idea can be implement?
    ... Not every sectors on the disk will be encrypted with my "WDE", such as the first cylinder of the disk which contain the MBR; ... The INT13 filter is implement reading and writting sectors in secure mode, and PCI's functions is to implement the driving of PCI card to do the encrypt and decrypt operations, these function will be called by my INT13 filter. ... The PCI driver will drive my PCI crypto card, and disk filter driver do the reading and writting disk sectors in a secure mode, they will "use" PCI device to do the encrypt and decrypt operations through PCI driver. ...
    (microsoft.public.development.device.drivers)
  • Re: GJournal (hopefully) final patches.
    ... For a couple of my smaller filesystems I reduced it to ... It seems like a reasonably modern controller and disk, ... The geom stack on my laptop currently looks something like this: ... rather than encrypt the journal). ...
    (freebsd-current)
  • Re: mlock(1)
    ... >>related to the swapsuspend encryption key on disk) is needed. ... >>usb pen to store and fetch the key... ... Encrypt _that_ with the passphrase or whatever, ...
    (Linux-Kernel)
  • Re: Fastest secure erasing of HDs?
    ... here is the fastest way to make sensitive data unreadable to ... Encrypt the drive using a "whole disk" encryption system, ... You need to encrypt the whole disk, not just your home directory, to be ... If it is just your home directory encrypted, you have to worry ...
    (comp.sys.mac.system)
  • Re: RFC: backporting GEOM to the 4.x branch
    ... >a very long time to re-encrypt the entire disk. ... I confess that I still don't see the threat model here. ... but wouldn't require replacing AES entirely. ... encrypt block B with master key K, ...
    (freebsd-hackers)