Re: faq8.html#LostPW

On 06/23/12 17:43, rustyBSD wrote:
> Hi,
> "If an attacker has physical access to your system, they win, regardless
> of the OS on the computer."
> NO. Some Linux distribs can have a full disk encryption.

"NO.  I have a blue car"
what you have said is about as relevant.  See, I don't drive the blue
car much, so I've mislead you because my daily drivers aren't blue, thus
my cars are now 100% safe, right?
Oh, doesn't work that way?  Right.  it doesn't.

If an attacker has physical access to your system, they win.  If you
don't believe me, let me at your computer for a while, preferably while
you aren't aware I'm there.   Hint: the bad guys don't attack you in the
way you hope, they attack in the way that works.

Where I work, someone posted a picture of Darth Vader saying, "I find
your lack of encryption disturbing" (Google for it, I thought it was an
original, but apparently not).  Some people are very fond of encryption,
thinking it equals security.
I wish my art skills were a little better, I'd add a picture of a
pimple-faced cracker crouched over his keyboard saying, "I find your
trust in encryption amusing".

Encryption is important, but it is a tiny part of the security puzzle,
and usually when it is the first thing people mention, they are missing
not only many of the pieces, but also the shape and size of the puzzle
(no, that's not a puzzle of daisy, that's a puzzle of a vast landscape,
but there is a daisy in it)

> Instead of telling "they win", it should be better to tell something
> like: "OpenBSD doesn't support
> full disk encryption, but you can use vnconfig(8) to crypt a non-root
> partition."

vnconfig? we got softraid.

Nick.