News for hackers. Stuff that matters.

A comment on “I would like to maintain the floppy driver”. Parent comment

Re:“I would like to maintain the floppy driver” by unilynx on Friday August 02, 2019 @05:53PM (#20596943)
Probably not... any form of partial encryption (ie not the full block device) needs to make sure no sensitive data leaks outside the encrypted parts (/tmp and swap? /var if you only encrypt /home?)

Depending on the implementation the filesystem metadata may also reveal more data than needed. The attacker can probably ignore that 4GB file that wasn't modified for a year (a downloaded ISO image?) but that 20KB file that was recently modified might be that passwords.txt he was looking for..

[ Parent | on HN ]
Re:“I would like to maintain the floppy driver” by tptacek on Friday August 02, 2019 @06:38PM (#20597238)
It depends on what your biggest concern is. Large scale metadata analysis is a concern that block-level encryption does a better job of than "file filter encryption" does. Authenticated encryption, which prevents people from bitflipping your init scripts into bindshells if you lose access to your laptop for a few minutes, is something that file encryption addresses and block encryption basically doesn't.

The important thing is that you don't really have to choose; a true encrypted filesystem can give you both things. Block-level encryption can't.

[ Parent | on HN ]