Re:DigitalOcean not destroying droplets securely, data is co...
by ceejayoz on Sunday March 30, 2014 @11:59PM
(#7499530)
Or run on an encrypted volume that you scrub prior to killing off the instance.
[ Parent
| on HN ]
Re:DigitalOcean not destroying droplets securely, data is co...
by nikcub on Monday March 31, 2014 @12:29AM
(#7499632)
you shouldn't rely on your hosting provider to secure/shred your data, do it yourself.
encfs is really easy to setup and use, everybody should be using it, especially on VPS's:
$ sudo apt-get install encfs
or: $ sudo yum -y install fuse-encfs
then: $ sudo encfs ~/.encrypted /home/private
the /home/private folder is where you place your files (web sites, etc.). ~/.encrypted is where the encrypted version is stored. when prompted hit 'p' for the default paranoid mode, enter a password and you're done. read more about it on the homepage[0]When you are done with a server and need to secure delete, use shred -- which is installed on both RHEL and Debian based distributions:
$ sudo shred -fz ~/.encrypted
$ sudo shred -fz /home/private
[0] http://www.arg0.net/encfs
Re:DigitalOcean not destroying droplets securely, data is co...
by coolj on Monday March 31, 2014 @01:51AM
(#7499870)
https://defuse.ca/audits/encfs.htm
https://defuse.ca/audits/ecryptfs.htm
Probably better to use ecryptfs or dm-crypt.
Re:DigitalOcean not destroying droplets securely, data is co...
by ars on Monday March 31, 2014 @06:58AM
(#7500671)
encfs is not completely transparent, so don't just blindly do this, you need to check that your data/workflow does not interact badly.
Two examples: (Depending on the settings you choose) hard links might not work at all, and renaming can be very very slow. Both of these are common in certain applications.
Re:DigitalOcean not destroying droplets securely, data is co...
by userbinator on Monday March 31, 2014 @12:56AM
(#7499724)
Wouldn't an encrypted volume be essentially random data to anyone who doesn't have the key? So all you'd need to do is scrub any traces of the key itself.