The VeraCrypt FAQ addresses your concern: https://www.veracrypt.fr/en/FAQ.html
Direct link to audit: https://blog.quarkslab.com/security-assessment-of-veracrypt-...
If you are doing the former, I used to use git-annex[1] for a similar purpose and liked it to keep track of where the encrypted versions of files are stored.
But git annex look nifty! The use case is large file? Correct ?
On Linux, I use age[1] (specifically, rage[2]) to encrypt sensitive files. I wrote a secret manager that uses the latter as an encryption backend[3], and I use `rage-mount` to mount (read-only) views of encrypted archives.
[1]: https://github.com/FiloSottile/age
At best, they probably just plug it into a black box and that box searches what it can for certain file hashes or names. Encrypted disk and it's game over.
Unless they're specifically looking for your data in particular - then all bets are off.
Not sure what they'd do with most modern laptops that have soldered drives though.
Happy to be corrected.
I believe they often ask for your passwords at the border too. I read that some borders also ask for your social media accounts, not sure if they want passwords for those too.
Would be interesting to set up a honeypot of sorts that records everything they do when they login to your device. Could even activate the camera and mic recording.
It seems unbelievable that it's accepted that they can walk away with your device and login as you and then do whatever they want.
I've seen on border patrol shows the guards going through messages on the phone looking for evidence of an intent to take paid work, etc. But it looks like a pretty surface-level manual search, at least the part they show on TV.
Surely somebody on here has had experience in this from the other side?
What evidence do you have, leaving aside speculation or conjecture? Can you state it any higher than it was possible they copied your hard drive? Is this a routine occurrence where you live?
Well I am pretty sure the personnel liked GP’s laptop colour and just wanted to admire it in privacy. Or maybe lick it as well; and possibly passing around among themselves so that more could lick it.
You didn’t mention the country, should I assume US of A? Or it happens elsewhere as well?
Ever been forced to open the laptop or phone as well?
Communication is pretty much always automatically covered nowadays.
Depends what you want to encrypt.
On Linux, there's LUKS as mentioned already.
So it's only on by default if you shelled dough out for one of those
You can have an encrypted folder, put it on Google Drive and then decrypt it from any of your devices. Even iOS will support it natively once you do the setup with the Cryptomator app.
Meanwhile, I've realised that my scanned receipts should also be encrypted, so I'll probably use a similar sync-between-encrypted-virtual-disks process with them. Unfortunately my first virtual disk is too small and I haven't yet checked how easy it will be to expand.
I'm mostly Windows, so I only really have to solve for that. Fortunately, Keepass is cross-platform (even works on my Pine Phone, along with Syncthing - same for my Android tablet, but my iPhone is trickier), so if I want to expand this to my Linux or Mac laptops it's not hard.
I was trying to solve saving authenticator seeds (which is something I regred not doing up to this point) securely outside of my main password manager. That was using an obscure archiver with a password protection option. This turned out to be way to clumsy to be practical. For small stuff like that, It's going in the password manager database for now.
For personal stuff, I can't do much about sophisticated attackers, pretty much only about random physical thieves who mostly just want the hardware.
Most likely scenario involving encryption: a laptop is lost/stolen, and some random thief/fence/buyer snoops around the drive to see if there's anything worth stealing. There isn't, but I'd feel violated to have some thief sifting through my personal stuff.
So, on laptops, I just use Linux LUKS.
On my custom Coreboot laptops, I have even the boot partition encrypted for LUKS, which seemed like a good idea at the time (I was peeved about Intel ME, and on a roll), but it's overkill for the random laptop thief threat. It also means I can't just move the drive to a system that doesn't have Coreboot with that feature set up.
Also, in general, try not to deny yourself access to your own data when you need it, in the process of denying it to others.
It also has some cool features like photo auto upload on mobile.
One thing it specifically lacks though it's FreeBSD support which leaves a huge gap in my personal workflow but it's unlikely to bother all but a handful of people in the world :)
I used to use Boxcryptor so I could have file-by-file encryption and sync directories full of encrypted files to various cloud storage services, but there was a know vulnerability with the way the crypto worked, were updates/changes to previously encrypted files could leak important info (I don't recall if it was cleartext or key hints?). It also had the problem of not encrypting directory names, so an attacker could see that you had a directory named "Plans For Super Secret Volcano Submarine Base" or "Darkweb purchase receipts".
I second this comment. Plus TrueCrypt has passed a serious source code audit. I'm not aware of any on-the-fly encryption system that has had the scrutiny of TrueCrypt. The main issue to be aware of is making certain you download the valid v7.1a source code or binaries. There are plenty of old trustworthy sites that have published the hashes of the source code tarballs or Windows binaries that you should check.
TrueCrypt works for me without any issue on current Linux systems, but I haven't tested it on recent Windows and macOS.
On Windows I just use the built-in Bitlocker encryption.
It is a bit annoying understanding what this means between Windows Home and Pro editions though.
On Home, it's not technically 'Bitlocker' - it's Device Encryption - hit Windows key & type 'device encryption' - if you see 'Device Encryption Settings', you should have it available. If you do not, it's probably not available on your device e.g. maybe you don't have a TPM, although I've had Windows machines that showed it as not available but then I was able to get it running with a bit of messing around and registry hacking.
It is still Bitlocker under the hood, but it's missing some features. You can get some of them by logging into your machine with a Microsoft account, but if you're running a local account (like I am) you get a more budget experience (e.g. I don't think there's an easy way to get the Bitlocker encryption key or have it backed up online).
If you only want to run local accounts, the easier and probably safer solution is to shell out for Windows Pro and take advantage of the full Bitlocker experience.
Especially convenient when you need to transmit the file over some untrusted medium like email, or if you just want to dump it in some cloud storage service and not worry about potential snooping.
Full-disk encryption from your OS vendor (FileVault, LUKS, whatever windows does) will accelerate this process.
You could build something more secure using the hello-world code for Go's Seal/Unseal crypto/ libraries, or Rust's Ring crate.
I encrypt (business related) ssh keys in our company's keepass database file.
I use keepassxc to keep all my sensitive information and syncthing to keep it synchronised between all my devices. Having it across all my devices is super handy and provides redundancy.
On my home nas, I'm still using GELI-encrypted zfs/zpools. I need to migrate it to a new zfs native encryption.
All of my backups get encrypted by restic before being uploaded.
For one-off files or things I want to share encrypted with someone, I'd use gpg.
Yes, state of Secure Boot with TPM (unlocks transparently) on *nix is awful.
What is the attack surface you're trying to hedge against? Are you afraid of someone gaining physical access to the device and ripping out the hard drive?
So basically I use the default encryption. When I need to move stuff from one computer to another I encrypt the files individually with GPG (using openPGP keys on smartcard or yubikey)
For individual files I would just use WinZip AES encryption which is very portable and atomic (so bit rot only impacts that single file no the fs).
FreeBSD, Linux, macOS, Windows: VeraCrypt -> (whatever)
FreeBSD: geli
Linux: XFS -> LVM2 -> LUKSv2 (dm-crypt +? dm-integrity) -> dm-raid (RAID 10) -> (lots of spinning rust)
macOS: FileVault 2
Windows: BitLocker
I would always be hesitant to disclose what type of crypto you are using, unless I guess you have nothing important. I think veracrypt, 7zip, openssl are good. Probably anything that has been recently audited. Just make sure you are offline when decrypting or encrypting or else it may defeat the purpose.
It uses envelope encryption with one-time password (OTP) authentication. I like to store data on the systems I own and just run backups regularly.