Comment by Someone1234 | Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Parent Full thread

If the device is nonfunctional, and has encryption enabled (e.g. Bitlocker or FileVault) you MUST give them your password if you want it repaired and cannot afford to lose data. That is the COMMON CASE. A lot of shops/businesses aren't going to agree to a "stand over my shoulder while I work" clause least of all because your repair goes into a backlog until they can get to it.

> backup your data somewhere else, and wipe the device clean before handing it in.

Well over half the devices going in for repair cannot do that, that's why they're going in for repair.

> safe to assume that people who take their laptops to service shops know _nothing_ about security

Safe to assume that the people being judgmental online know nothing about the technical expertise of the average device owner.

I'd never take a device into somewhere with personal/sensitive information on it, but I recognize I am in an extremely privileged position in having the knowledge and expertise to do so. Even a fully broken screen wouldn't stop me from backing up/wiping. That isn't typical at all.

Probably the best setup to avoid this is to have something like Linux home folder encryption, and to set a separate account just for maintenance. If the device breaks, the technician is given the maintenance account password, not the one with access to your private stuff.

That's fine for hardware issues, which really wouldn't require the personal drive at all to fix. The issue arises for when a software-related issue occurs and the person who could do what you just described could probably also fix it themselves.

Macintosh computers have a "recovery startup" mode where it boots on a minimal OS partition (chosen by holding cmd-R right after power-on). All current Macs gets such a partition as part of normal OS install. This enables checking HW without having access to the customers data (i.e. encrypted partition).

All computers and phones should have such a recovery/repair mode.

I would not be surprised that if this continues to be a problem, then EU will mandate that repair should not be allowed to ask for password and that all devices must have a repair mode. It seems like a straightforward extension of GDPR.

>If the device is nonfunctional, and has encryption enabled (e.g. Bitlocker or FileVault) you MUST give them your password if you want it repaired and cannot afford to lose data.

That needs to change. We create two user accounts for all of the laptops we give out. Someone working on the device only needs to have access to one of the accounts. Windows is still too stupid to hide user data from other users. But at least it's something.

I was with you until the third point. People who know about security in technical fields are uncommon. No tot mention the average Joe .

I do not understand how this is being judgmental? How much do you know about the operation of a nuclear plant, or knee surgery? You are not expected to, same with cybersecurity where knowing to not share your password over a random phone call is already complicated to teach.

The technical guy you went to for help asking you "the numbers you type when the computer starts" sound completely legit.

On macOS at least, if you want to keep data encrypted, you can use encrypted disk images. If you want a more user friendly alternative, you can use https://www.espionageapp.com, which lets you encrypt folders (note: I wrote Espionage).

> If the device is nonfunctional, and has encryption enabled (e.g. Bitlocker or FileVault) you MUST give them your password if you want it repaired and cannot afford to lose data.

In corporate settings key escrow may be used. Windows for example can store bitlocker credentials in AD.

Reply on news.ycombinator.com