Hacker News Reader

>it could be a software issue

They can still do some tests. It's not like wiping the hard drive helps solve software issues.

>FDE is good for one loss of control; after that you should assume compromise.

If the threat model is a malicious actor, yes. If the threat model is accidental plaintext password leaking, there is a huge difference between the scenarios. I could construct a similar argument against password hashing on servers...

View on HN

>If the threat model is accidental plaintext password leaking, there is a huge difference between the scenarios.

That's just fear mongering.

Why would you not change your password before taking it in? You should be changing it regularly anyway, and you shouldn't be using that password in more than one place. The idea of it leaking from a technician's database is irrelevant because you would change it as soon as you get the machine back.

Reply on news.ycombinator.com