Disk drive encrytion - bad idea?

[mikemex]

Hi,

I fail to see what full disk encryption brings to the table, having the option to simply put an ATA password on the drive. It seems to me that such technologies make it even easier for hackers to use ransomware against you. Or make your data more prone to catastrophic loss / corruption if your system begins to fail / has a bug.

All in all, the most likely negative scenario is that you do something wrong yourself and you're locked out of your own data. Besides, I think the chances of finding someone capable of circumventng disk encryption are far higher than of finding someone capable of breaking into an ATA password protected drive. If for anything, because the former can be done remotely, and the second only physically.

Or am I missing something?

[unix_joe]

In practice, on modern SSD's, they are the exact same thing.

You have to trust the hardware on some level, which has proven to be problematic. Hence the rise of secondary authentication measures like TPM, which distributes trust among components made by different manufacturers.

The attack vector comes in when you add remote management. McAfee, Symantec, and Bitlocker allow this.

But for that kind of infrastructure, you are talking a large corporation willing to pay for such services, and they assume the risk not in terms of data, but in terms of the insurance payout from the vendor when the data is lost.

For a personal user, normal FDE given by the OS is sufficient enough. The benefit of not using the ATA encryption is that, one can remove the drive, use dd or one of the pretty front ends (Clonezilla, etc) to mirror the drive to another one sector by sector and it the other drive will work with the same password. A nice out of band backup system.

[elka.]

> I fail to see what full disk encryption brings to the table, having the option to simply put an ATA password on the drive.

Not all computers have a way of entering ATA password. If your computer quits working you may be unable to read the drive in another computer.

Full disk encryption that is done in software doesn't have this issue.

FDE does not protect you from malware or ransomware. for this you need backups.