update: Revamp full disk encryption section #2437

vandorsx · 2024-03-15T04:07:41Z

Changes in the order they appear:

Re-wrote the introduction to the FDE section.
- The information is the same, it just reads a bit better now.
- Added a note that FDE and FVE are generally used interchangeably. Previously, the term "full volume encryption" was used without a precursor.
Re-wrote the BitLocker card
- Immediately mention it's for Windows and it's proprietary.
- Make explicit mention of the hardware security TPM.
- Remove "The main reason we recommend it..." because generally all info stated supports a recommendation.
- Prominently state officially supported editions (pro, etc)
- Tell where to actually manage and enable BitLocker
- Information and guide on preboot authentication
  - I assume this will eventually be moved to update!: Windows guide #1659, but it's important so might as well get the info out now
- Improved the BitLocker on Windows Home guide
Re-wrote FileVault card
- Immediately mention it's for macOS and it's proprietary
- Mention secure enclave
- Tell where to manage and enable FileVault
- New logo
Re-wrote LUKS card
- Renamed it to LUKS, that's what it's known as
- Mention it's open-source
- State and elaborate on how it's a standard
- Tell where/how it can be managed (also linking to a faq)
- New logo

Up for discussion:

~~Maybe want to consider removing (or at least testing) the BitLocker on Home guide: update: Revamp full disk encryption section #2437 (comment)~~
It would be nice if someone more knowledgeable on LUKS could add some more context to encrypted containers — perhaps explaining what they are and what they do above the admonition.

I have disclosed any relevant conflicts of interest in my post.
I agree to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute my contribution as part of this project.
I am the sole author of this work.
I agree to the Community Code of Conduct.

netlify · 2024-03-15T04:10:15Z

✅ Deploy Preview for privacyguides ready!

Name	Link
🔨 Latest commit	`848b373`
🔍 Latest deploy log	https://app.netlify.com/sites/privacyguides/deploys/65f5e043d7481e00088adf3f
😎 Deploy Preview	https://deploy-preview-2437.preview.privacyguides.dev
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	4 paths audited Performance: 78 (🟢 up 2 from production) Accessibility: 91 (🔴 down 1 from production) Best Practices: 98 (no change from production) SEO: 90 (no change from production) PWA: - View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify site configuration.

dngray · 2024-03-15T05:17:18Z

docs/encryption.md

+
+</details>
+
+While BitLocker is not officially supported on Windows Home, it can be enabled on Home editions with a few extra steps.


Have we actually checked to see if this works? It did at one point but this indicates it might not #2407

Good question, I did see that issue. To me it read as if it worked except they accidentally did the process on a non-boot drive since their drive letters were weird.

Which is why I added:

+ This guide assumes the drive letter of your operating system drive is "C". If it is not, replace `c:` with the correct drive letter in the following commands.

Though maybe I'm interpreting what they're saying wrong.

There was also a thread https://discuss.privacyguides.net/t/enabling-bitlocker-on-the-windows-11-home-edition/13303/ about it. could just check in a VM

I went through the guide on a VM and it worked for me. I updated the instructions based on what I experienced (i.e., saving the recovery key to a .txt file didn't work for me).

The guide worked, my problem was that the drive letters were switched in the troubleshooter command prompt. I think the addition should explicitly mention the possibility of this.

or we could just point home users to MAS.

The guide worked, my problem was that the drive letters were switched in the troubleshooter command prompt. I think the addition should explicitly mention the possibility of this.

Where should this be mentioned? It's been a few months since I went through the guide, so I'm admittedly not too familiar with it anymore.

or we could just point home users to MAS.

MAS works well — there's no denying that. Though I think it's more of a iykyk thing rather than something to be recommend.

MAS works well — there's no denying that. Though I think it's more of a iykyk thing rather than something to be recommend.

Is what we're suggesting any less illegal?

(rebased)

docs/encryption.md

rollsicecream

Here are some little things to add:

docs/encryption.md

Co-authored-by: rollsicecream <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

IDON-TEXIST · 2024-07-26T18:18:44Z

I'm not sure whether the comments I've made create notifications, so check this.

IDON-TEXIST · 2024-07-28T04:14:59Z

docs/encryption.md

+
+</details>
+
+While BitLocker is not officially supported on Windows Home, it can be enabled on Home editions with a few extra steps.


MAS works well — there's no denying that. Though I think it's more of a iykyk thing rather than something to be recommend.

Is what we're suggesting any less illegal?

docs/encryption.md

Co-authored-by: IDON-TEXIST <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

redoomed1

Thanks for the improvements on the BitLocker guide!

I notice that there are some steps to configure Group Policy settings in the guide. It might be better to point readers to the relevant section in the Group Policy page of the Windows Overview (specifically, https://www.privacyguides.org/en/os/windows/group-policies/#operating-system-drives) in order to avoid duplicating content across multiple pages. Any settings that are mentioned in the BitLocker guide that aren't already in the Group Policy page could be added to the latter. (Ideally, the Group Policy page is the central hub for all things related to LGPO on the Privacy Guides site.)

This is probably not in the scope of this PR, but just mentioning it as a passing suggestion.

docs/encryption.md

Co-authored-by: redoomed1 <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

Signed-off-by: Jade van Dorsten <[email protected]>

IDON-TEXIST · 2024-07-31T02:45:08Z

I think it might make more sense to move the group policy stuff to this page. We wouldn't want readers to gloss over it and then decide to unencrypt and reencrypt their drives later because they realize they want AES-256. Those policies don't make much sense to enable unless you're using or planning to use Bitlocker, anyway.

rollsicecream

Some things to fix.

docs/encryption.md

Co-authored-by: rollsicecream <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

rollsicecream

Other things to fix...

docs/encryption.md

Co-authored-by: rollsicecream <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

kimg45 · 2024-09-21T06:06:39Z

docs/encryption.md

@@ -102,63 +102,118 @@ Truecrypt has been [audited a number of times](https://en.wikipedia.org/wiki/Tru

 ## OS Full Disk Encryption

-For encrypting the drive your operating system boots from, we generally recommend enabling the encryption software that comes with your operating system rather than using a third-party tool. This is because your operating system's native encryption tools often make use of OS and hardware-specific features like the [secure cryptoprocessor](https://en.wikipedia.org/wiki/Secure_cryptoprocessor) in your device to protect your computer against more advanced physical attacks. For secondary drives and external drives which you *don't* boot from, we still recommend using open-source tools like [VeraCrypt](#veracrypt-disk) over the tools below, because they offer additional flexibility and let you avoid vendor lock-in.
+Full disk encryption (FDE) is a comprehensive data encryption solution, encompassing the operating system and system files. FDE principally leverages hardware security features, such as a [secure cryptoprocessor](https://en.wikipedia.org/wiki/Secure_cryptoprocessor) (e.g., a [TPM](https://en.wikipedia.org/wiki/Trusted_Platform_Module)). Therefore, we recommend using the built-in FDE solutions for your operating system. For external drives, however, we still recommend [cross-platform tools](#multi-platform) for additional flexibility and to avoid vendor lock-in.


Nothing about FDE inherently has anything to do with using a TPM, the original point was to use built-in solutions instead of third party ones since those more likely take advantage of hardware security features. Also I don't like how this implies that encrypting the operating system necessarily makes it more secure, this isn't always the case especially when the operating system is protected by a good secure boot or verified boot.

kimg45 · 2024-09-21T06:07:25Z

docs/encryption.md

-For encrypting the drive your operating system boots from, we generally recommend enabling the encryption software that comes with your operating system rather than using a third-party tool. This is because your operating system's native encryption tools often make use of OS and hardware-specific features like the [secure cryptoprocessor](https://en.wikipedia.org/wiki/Secure_cryptoprocessor) in your device to protect your computer against more advanced physical attacks. For secondary drives and external drives which you *don't* boot from, we still recommend using open-source tools like [VeraCrypt](#veracrypt-disk) over the tools below, because they offer additional flexibility and let you avoid vendor lock-in.
+Full disk encryption (FDE) is a comprehensive data encryption solution, encompassing the operating system and system files. FDE principally leverages hardware security features, such as a [secure cryptoprocessor](https://en.wikipedia.org/wiki/Secure_cryptoprocessor) (e.g., a [TPM](https://en.wikipedia.org/wiki/Trusted_Platform_Module)). Therefore, we recommend using the built-in FDE solutions for your operating system. For external drives, however, we still recommend [cross-platform tools](#multi-platform) for additional flexibility and to avoid vendor lock-in.
+
+Note the terms full *disk* encryption and full *volume* encryption are often used interchangeably.


These aren't the same though. Full disk implies the entire disk is encrypted and Full Volume encryption just means a volume on the disk is encrypted. I think we should probably avoid using either of these terms and just call it encryption.

kimg45 · 2024-09-21T06:29:34Z

theme/assets/img/encryption-software/filevault.png

The one you deleted still shows up in Apple's marketing materials so I think we can leave it.

dngray reviewed Mar 15, 2024

View reviewed changes

Revamp full disk encryption section

82709fe

(rebased)

vandorsx force-pushed the os-fde branch from 9836735 to 82709fe Compare March 15, 2024 05:30

Re-link ElcomSoft article

636abc6

vandorsx marked this pull request as ready for review March 15, 2024 06:03

dngray added c:software self-hosted/decentralized software and related topics c:enhancements new features or other enhancements to the website itself labels Mar 15, 2024

Improve Windows Home BitLocker guide

ad8a778

vandorsx force-pushed the os-fde branch from bb180cf to ad8a778 Compare March 15, 2024 19:21

rollsicecream reviewed Mar 16, 2024

View reviewed changes

docs/encryption.md Outdated Show resolved Hide resolved

improve introductory wording of bitlocker and filevault cards

848b373

vandorsx force-pushed the os-fde branch from 5887bfa to 848b373 Compare March 16, 2024 18:09

jonaharagon force-pushed the main branch 17 times, most recently from 19d9058 to a909cf7 Compare March 29, 2024 04:57

jonaharagon force-pushed the main branch 8 times, most recently from 0a94f3f to d80af39 Compare April 11, 2024 17:36

dngray mentioned this pull request Apr 15, 2024

update!: Windows guide #1659

Open

dngray force-pushed the main branch from cb651ef to a5a2ed0 Compare June 11, 2024 08:13

rollsicecream suggested changes Jul 13, 2024

View reviewed changes

docs/encryption.md Outdated Show resolved Hide resolved

docs/encryption.md Outdated Show resolved Hide resolved

vandorsx and others added 2 commits July 15, 2024 14:48

Update docs/encryption.md

10cad19

Co-authored-by: rollsicecream <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

Update docs/encryption.md

0c3b9de

Co-authored-by: rollsicecream <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

IDON-TEXIST suggested changes Jul 28, 2024

View reviewed changes

Add instructions for determining correct drive letter

7fd360a

Co-authored-by: IDON-TEXIST <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

redoomed1 reviewed Jul 30, 2024

View reviewed changes

docs/encryption.md Outdated Show resolved Hide resolved

vandorsx and others added 2 commits July 30, 2024 13:17

Link to #multi-platform

e402f9b

Co-authored-by: redoomed1 <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

Merge branch 'main' into os-fde

5ee484b

Signed-off-by: Jade van Dorsten <[email protected]>

jonaharagon changed the title ~~Revamp full disk encryption section~~ update: Revamp full disk encryption section Aug 1, 2024

This comment was marked as off-topic.

Sign in to view

rollsicecream suggested changes Aug 8, 2024

View reviewed changes

docs/encryption.md Outdated Show resolved Hide resolved

docs/encryption.md Outdated Show resolved Hide resolved

docs/encryption.md Outdated Show resolved Hide resolved

docs/encryption.md Outdated Show resolved Hide resolved

docs/encryption.md Outdated Show resolved Hide resolved

vandorsx and others added 2 commits August 8, 2024 19:18

Apply suggestions from rolls' code review

aa837ce

Co-authored-by: rollsicecream <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

Merge branch 'main' into os-fde

7d24791

rollsicecream suggested changes Aug 9, 2024

View reviewed changes

docs/encryption.md Outdated Show resolved Hide resolved

docs/encryption.md Outdated Show resolved Hide resolved

docs/encryption.md Outdated Show resolved Hide resolved

vandorsx and others added 2 commits August 9, 2024 10:30

Apply suggestions from code review

b454e80

Co-authored-by: rollsicecream <[email protected]> Signed-off-by: Jade van Dorsten <[email protected]>

Merge branch 'main' into os-fde

3bb1f76

kimg45 requested changes Sep 21, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

update: Revamp full disk encryption section #2437

update: Revamp full disk encryption section #2437

vandorsx commented Mar 15, 2024 •

edited

Loading

netlify bot commented Mar 15, 2024 •

edited

Loading

dngray Mar 15, 2024

vandorsx Mar 15, 2024

dngray Mar 15, 2024

vandorsx Mar 15, 2024

IDON-TEXIST Jul 26, 2024 •

edited

Loading

IDON-TEXIST Jul 26, 2024

vandorsx Jul 27, 2024

IDON-TEXIST Jul 28, 2024

rollsicecream left a comment •

edited

Loading

IDON-TEXIST commented Jul 26, 2024

IDON-TEXIST Jul 28, 2024

redoomed1 left a comment •

edited

Loading

IDON-TEXIST commented Jul 31, 2024 •

edited

Loading

This comment was marked as off-topic.

rollsicecream left a comment

rollsicecream left a comment

kimg45 Sep 21, 2024

kimg45 Sep 21, 2024

kimg45 Sep 21, 2024


		</details>

		While BitLocker is not officially supported on Windows Home, it can be enabled on Home editions with a few extra steps.

update: Revamp full disk encryption section #2437

Are you sure you want to change the base?

update: Revamp full disk encryption section #2437

Conversation

vandorsx commented Mar 15, 2024 • edited Loading

netlify bot commented Mar 15, 2024 • edited Loading

✅ Deploy Preview for privacyguides ready!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

IDON-TEXIST Jul 26, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rollsicecream left a comment • edited Loading

Choose a reason for hiding this comment

IDON-TEXIST commented Jul 26, 2024

Choose a reason for hiding this comment

redoomed1 left a comment • edited Loading

Choose a reason for hiding this comment

IDON-TEXIST commented Jul 31, 2024 • edited Loading

This comment was marked as off-topic.

rollsicecream left a comment

Choose a reason for hiding this comment

rollsicecream left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vandorsx commented Mar 15, 2024 •

edited

Loading

netlify bot commented Mar 15, 2024 •

edited

Loading

IDON-TEXIST Jul 26, 2024 •

edited

Loading

rollsicecream left a comment •

edited

Loading

redoomed1 left a comment •

edited

Loading

IDON-TEXIST commented Jul 31, 2024 •

edited

Loading