Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Unsafe Advice (Score 1) 91

Any marginal blocks mapped out before you encrypt will remain unencrypted and may be available to a determined attacker. Same goes for hard drives, and SATA secure erase is not provably trustworthy. Always encrypt your storage before you put any data on it. If you do not trust your hardware AES to not be backdoored then use software crypto.

Yes, the safest approach is to enable encryption just after you get the device (after using it for a few minutes to accumulate some randomness in the Linux randomness pool, so you get a good key). If you don't, totally wiping it is more or less impossible, though the odds of anything significant surviving either the normal wipe or the encrypt & wipe (which probably won't actually do any more than the wipe) are pretty small.

Comment Re:usually will not do the sdcard partition (Score 1) 91

Last time I checked the standard Android encryption will not do the sdcard partition (I mean not the physical card, but the partition on the internal flash, usually the biggest chunk of it, like let's say 11 out of 16GB).

I'm pretty sure that's not true, because it would make device encryption pretty much useless. A glance at the code certainly appears to show that it encrypts all volumes, but maybe /sdcard somehow gets excluded from the list? I'll ask my colleague, who "owns" disk encryption for Android at Google, tomorrow and post a followup.

I'll also note that none of the devices I have handy (Galaxy Nexus, Nexus 4, Nexus 5, Nexus 7 1st & 2nd gen, Nexus 10, Moto X, Moto RAZR M, Samsung Note 2) even have an /sdcard partition, exactly. They all mount their data partition on /data, and /data is definitely included in device encryption. In fact, it and /cache are the primary targets of device encryption (/system doesn't matter).

Comment The math of retina displays (Score 1) 129

Human visual acuity in a healthy human eyeball can discern features as tiny as 30-arcseconds in size. If you holding a retina display device 30 centimeters away from your face, 30 arc-seconds is only 48 micrometers at that distance, while retina displays use a resolution of 78 micrometers. Further, because the Nyquist-Shannon sampling theorem suggests that you will need at to sample at at least double the highest frequency of a signal to receive the signal with minimal distortion, suggesting that a true retina display would need pixels that are only 24micrometers in size, and not 78.

So basically, increase the resolution by a factor of slightly more than three, and then you're looking at something that you could truly call "retina".

Comment Re:I've always thought that the best way for Israe (Score 1) 379

Their not allowed to repair the buildings as concrete is on the list of goods that Israel prevents from being imported:

Seriously? Let's think about this:

He says if Hamas stops with the rockets, they can use the money to make repairs to buildings.
You say "but they can't fix stuff because they can't get concrete".
Israel says they can't import concrete because they keep launching rockets.

Hrm. I don't know about you, but I think I see a solution somewhere in there.

Even during the last ceasefire the blockade was still in effect so it is not as simple as you suggest.

Comment Re:Snowden's Patriotism is Gaining Acceptance (Score 1) 231

It has been my observation that the people who have blistering hatred for Snowden, are the kinds of people who totally embrace jingoism.

But there are also those who don't have a blistering hatred, yet still feel that he broke the law and should be accountable. I find these people to be especially common among those who themselves are or have been under legal and moral obligations to preserve US government secrets and are appalled that Snowden essentially dumped a huge pile of unsifted sensitive data on the Guardian and trusted them to keep it secure and behave responsibly.

These people largely agree with the need to publish some of the data, but find dumping all of it to be criminally irresponsible.

I think there are a lot more people like that than those who have the blistering hatred you mention. FWIW, my own take (as someone who once held a Top Secret clearance) is that Snowden's action was necessary, that it was infeasible for him to properly vet and carefully release the data, that the news agencies have done a good job and been responsible, and that whatever damage it may have done is far more than offset by the good that it has done. So on balance I consider him a hero. But I do know a lot of people whose concern about what he did tips the balance the other way, even though they don't "have blistering hatred".

Comment Re:Snowden / Binney 2016 (Score 1) 231

Except Snowden is 31 and you must be 35 to meet the candidacy requirement for POTUS.

It also helps to be able to set foot on US soil without being arrested. Not a constitutional requirement, per se, but a fairly important practical one. Otherwise even if you win you have to figure out how to sneak into the country and your own inauguration so you can get sworn in -- and acquire the ability to pardon yourself -- before being body slammed to the ground, thrown into the back of a black Suburban and transported to Gitmo for waterboarding.

Comment Re:What the fuck are they supposed to do? (Score 3, Funny) 123

What's the problem with being good at what you do? So there are 1% of researchers who are really fucking good at what they do. They aren't just good, they are REALLY FUCKING GOOD. They are top 1% good. They are THE BEST IN THE WORLD. So why should we be surprised that they have such an impact?

They are getting 99% of the academic tail, too.

Comment Re:Full-disk wipe or only current data? (Score 4, Insightful) 91

Who gives a shit what the documentation says. Actual implementation is what matters.

Absolutely. So, look at the source: https://android.googlesource.c...

That file contains the code that generates the master key, derives the key encryption key used to protect it (using scrypt), stores the protected master key, and configures dm_crypt with the master key.

Some functions to look at:

- create_encrypted_random_key(), which creates the master key (reading from /dev/urandom).
- encrypt_master_key(), which derives a KEK from your password and uses it to encrypt the master key.
- decrypt_master_key(), which does the reverse.
- create_crypto_blk_dev(), which creates dm_crypt block device.
- cryptfs_setup_volume(), which mounts an encrypted block device.
- cryptfs_enable_inplace(), which encrypts an existing file system.

Do you really trust a mobile platform to be faithful to the documentation when you're trying to wipe a partition (which could easily be implemented directly but isn't) by first encrypting all data and then throwing away the key?

The device doesn't know you're trying to wipe. It knows that you (a) requested full disk encryption and then later (b) requested a wipe. So it can't optimize (a) away. I suppose it's possible it could just lie and tell you "Yep, I'm encrypting" even though it isn't, but that's the sort of thing that would definitely get noticed by security analysts and gleefully published.

Slashdot Top Deals

Anyone can make an omelet with eggs. The trick is to make one with none.

Working...