I'm using full disk encryption, that is easily done using recent ubuntu installation images. I have a very strong password that I type in on boot to unlock the encrypted disk partitions. Is a strong linux login password needed if I have no network services running (I have a firewall turned on to reject all incoming connections)? It's really annoying to have to type in a 40+ character password everytime I lock my screen, like when I just want to take a 5 minute break from working and step away from my computer or leave it in the trunk of my car. I can't think of any way someone could do a very high speed brute force attack with just keyboard and mouse access. Is this true? If the machine is stolen, then someone can copy the disk and insert it into another machine, but if a very strong password is used on the full disk encryption, it seems like I am safe. Am I missing any possible hacking attempts? I am aware of a cold boot attack, but it seems to me like in this situation the length of the password doesn't really matter.
2 Answers
To answer your question: No. Physical attacks are going to be in a number of categories:
- Attacking the offline harddrive: This is the only point of using super long passwords.
- Attacking the offline RAM: This is the approach billybadass is discussing, and if it works, length of your password won't matter.
- Attacking the computer while on using the normal interface: This is the point of locking your computer and your computer wouldn't allow billions of password attempts per second, so no point in super long passwords.
- Attacking the computer while on through roundabout means: If someone is able to get around the normal login interface, like directly reading memory or CPU, your password length won't matter because your harddrive is already decrypted so they'd have full access.
This is why there is a very different standard for encryption passwords specifically versus your normal passwords. If you're the only user you might consider a full disk encryption which is prompted for once during the bootup and then have an easier user password.
Also, keep in mind that having no network services running and blocking incoming connections doesn't make you immune from that vector. You could download a virus accidentally which could send all your data to the attacker.
-
Any example on how someone could directly read the CPU or memory? It seems as though all your comments have pointed towards the same conclusions that I made, which was I should have a strong password on decrypting the disk at boot, and then a simpler unix login password. All other attack methods success seem to be unrelated to the length of the passwords anyway. As a bonus, can anyone confirm these conclusions are valid or provide any technical references? May 7, 2014 at 16:23
-
Getting a virus is a concern, but I think the risks are lower these days, particularly if all software that is installed is through a repository and/or signed by a reputable source. May 7, 2014 at 16:24
I feel the question is a bit vague but yet it has some points . The lock screen and disk encryption protects you mostly from physical (if you can call them so) attacks , meaning someone being in front of your computer literally . As you say computers can be stolen , and we all know that some data can be valuable . But I think cold boot attack is the method that hackers take data from RAM when the power is off and the encrypted disk don't offer more security . So in that sense the length of the pass doesn't really matters. As for brute force attacks 10 characters (that isn't really a word ) maybe with special characters and numbers , that covers it in the most part . Also I hear that linux kernel can be modified to keep some of the encrypted data in the CPU rather than the RAM with patches like TRESOR . If you conclude something more please share .
