mirror of
https://github.com/privacyguides/privacyguides.org.git
synced 2024-12-17 20:04:40 -05:00
update: Refine OS Encryption section (#2805)
Signed-off-by: fria <138676274+friadev@users.noreply.github.com> Signed-off-by: Daniel Gray <dngray@privacyguides.org>
This commit is contained in:
redoomed1
Daniel Gray
parent
d4f8370fc3
commit
9d05fe7cb2
@ -9,7 +9,7 @@ cover: encryption.webp
|
||||
|
||||
## Multi-platform
|
||||
|
||||
The options listed here are multi-platform and great for creating encrypted backups of your data.
|
||||
The options listed here are available on multiple platforms and great for creating encrypted backups of your data.
|
||||
|
||||
### Cryptomator (Cloud)
|
||||
|
||||
@ -114,13 +114,13 @@ When encrypting with VeraCrypt, you have the option to select from different [ha
|
||||
|
||||
Truecrypt has been [audited a number of times](https://en.wikipedia.org/wiki/TrueCrypt#Security_audits), and VeraCrypt has also been [audited separately](https://en.wikipedia.org/wiki/VeraCrypt#VeraCrypt_audit).
|
||||
|
||||
## OS Full Disk Encryption
|
||||
## Operating System Encryption
|
||||
|
||||
<small>Protects against the following threat(s):</small>
|
||||
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
||||
|
||||
For encrypting the drive your operating system boots from, we generally recommend enabling the encryption software that comes with your operating system rather than using a third-party tool. This is because your operating system's native encryption tools often make use of OS and hardware-specific features like the [secure cryptoprocessor](https://en.wikipedia.org/wiki/Secure_cryptoprocessor) in your device to protect your computer against more advanced physical attacks. For secondary drives and external drives which you *don't* boot from, we still recommend using open-source tools like [VeraCrypt](#veracrypt-disk) over the tools below, because they offer additional flexibility and let you avoid vendor lock-in.
|
||||
Built-in OS encryption solutions generally leverage hardware security features such as a [secure cryptoprocessor](basics/hardware.md#tpmsecure-cryptoprocessor). Therefore, we recommend using the built-in encryption solutions for your operating system. For cross-platform encryption, we still recommend [cross-platform tools](#multi-platform) for additional flexibility and to avoid vendor lock-in.
|
||||
|
||||
### BitLocker
|
||||
|
||||
@ -128,7 +128,7 @@ For encrypting the drive your operating system boots from, we generally recommen
|
||||
|
||||
{ align=right }
|
||||
|
||||
**BitLocker** is the full volume encryption solution bundled with Microsoft Windows. The main reason we recommend it for encrypting your boot drive is because of its [use of TPM](https://learn.microsoft.com/windows/security/information-protection/tpm/how-windows-uses-the-tpm). ElcomSoft, a forensics company, has written about this feature in [Understanding BitLocker TPM Protection](https://blog.elcomsoft.com/2021/01/understanding-BitLocker-tpm-protection).
|
||||
**BitLocker** is the full volume encryption solution bundled with Microsoft Windows that uses the Trusted Platform Module ([TPM](https://learn.microsoft.com/windows/security/information-protection/tpm/how-windows-uses-the-tpm)) for hardware-based security.
|
||||
|
||||
[:octicons-info-16:](https://learn.microsoft.com/windows/security/information-protection/BitLocker/BitLocker-overview){ .card-link title="Documentation" }
|
||||
|
||||
@ -136,7 +136,7 @@ For encrypting the drive your operating system boots from, we generally recommen
|
||||
|
||||
</div>
|
||||
|
||||
BitLocker is [only supported](https://support.microsoft.com/windows/turn-on-device-encryption-0c453637-bc88-5f74-5105-741561aae838) on Pro, Enterprise and Education editions of Windows. It can be enabled on Home editions provided that they meet the prerequisites.
|
||||
BitLocker is [officially supported](https://support.microsoft.com/windows/turn-on-device-encryption-0c453637-bc88-5f74-5105-741561aae838) on the Pro, Enterprise, and Education editions of Windows. It can be enabled on Home editions provided that they meet the following prerequisites.
|
||||
|
||||
<details class="example" markdown>
|
||||
<summary>Enabling BitLocker on Windows Home</summary>
|
||||
@ -186,7 +186,7 @@ Backup `BitLocker-Recovery-Key.txt` on your Desktop to a separate storage device
|
||||
|
||||
{ align=right }
|
||||
|
||||
**FileVault** is the on-the-fly volume encryption solution built into macOS. FileVault is recommended because it [leverages](https://support.apple.com/guide/security/volume-encryption-with-filevault-sec4c6dc1b6e/web) hardware security capabilities present on an Apple silicon SoC or T2 Security Chip.
|
||||
**FileVault** is the on-the-fly volume encryption solution built into macOS. FileVault takes advantage of the [hardware security capabilities](os/macos-overview.md#hardware-security) present on an Apple silicon SoC or T2 Security Chip.
|
||||
|
||||
[:octicons-info-16:](https://support.apple.com/guide/mac-help/encrypt-mac-data-with-filevault-mh11785/mac){ .card-link title="Documentation" }
|
||||
|
||||
@ -194,7 +194,7 @@ Backup `BitLocker-Recovery-Key.txt` on your Desktop to a separate storage device
|
||||
|
||||
</div>
|
||||
|
||||
We recommend storing a local recovery key in a secure place as opposed to using your iCloud account for recovery.
|
||||
We advise against using your iCloud account for recovery; instead, you should securely store a local recovery key on a separate storage device.
|
||||
|
||||
### Linux Unified Key Setup
|
||||
|
||||
@ -376,7 +376,7 @@ We suggest [Canary Mail](email-clients.md#canary-mail-ios) for using PGP with em
|
||||
|
||||
{ align=right }
|
||||
|
||||
**GPG Suite** provides OpenPGP support for [Apple Mail](email-clients.md#apple-mail-macos) and macOS.
|
||||
**GPG Suite** provides OpenPGP support for [Apple Mail](email-clients.md#apple-mail-macos) and other email clients on macOS.
|
||||
|
||||
We recommend taking a look at their [First steps](https://gpgtools.tenderapp.com/kb/how-to/first-steps-where-do-i-start-where-do-i-begin-setup-gpgtools-create-a-new-key-your-first-encrypted-email) and [Knowledge Base](https://gpgtools.tenderapp.com/kb) for support.
|
||||
|
||||
@ -394,7 +394,7 @@ We recommend taking a look at their [First steps](https://gpgtools.tenderapp.com
|
||||
|
||||
</div>
|
||||
|
||||
Currently, GPG Suite does [not yet](https://gpgtools.com/sonoma) have a stable release for macOS Sonoma.
|
||||
Currently, GPG Suite does [not yet](https://gpgtools.com/sequoia) have a stable release for macOS Sonoma and later.
|
||||
|
||||
### OpenKeychain
|
||||
|
||||
@ -402,7 +402,7 @@ Currently, GPG Suite does [not yet](https://gpgtools.com/sonoma) have a stable r
|
||||
|
||||
{ align=right }
|
||||
|
||||
**OpenKeychain** is an Android implementation of GnuPG. It's commonly required by mail clients such as [Thunderbird](email-clients.md#thunderbird) and [FairEmail](email-clients.md#fairemail-android) and other Android apps to provide encryption support. Cure53 completed a [security audit](https://openkeychain.org/openkeychain-3-6) of OpenKeychain 3.6 in October 2015. Technical details about the audit and OpenKeychain's solutions can be found [here](https://github.com/open-keychain/open-keychain/wiki/cure53-Security-Audit-2015).
|
||||
**OpenKeychain** is an implementation of GnuPG for Android. It's commonly required by mail clients such as [Thunderbird](email-clients.md#thunderbird), [FairEmail](email-clients.md#fairemail-android), and other Android apps to provide encryption support.
|
||||
|
||||
[:octicons-home-16: Homepage](https://openkeychain.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://openkeychain.org/help/privacy-policy){ .card-link title="Privacy Policy" }
|
||||
@ -418,6 +418,8 @@ Currently, GPG Suite does [not yet](https://gpgtools.com/sonoma) have a stable r
|
||||
|
||||
</div>
|
||||
|
||||
Cure53 completed a [security audit](https://openkeychain.org/openkeychain-3-6) of OpenKeychain 3.6 in October 2015. The published audit and OpenKeychain's solutions to the issues raised in the audit can be found [here](https://github.com/open-keychain/open-keychain/wiki/cure53-Security-Audit-2015).
|
||||
|
||||
## Criteria
|
||||
|
||||
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
||||
|
||||
@ -121,7 +121,7 @@ Decide whether you want personalized ads based on your usage.
|
||||
|
||||
##### FileVault
|
||||
|
||||
On modern devices with a Secure Enclave (Apple T2 Security Chip, Apple silicon), your data is always encrypted, but is decrypted automatically by a hardware key if your device doesn't detect it's been tampered with. Enabling FileVault additionally requires your password to decrypt your data, greatly improving security, especially when powered off or before the first login after powering on.
|
||||
On modern devices with a Secure Enclave (Apple T2 Security Chip, Apple silicon), your data is always encrypted, but is decrypted automatically by a hardware key if your device doesn't detect it's been tampered with. Enabling [FileVault](../encryption.md#filevault) additionally requires your password to decrypt your data, greatly improving security, especially when powered off or before the first login after powering on.
|
||||
|
||||
On older Intel-based Mac computers, FileVault is the only form of disk encryption available by default, and should always be enabled.
|
||||
|
||||
@ -233,7 +233,7 @@ We recommend against installing third-party antivirus software as they typically
|
||||
|
||||
##### Backups
|
||||
|
||||
macOS comes with automatic backup software called [Time Machine](https://support.apple.com/HT201250), so you can create encrypted backups to an external or network drive in the event of corrupted/deleted files.
|
||||
macOS comes with automatic backup software called [Time Machine](https://support.apple.com/HT201250), so you can create encrypted backups to an external drive or a network drive in the event of corrupted/deleted files.
|
||||
|
||||
### Hardware Security
|
||||
|
||||
|
||||
@ -404,14 +404,16 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
|
||||
### Encryption Software
|
||||
|
||||
<details class="info" markdown>
|
||||
<summary>Operating System Disk Encryption</summary>
|
||||
<summary>Operating System Encryption</summary>
|
||||
|
||||
For encrypting your operating system drive, we typically recommend using whichever encryption tool your operating system provides, whether that is **BitLocker** on Windows, **FileVault** on macOS, or **LUKS** on Linux. These tools are included with the operating system and typically use hardware encryption elements such as a TPM that other full-disk encryption software like VeraCrypt do not. VeraCrypt is still suitable for non-operating system disks such as external drives, especially drives that may be accessed from multiple operating systems.
|
||||
For encrypting your OS drive, we typically recommend using the encryption tool your operating system provides, whether that is **BitLocker** on Windows, **FileVault** on macOS, or **LUKS** on Linux. These tools are included with the operating system and take advantage of hardware encryption elements such as a [secure cryptoprocessor](basics/hardware.md/#tpmsecure-cryptoprocessor).
|
||||
|
||||
[Learn more :material-arrow-right-drop-circle:](encryption.md#os-full-disk-encryption)
|
||||
[Learn more :material-arrow-right-drop-circle:](encryption.md#operating-system-encryption)
|
||||
|
||||
</details>
|
||||
|
||||
#### Cross-platform Tools
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
- { .twemoji loading=lazy } [Cryptomator](encryption.md#cryptomator-cloud)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user