TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: How can I easily but securely encrypt my laptop & emails?

13 点作者 codex_irl将近 12 年前

5 条评论

tptacek将近 12 年前
On a Mac:<p>Get up to very most recent OS X. A dot release in OS X disabled Firewire while the machine was sleeping, which is important because Firewire is basically a thin veneer around direct DMA access to system memory.<p>Enable FileVault. Unlike the feature that used to be called FileVault, modern FileVault is block-level AES-XTS encryption. (Before FileVault, my recommendation would have been to buy PGP WDE).<p>Tell the system to forget its key during sleep; the most recent rubber chicken to wave for this appears to be &quot;sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25&quot;.<p>Power down your machine whenever you can; don&#x27;t just shut the lid.<p>Buy Knox.app from AgileBits, which is a nice UI on top of the VFS-level block AES encryption OS X does. Create virtual disk drives for each of your clients, or each of your projects, or whatever. Create another for your mail; create another for personal documents. Give each a separate key (you&#x27;ll rarely have all of them unlocked or need to use all of them). Do not store the keys in the Keychain.<p>Copy ~&#x2F;Library&#x2F;Mail&#x27;s contents to the virtual disk you made for Mail and then replace ~&#x2F;Library&#x2F;Mail with a link to that disk; now, you&#x27;ll need to have that virtual disk unlocked to read your mail.<p>Disable sharing; make sure every box in &quot;Sharing&quot; under Preferences is unchecked.<p>Enable the firewall and block all incoming connections; Preferences-&gt;Security-&gt;Firewall, Enable, Options-&gt;Block All Incoming Connections.<p>Get GPGTools and GPGMail (the most recent official build supports Mt. Lion nicely). Install them, and use GPG, from your Mac only, to send mail.<p>Do not supply your GPG private key to <i>any</i> service, ever.<p>Uninstall Dropbox. Sorry. Dropbox is fantastic. We ban it wholesale.<p>Though we can&#x27;t use it for a variety of contractual reasons, I highly recommend Colin Percival&#x27;s Tarsnap for backup.
评论 #5847471 未加载
gasull将近 12 年前
- Use an open-source OS like Linux. Ubuntu is user-friendly. Windows isn&#x27;t safe: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;NSAKEY" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;NSAKEY</a><p>- Install the OS with full-disk encryption.<p>- If you use a service like Dropbox, use EncFS to encrypt everything in the cloud.<p>- For email, you&#x27;ll need to start using a mail user agent like Mutt or Thunderbird with PGP&#x2F;GnuPG. And then the problem will be that none of your friends use encryption anyway. Personally I&#x27;m telling everyone about using Bitmessage instead of email: <a href="https:&#x2F;&#x2F;bitmessage.org" rel="nofollow">https:&#x2F;&#x2F;bitmessage.org</a>
评论 #5846860 未加载
codex_irl将近 12 年前
Do we know what is secure against the likes of the NSA &#x2F; what encryption they can break today?<p>I understand this is almost impossible for us to accurately answer, just curious if we have any clues regarding their codebreaking capabilities in this regard.
gesman将近 12 年前
You cannot encrypt emails. Even if you&#x27;ll satisfy your urge for privacy - the originator of email or addressee of email will still contain unencrypted copies. So forget about it.<p>The presence of encryption will raise more suspicion and cause further investigation in your activities. So forget about it.
iamjustin将近 12 年前
TrueCrypt for the laptop, and GnuPG for emails.