Comments on: What’s in my Encrypted ~/Private directory? http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/ Sat, 22 Aug 2009 20:09:18 +0000 http://wordpress.com/ hourly 1 By: (``-_-´´) BUGabundo http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-84 (``-_-´´) BUGabundo Mon, 06 Oct 2008 17:16:30 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-84 @Dustin I have no preference at this moment. I've been using encFS for several years on Ubuntu. The change from Hardy to Ibex gave me some problems (https://bugs.launchpad.net/ubuntu/+source/encfs/+bug/234818) because the default algorithm on hardy has been replaced on Intrepid. ecryptfs is NEW, so I'm just asking around. maybe both can improve from each other. @Dustin I have no preference at this moment.
I’ve been using encFS for several years on Ubuntu.
The change from Hardy to Ibex gave me some problems (https://bugs.launchpad.net/ubuntu/+source/encfs/+bug/234818) because the default algorithm on hardy has been replaced on Intrepid.

ecryptfs is NEW, so I’m just asking around. maybe both can improve from each other.

]]> By: Dustin Kirkland http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-83 Dustin Kirkland Mon, 06 Oct 2008 14:54:39 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-83 On October 6, 2008 at 12:33 pm, BUGabundo wrote: > Conclusion: both ecrypt and encFS seem to have the same > hit, performance wise; > encFS is more flexible as it allows you to choose the > level of encryption, and where to put the folder, but > ecrypt works as soon as you login This is open source world... I welcome you to use encFS instead, if that's your preference. :-Dustin On October 6, 2008 at 12:33 pm, BUGabundo wrote:
> Conclusion: both ecrypt and encFS seem to have the same
> hit, performance wise;
> encFS is more flexible as it allows you to choose the
> level of encryption, and where to put the folder, but
> ecrypt works as soon as you login

This is open source world… I welcome you to use encFS instead, if that’s your preference.

:-D ustin

]]> By: Dustin Kirkland http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-81 Dustin Kirkland Mon, 06 Oct 2008 14:47:52 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-81 pascalandreas wrote: > Will this also be available in Kubuntu Intrepid? Yes, of course. There should be no difference for Kubuntu, Xubuntu, Mythbuntu, etc. :-Dustin pascalandreas wrote:
> Will this also be available in Kubuntu Intrepid?

Yes, of course. There should be no difference for Kubuntu, Xubuntu, Mythbuntu, etc.

:-D ustin

]]> By: (``-_-´´) BUGabundo http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-80 (``-_-´´) BUGabundo Mon, 06 Oct 2008 12:33:45 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-80 @Dustin: last night i made a new encFS folder and activated my ecrypt/Private folder. encFS was made with Paranoid settings; I used bonnie++ and dd (timeout 300 dd if=/dev/zero of=lixo and timeout 300 dd if=/dev/urandom of=lixo) with zero, both systems ran between 6 and 10 MiB/s. with urandom i got around 3-4MiB/s. on an encrypted folder values from 3 tests were between 14 and 27 MiB/s. Conclusion: both ecrypt and encFS seem to have the same hit, performance wise; encFS is more flexible as it allows you to choose the level of encryption, and where to put the folder, but ecrypt works as soon as you login. @Dustin: last night i made a new encFS folder and activated my ecrypt/Private folder.

encFS was made with Paranoid settings;

I used bonnie++ and dd (timeout 300 dd if=/dev/zero of=lixo and timeout 300 dd if=/dev/urandom of=lixo)

with zero, both systems ran between 6 and 10 MiB/s.
with urandom i got around 3-4MiB/s.
on an encrypted folder values from 3 tests were between 14 and 27 MiB/s.

Conclusion: both ecrypt and encFS seem to have the same hit, performance wise;
encFS is more flexible as it allows you to choose the level of encryption, and where to put the folder, but ecrypt works as soon as you login.

]]> By: Dustin Kirkland http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-78 Dustin Kirkland Sat, 04 Oct 2008 21:06:50 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-78 On October 4, 2008 at 6:40 pm, qense wrote: > What happens when you use the fast-user-switch-applet to > quickly let e.g. a guest use your computer? You are > still logged on, so it would make sense to keep the > encrypted directory mounted. > However, this would mean that the encryption barrier > wouldn’t work in that case. Is that true? See my response above regarding SELinux and AppArmor as enforcers of Mandatory Access Controls. Even if your private directory is mounted, guest users will not be able to access it because of Discretionary Access Controls (ie, the permissions on ~/Private are 700, rwx------). That said, I will look into hooking the Guest-Session applet to run umount.ecryptfs_private. :-Dustin On October 4, 2008 at 6:40 pm, qense wrote:
> What happens when you use the fast-user-switch-applet to
> quickly let e.g. a guest use your computer? You are
> still logged on, so it would make sense to keep the
> encrypted directory mounted.
> However, this would mean that the encryption barrier
> wouldn’t work in that case. Is that true?

See my response above regarding SELinux and AppArmor as enforcers of Mandatory Access Controls.

Even if your private directory is mounted, guest users will not be able to access it because of Discretionary Access Controls (ie, the permissions on ~/Private are 700, rwx——).

That said, I will look into hooking the Guest-Session applet to run umount.ecryptfs_private.

:-D ustin

]]> By: Dustin Kirkland http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-77 Dustin Kirkland Sat, 04 Oct 2008 20:36:11 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-77 On October 4, 2008 at 4:48 pm, BUGabundo wrote: > What is your opinion on encFS? > I’ve been using it for years and a I really like it. > Is there any benchmark between the two? Please see: * https://answers.launchpad.net/ecryptfs/+question/46302 In brief, ecryptfs is very similar to encfs, however, eCryptfs exists within the kernel, while encfs runs in userspace (thus, more context switching, perhaps some performance impact). I do not have any benchmarks. :-Dustin On October 4, 2008 at 4:48 pm, BUGabundo wrote:
> What is your opinion on encFS?
> I’ve been using it for years and a I really like it.
> Is there any benchmark between the two?

Please see:
* https://answers.launchpad.net/ecryptfs/+question/46302

In brief, ecryptfs is very similar to encfs, however, eCryptfs exists within the kernel, while encfs runs in userspace (thus, more context switching, perhaps some performance impact).

I do not have any benchmarks.

:-D ustin

]]> By: Dustin Kirkland http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-76 Dustin Kirkland Sat, 04 Oct 2008 20:29:17 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-76 On October 4, 2008 at 9:33 am, miohtama wrote: > It’s a major turn off and a security risk if you need > to manually symlink directories to protect your data - > this feature is not definitely end user feasible. If > you encrypt your data you expect it to be safe, > automatically. We're hoping to provide some graphical administration utilities for Jaunty. See: * https://bugs.launchpad.net/bugs/257901 > Why we need separate directory, why just we can’t > encrypt /home/whoever like OS X does? That was actually my original proposal at the Ubuntu Developer Summit in May of 2008 in Prague. However, it was deemed 'too aggressive' for Intrepid. The compromise was to provide a single encrypted directory where Ubuntu users could choose to copy or link their most sensitive data there. I will revisit the proposal in the December 2008 Ubuntu Developer Summit in Mountain View. :-Dustin On October 4, 2008 at 9:33 am, miohtama wrote:
> It’s a major turn off and a security risk if you need
> to manually symlink directories to protect your data –
> this feature is not definitely end user feasible. If
> you encrypt your data you expect it to be safe,
> automatically.

We’re hoping to provide some graphical administration utilities for Jaunty. See:
* https://bugs.launchpad.net/bugs/257901

> Why we need separate directory, why just we can’t
> encrypt /home/whoever like OS X does?

That was actually my original proposal at the Ubuntu Developer Summit in May of 2008 in Prague. However, it was deemed ‘too aggressive’ for Intrepid. The compromise was to provide a single encrypted directory where Ubuntu users could choose to copy or link their most sensitive data there. I will revisit the proposal in the December 2008 Ubuntu Developer Summit in Mountain View.

:-D ustin

]]> By: Dustin Kirkland http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-75 Dustin Kirkland Sat, 04 Oct 2008 20:19:00 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-75 On October 4, 2008 at 8:03, miekg wrote: > And how about backups? I do not turn my computer off > and I’m always logged in… this means this ~/Private > directory is available in unencrypted form. When my > backup runs this means the ~/Private directory will be > backed up in plain text (i.e. not encrypted). I have automated backups too. In my backup scripts, I have something like: umount.ecryptfs_private || exit 1 ... rsync -aP /home/kirkland remote:/backup/home/kirkland ... mount.ecryptfs_private Basically, I force an unmount of my private directory, and mount it back when I'm done. > What I need is the following: ONLY for my uid > ~/Private is uncrypted, for ALL OTHER (even root) > users it is encrypted. Absolutely, and that's on our to-do list in the ecryptfs project. However, this will need to be handled via MAC (Mandatory Access Control) provided by SELinux/AppArmor. We have a bug about this in Launchpad: * https://bugs.launchpad.net/ecryptfs/+bug/278290 :-Dustin On October 4, 2008 at 8:03, miekg wrote:
> And how about backups? I do not turn my computer off
> and I’m always logged in… this means this ~/Private
> directory is available in unencrypted form. When my
> backup runs this means the ~/Private directory will be
> backed up in plain text (i.e. not encrypted).

I have automated backups too. In my backup scripts, I have something like:

umount.ecryptfs_private || exit 1
…
rsync -aP /home/kirkland remote:/backup/home/kirkland
…
mount.ecryptfs_private

Basically, I force an unmount of my private directory, and mount it back when I’m done.

> What I need is the following: ONLY for my uid
> ~/Private is uncrypted, for ALL OTHER (even root)
> users it is encrypted.

Absolutely, and that’s on our to-do list in the ecryptfs project. However, this will need to be handled via MAC (Mandatory Access Control) provided by SELinux/AppArmor. We have a bug about this in Launchpad:

* https://bugs.launchpad.net/ecryptfs/+bug/278290

:-D ustin

]]> By: qense http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-74 qense Sat, 04 Oct 2008 18:40:43 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-74 What happens when you use the fast-user-switch-applet to quickly let e.g. a guest use your computer? You are still logged on, so it would make sense to keep the encrypted directory mounted. However, this would mean that the encryption barrier wouldn't work in that case. Is that true? What happens when you use the fast-user-switch-applet to quickly let e.g. a guest use your computer? You are still logged on, so it would make sense to keep the encrypted directory mounted.
However, this would mean that the encryption barrier wouldn’t work in that case. Is that true?

]]> By: Ubuntu Intrepid Ibex preview | Qense’s blog http://dustinkirkland.wordpress.com/2008/10/03/whats-in-my-encrypted-private-directory/#comment-73 Ubuntu Intrepid Ibex preview | Qense’s blog Sat, 04 Oct 2008 17:05:33 +0000 http://dustinkirkland.wordpress.com/?p=111#comment-73 [...] to start, this time about the contents of their ~/Private directory. One of those posts — What’s in my Encrypted ~/Private directory? — helped me a lot with setting up my [...] [...] to start, this time about the contents of their ~/Private directory. One of those posts — What’s in my Encrypted ~/Private directory? — helped me a lot with setting up my [...]

]]>