Hacker News new | ask | show | jobs
by tarnacious_ 3804 days ago
> It is very irresponsible to make statements like that.

I don't think so. It is irresponsible to suggest that you can secure a server you don't physically control. Full disk encryption doesn't protect your disk if someone can take a memory dump of the machine. Using sshd in an initramfs to receive the passphrase for an encrypted rootfs doesn't help if someone can modify the initramfs and wait for a the passphrase.

Encrypting your volumes does provide some security, but having to SSH into an initramfs to unlock the root partition has its own problems.

1 comments

Nothing is ever 100% safe and everything has its own problems. Initramfs-based full disk encryption is easy and effortless to do, and the value is most definitely greater than the effort required. I know multiple of cases where a simple FDE would have helped to greatly reduce the harm done.

You can host your own servers, but even that is not 100% safe. Someone can break to your hosting space and inspect the servers. And that of course requires quite a deal of effort.