Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

After this https://borncity.com/win/2018/11/06/ssd-vulnerability-breaks...

Microsoft patched out support for self encrypting drives.



Quite dumb considering this was an issue with pretty much a single, low-cost consumer vendor (Crucial?).

If nothing else, use it in combination - the encryption of OPAL drives is always active anyway, all that changes when the feature is "active" is whether the key is stored as-is on the controller or whether its protected by a passphrase.


Both Crucial and Samsung, which produce a significant number of OEM drives for the likes of Dell, HP, etc.


It was two entirely seperate vulnerabilities.

The Crucial drive did not have any association between the encryption key and the passphrase, making it possible to bypass encryption.

The Samsung drive had an issue where when setting a passphrase, wear leveling could cause the old unprotected key to still exist on a flash bank (not normally accessible) until that bank got reused.

Only one of them is horrible incompetence - the other is bad but fixable and expires on its own after a bit of use.


And in either case, it doesn't matter in the eyes of Microsoft. Drive manufactures couldn't be trusted -- and honestly, the amount of "awesome" software coming from component manufactures is pretty small.

The drive manufactures software was making Microsoft look bad. The advantage of SED was small when we have AES-NI.


True, Microsoft can't be expected to make software that is good for the sake of being good. Maybe they'll consider now Microsoft looks bad on their own - OPAL2.0 on modern drives is quite a different beast than what they pulled out of.

Note that the advantage is still very large - easily 20% and an associated hit to battery life, depending on the specific cipher mode and access pattern. Without AES-NI it just wouldn't be practical to even consider AES-based FDE.


I like using OPAL on my low powered laptop (8th gen i3), since Bitlocker eats some of that prescious CPU. Testing showed the impact of BL to be about 20% worse for the write speed and somewhere around a few percent read.

Not earth shattering, but for SATA3 era SSDs, it's not nothing either. The old 850 EVOs work well, and they're quality disks IME.


It's actually still in there.

Now, drives with eDrive, as MS calls it, are becoming harder to find. It is no longer advertised (as native 4k sectors aren't either...). Soon it'll be dropped all together.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: