Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>One thing of note here, don't put LUKS header on any kind of flash (like SSD) or SMR HDD.

Why not?



I'm guessing it is because it's harder to securely wipe SSD/flash drives [0]. Anyway I'm no expert on these topics.

[0]: https://wiki.archlinux.org/title/Securely_wipe_disk#Flash_me...


SSDs and drive-managed SMR HDDs do not immediately delete the data.

If the system is interrupted after data is deleted there is a good chance you can still get it back.

On a normal HDD you still have to wipe the data (ie. physically overwrite it half a dozen times). But this is not possible to execute reliably on SSD or drive-managed SMR HDD.


You can reset the SSD's internal encryption key via hdparm, too, once you're done "deleting" luks header. It takes somewhat longer time, but if the SSD firmware is not completely stupid, it will be the equivalent of deleting the LUKS header and running TRIM on the whole device afterwards.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: