Mostly true. It protects against access to the data when the encrypted volume is actively open.

Is it going to protect against physical access to active hardware in most cases? Probably not (though some might also l consider some layers such as immediately closing the volume and/or wiping keys if certain circumstances are net)

Is it still a good idea? Yes, as it offers reasonable protection for data (along with other layers) when one considers stuff like drive disposal etc.

There are several methods available for encrypting server disks without compromising availability but the best I’ve used is Network Bound Disk Encryption in the form of tang and clevis utilities. The encrypted server consults a tang server (or multiple servers using Shamir’s Secret Sharing) for the decryption key and then boots without user intervention. You can put a range of controls and redundancies around tang servers but the idea is they are only available on the local network.

Before you say there’s no point encrypting a disk and then automatically decrypting it, think about the use case. The encrypted server will auto decrypt if everything is fine, but remain protected if that server is stolen or the decryption servers are shutdown or modified. It provides convenience while maintaining a level of protection. It also ensures disks are preemptively encrypted if they ever need to be returned for a warranty claim, which is a much more likely event.

If you’ve got proper HA, then your secondary could still be up and running just but not receiving connections or running certain services (assuming a standard active/passive). Yes, one could still have a passphrase on encrypted boot and enter that via RA (DRAC,ILO, SSH preboot), or the credentials could be in a TPM etc.

None of those are foolproof, but protecting users’ data isn’t just about FBI raids, and disk encryption in general should still be part of the security toolkit because stuff like lost drives or improper disposal still happens.

Encrypting user data is pretty standard in the industry, and even required by law in the instance of servers hosting medical information in the US. Consumer software for disk encryption like you mentioned is substantially different from usual encryption solutions employed by data centers. Whole disk encryption is commonly done at a firmware or hardware level. For an example, iPhone embedded storage is fully encrypted and tied to the rest of the phone’s hardware. No user input required.

It wouldn’t have mattered if the guy had encryption any way because, as the article mentioned:

To make matters worse, it appears that the admin targeted in the raid was in the middle of maintenance work which left would-be-encrypted material on the server available in unencrypted form at the time of seizure.

Well yeah, with a cloud host your data is on call l somebody else’s hardware. The cloud host themselves do implement some form of encryption closer to said hardware (i.e. for the SAN arrays) so that a lost disk doesn’t mean exposed data.

BTW passwords shouldn’t be stored anywhere. Best practice since forever is to only store a cryptographic hash of a user’s password.

The article also mentions that DM’s were available to the admin.

However it should be assumed that DM’s on lemmy or others are not secure in the first place. If you want secure chat, move to Matrix.

haha yeah, for 26 years now. year of the OpenPGP any day now.

I agree with you, but the vast majority of people will always sell themselves out for convenience. If PGP caught on, you’d have iPhones with a built-in PGP messaging feature that sends everything unencrypted straight to apple before it sends the encrypted version.

And it’s the year of the Linux desktop 🤦‍♂️

You aren’t making any relevant point. Just showing how incompetent oss designers and the Linux desktop teams really are.

Stop trying to make PGP happen. It’s not going to happen.

I can only assume as I haven’t checked and I’m not sure anyone else reading this has checked either.

Fediverse sounds like a gold mine for big data collectors .

So you’re suing all these companies that share your data with 3rd parties?

Why do you think all these dipshit red states are trying to make porn sites go ham on the identification and gathering data just to watch porn? Could it be because they have ulterior motives and wanna target gay and other “sinful” people?

this is pretty tangential, but I live in one of those states, I don’t agree with the law, but I’m pretty sure their ulterior motives are securing votes. The reason people like those laws is that they think the laws protect children (they don’t, they make the internet more dangerous.) But those people pushing the laws really don’t give a fuck about gay people watching porn

While I agree with the overall sentiment towards privacy, I do wonder what is you opinion on how society can go against people who try to groom kids and teens online or who share CSAM online?

So you trust Reddit, Facebook and Twitter? That snoo has been gone a long time.

Switzerland*

And no, I was referring to Mastodon.

But if it’s public law enforcement agencies can just browse/scrape the website to collect the data, or am I missing something?

LOL no public social media can function without “public facing account data”. I’m not not worried about that. I’m worried about things like IP address, login info, account metadata, etc

They’re semi-private, in that users can’t just see other user’s DMs. However instance admin have the capability - the instance admin can see everything in their instance.

“The raid was part of an investigation into a local protest.”

And what if what’s legal now becomes illegal tomorrow? Don’t fall into the “If you have nothing to hide, you have nothing to fear” trap.