The EFF has a whitepaper advocating greater adoption of full disk encryption. The intent is to protect privacy of data during government searches or when a device is stolen. The thing is, while that is a very real risk, it is vastly overshadowed by a far more likely risk for the average user – needing to recover data from an unbootable machine. Given the general prevelence of malware it is highly likely that some form of unbootable recovery will be necessary for the vast majority of users at some point, and while it is possible to recover data from an encrypted drive the majority of solutions require opt-in action in advance to do so (for example, exporting the key to some form of removable media). When 12345 is still a common password in 2011, despite Spaceballs making fun of it decades ago, I think it is highly niave to believe that most users will have taken the appropriate steps in advance to protect themselves when needing to recover an encrypted drive.

So at this point EFF, asking for widespread adoption of encryption when the encryption solutions still aren’t really ready for consumer drive recovery is really asking to generate a much greater and more likely issue than the one you hope to solve. Sadly, such is a thing is all too common in security, where very rarely do solutions come without tradeoffs, but we often don’t consider them. Account lockout is awesome, but denial of service is not. Strong passwords are harder to break, but they are also harder to remember. And so on. One thing security folks have traditionally done a poor job with is weighing the negative effects of their solution versus the positive gains – the EFF is just the latest offender there.

~ Joshbw