Re: ATA security commands, bug in atacontrol

2005-04-05 Thread Dag-Erling Smørgrav
Craig Boston <[EMAIL PROTECTED]> writes: > Um, wouldn't setting the password on a system in which the BIOS offers > no ATA security support render the system unbootable? The BIOS would > be unable to read the boot sector without first unlocking the disk... You are assuming that there is only one

Re: ATA security commands, bug in atacontrol

2005-04-04 Thread ALeine
[EMAIL PROTECTED] wrote: > And while travelling, someone pickpockets you and takes the > flash drive where you stored the key. I never said you would store the password on the USB flash drive, that drive is meant to serve mainly for booting FreeBSD. Secure password storage is another issue altog

Re: ATA security commands, bug in atacontrol

2005-04-04 Thread Julian Elischer
ALeine wrote: You would then take the USB flash drive with you and after returning home you would repeat the procedure (assuming your drives were not stolen :->), only issuing unlock and disable password commands. Another reboot and you could boot off your drive(s). And while travelling, someon

Re: ATA security commands, bug in atacontrol

2005-04-04 Thread ALeine
[EMAIL PROTECTED] wrote: > Um, wouldn't setting the password on a system in which the BIOS > offers no ATA security support render the system unbootable? The BIOS > would be unable to read the boot sector without first unlocking the > disk... Correct, if BIOS is configured to try to boot only of

Re: ATA security commands, bug in atacontrol

2005-04-04 Thread Craig Boston
On Sun, Apr 03, 2005 at 09:19:19AM -0700, ALeine wrote: > [EMAIL PROTECTED] wrote: > There are some people who would want to be able to issue ATA security > {set,unlock,disable} password and other commands, but have no BIOS user > interface to change any of the ATA security settings. Um, wouldn't

Re: ATA security commands, bug in atacontrol

2005-04-03 Thread ALeine
[EMAIL PROTECTED] wrote: > Right, I did see that article but I've not settled on how if at > all to deal with it. The by far most secure method would be to > have ATA issue the freeze command ASAP in the probe/attach code, > thats about one line of code :) > > At any rate atacontrol is not the pl

Re: ATA security commands, bug in atacontrol

2005-04-03 Thread Søren Schmidt
ALeine wrote: Recent c't magazine article "At Your Disservice - How ATA security functions jeopardize your data", which you can find at the URL below, warns about the dangers of ATA security commands. Specifically, a malicious attacker with sufficient access could render a disk useless to the legit

ATA security commands, bug in atacontrol

2005-04-03 Thread ALeine
Recent c't magazine article "At Your Disservice - How ATA security functions jeopardize your data", which you can find at the URL below, warns about the dangers of ATA security commands. Specifically, a malicious attacker with sufficient access could render a disk useless to the legitimate owner o