-1

Why bother encrypting when I can simply place 0700 -rwx------ permission on a file or directory? As long as the user that assigned the permission has a strong password, nobody else would be able to read, write, or execute the file. So it's going nowhere, and can't be opened. What's wrong with my thought process?

I remember back in the day how easy it was to browse Windows NTFS files that were "protected" by a Windows password, simply by using a Knoppix live CD on the computer. Nothing like that is practical on a Linux box that I'm missing here, right? As long as I've got the 0700 permission nobody is getting to my file/directory without brute forcing the strong password.

[Edit] Please assume that I am the only person with physical access to the computer.

  • 2
    Absolutely irrelevant, boot on any livelinux , grant yourself root access read whatever you want. – Kiwy Mar 27 '18 at 11:55
  • But the person would need physical acess to my PC. The assumption in my post is that I am the only person with physical access to the PC, which is a true statement. Maybe I should have included that. Good point. – stackinator Mar 27 '18 at 12:01
  • Still, exploit any bug, elevate privileges, and read anything. You can't base yourself on just read write permission root can do anything. Encryption is there to protect interception of physical disk. as long as you gain access to a server and data are decipher you will be able to read them. Your question is irrelevant see security.stackexchange.com/q/115434/35967 – Kiwy Mar 27 '18 at 12:12
  • The assumption in my post is that I am the only person with physical access to the PC, which is a true statement. <cough>. And PCs get stolen, disks replaced... – xenoid Mar 27 '18 at 12:35
  • 2
    As long as the user that assigned the permission has a strong password, nobody else would be able to read, write, or execute the file: Wrong, root can. Of course, if you can't trust root, you're in trouble anyhow. But the sentence remains wrong. – Philippos Mar 27 '18 at 12:59
1

As long as I've got the 0700 permission nobody is getting to my file/directory without brute forcing the strong password

and you initially ask "is encryption any better than 0700 permissions?"

yes it is, because I or anyone can simply take your disk and mount it, or slave it, to another system {typically linux} and in doing so simply bypass any and all file/folder permissions that were on your non-encrypted disk and access any and all data on your non-encrypted disk. The assumption being it is a trivial thing to set up a second computer and install any of a dozen free linux distributions to accomplish the task of mounting and accessing anything that is non-encrypted either at the whole-disk level or at a file level.

  • What's the point of file/folder permissions if they are so easily bypassed? Why bother in the first place? Is it the equivalent of chintzy locks on a $5 Walmart safe? It just keeps the honest people out? – stackinator Mar 27 '18 at 13:54
  • 1
    there is some ambiguity surrounding your question, there are different types of "security"... the two big obvious ones are physical security and then security on the software side of things which in my opinion includes network security. it is too big topic to discuss here but to indulge what I think you are getting at... if you truly believe there to be NO other flaws/bugs/loopholes in your operating system and the mechanisms for elevated privileges AND physical security is not an issue then yes 0700 permissions in an ideal world should be enough to restrict access – ron Mar 27 '18 at 17:24
  • 1
    proper implementation of a proven encryption scheme is a trusted and proven method, at this point in time there are no legitimate known ways to crack AES, serpent, blowfish, twofish and maybe a few others in reasonable amount of time. Even with a hardened, patched, bug free operating system there are attack vectors/methods to get a root password, to then get around 0700. Locking down an operating system is complex and as a human you will miss something and make a mistake, with a simple encryption method there is far less risk and it's way more secure and reliable compared to the OS level. – ron Mar 27 '18 at 17:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.