One thing I disagree with the article about is that drives should not be encrypted by default. For the vast majority of people an encrypted drive is just data loss lying in wait.

I prefer to use non-encrypted drives so I have the option of popping out the disk and reading it from another system with ease, which also means that I can recover files from drives of otherwise dead systems just as easily. This is a trade off I'm willing to make over losing access to data.

I understand business uses for it, and for that they have an IT team to manage key backup and backups in general. Plus when you're using company equipment it is theirs, not yours.

It's really about personal privacy. Your computer is likely to be stolen and sold. If you don't want others reading your email, viewing your pictures, seeing your tax returns, etc. then you should encrypt the drive.

I call this "The Pawn Shop Threat Model" ;)

And, IME it is likely to happen.

Users should be given a choice and clearly and concisely explain the consequences of choosing one or the other. Simple as that.

What it should definitely not happen is to do this behind scenes and store recovery codes on a microsoft account. Why those codes have to be stored on their servers?

A screen should display the recovery codes and instruct the user to print them and keep them in a safe place in case of requiring them. I should be able to recover my data completely offline. End of the story.

Obviously "physical access is full access", but it's shockingly easy to break into a Windows box if you have access to the unencrypted drive. I learned with I was a teenager how to use the recovery partition to mount the C: drive, then copy "cmd.exe" to "utilman.exe" or "sethc.exe" and get an instant root shell on the login page. Takes about 2-3 minutes, can be done in the time somebody leaves their laptop to go to the bathroom at Starbucks.

To me that's the main thing about disk encryption, it's to stop a nasty rootkit from being installed trivially as much as it is about stopping the guy at the pawn shop from getting your tax info. Whether you're on macos, linux, or windows, it's really quite easy to fully compromise a machine if you have hands on it.

> I prefer to use non-encrypted drives so I have the option of popping out the disk and reading it from another system with ease, which also means that I can recover files from drives of otherwise dead systems just as easily.

Everyone has different security needs. But (maybe it's different on Windows), what's hard about popping the disk to another machine and then decrypting it with the key? Does Windows not give you access to the key?

When an SSD fails it often reverts to read-only mode. The manufacturers may require you to return the drive to receive a replacement or refund. By which point it is too late. You now have the choice of potentially risking the disclosure of your personal data to a third-party (and your shipment could end up on a lost-parcel auction of it did not get delivered) or missing out on your warranty.

My solution for your concerns is twofold:

1. Use a password-based encryption method (not tied to hardware identity) if you prioritize moving the disk around. Then it is just as readable in a spare machine.

2. Use an easy to remember password/passphrase and write it down somewhere you keep paper documents, if you prioritize recovery.

This still provides meaningful protection when you need to discard the drive. The random downstream recipient of the hardware will not know your password, even if you skip the step where you "crypto-shred" the drive by setting a new random password.

Agreed, I have personally come to the same conclusion. I do not encrypt the drives in my home desktops and servers so that the recovery/migration is easier when the time comes. The risk of someone stealing my desktops from my home is very low and the impact of someone going through my family photos or Linux ISOs is nothing. I roll my eyes at my friend when he explains the solutions for how to input the encryption password when his server restarts.

At the time of writing, there are already other replies to this comment how "it's mandatory today to encrypt drives" without any qualifiers. I am growing more and more frustrated by people who try to force security measures like this "because it is more secure that way" without first taking a look at the risks, impacts and associated costs. I think they simply force these security measures on others to feel good about their choices.

It was a breath of fresh reasonability when I found out that apt intentionally uses only HTTP instead of blanket HTTPS everywhere because the packages are signed, therefore they can be verified by the client, and using HTTP allows easier caching with cache proxies and such.

> popping out the disk and reading it from another system

The vast majority of people don't know that this is an option or how to do it.

Windows gives you recovery keys for each encrypted drive. With those you can even access tpm-protected drives on another machine.

I'd say it's mandatory today to encrypt drives. In the age of SSDs it's not really possible anymore to delete files and to be sure they are in no way recoverable by an adversary.