【转帖】科普----关于ThinkPad密码

440440

可以自己集成安全芯片吗？！

[ Edited by  440440 on 2008-8-28 15:54 ]

nnmpx

非常好的文章

hitymc

挺好的 我一般只设定POP和PSP

zhanggr

QUOTE:

Posted by sheovi on 2008-8-27 21:23
...硬盘超级密码(HDD Supervisor password，以一简称HSP ...

QUOTE:

Posted by Drifter on 2008-8-27 23:58
n前年我写的...

纠正一下原著者自创的一个长期误导(或误区): HDD硬盘的硬盘锁DriveLock只存在一个密码, 根本不存在还有一个属于硬盘的管理员administrator或Maser或supervisor的密码!

所谓的"管理员administrator或Maser或supervisor的密码"是属于BIOS范畴.

这是一个BIOS的陈规 - 不允许在设置了BIOS管理员密码的情况下, 用硬盘锁DriveLock密码(相当于用户User密码级别)进入BIOS来修改硬盘锁DriveLock密码.

尽管这个BIOS的陈规有点可笑 - 相当于家长给孩子零用钱, 但是有不允许孩子在未经家长允许(许可)的情况下使用零用钱.

[ Edited by  zhanggr on 2011-5-17 13:45 ]

明镜

楼上，我觉得你说的前半部分有道理，就是硬盘只有一个密码，但是为什么清掉之后hsp也消失了呢？

[ Edited by  明镜 on 2011-5-17 02:05 ]

zhanggr

楼上的前提就错 - 根本不存在HSP, 哪来的的"一回事".

"User+Maser"模式的"Master"不是指明Maser密码本身, 只不过标明"需要Master密码才能修改"而已.

打一个不恰当的比喻: 如果小孩子脱离父母关系后, 小孩子花已有的零用钱根本不再需要经过父母允许.

明镜

QUOTE:

Posted by zhanggr on 2011-5-17 02:14
根本不存在HSP

求证

zhanggr

楼上不知道"谁提出谁举证"这条法规吗?

mophise1984

QUOTE:

Posted by Drifter on 2008-8-27 23:58


n前年我写的...

正解，我也写过一个类似的帖子，但是是关于密码组合方案的。

楼主自己坛子里的帖子还转啥啊？

只有硬件密码是最安全的，软件密码都是白扯，一个Linux全部绕过，什么权限。

所以最好的方案是硬件密码（用指纹代替输入ThinkPad这点做的最好）+软件密码加全盘加密比如BitLocker。

渝老虎

mark

nt941

学习。字数补丁。

zhanggr

纠正: 查询AT/ATAPI-5规范里面确实有Master Password硬盘密码!

附: 维基ATA资料
http://en.wikipedia.org/wiki/AT_Attachment

HDD passwords and securityThe disk lock is a built-in security feature in the disk. It is part of the ATA specification, and thus not specific to any brand or device. The disk lock can be enabled and disabled by sending special ATA commands to the drive. If a disk is locked, it will refuse all access until it is unlocked.

A disk always has two passwords: A User password and a Master password. Most disks support a Master Password Revision Code.

Reportedly some disks can report if the Master password has been changed, or if it still the factory default. The revision code is word 92 in the IDENTIFY response. Reportedly on some disks a value of 0xFFFE means the Master password is unchanged. The standard does not distinguish this value.

A disk can be locked in two modes: High security mode or Maximum security mode. Bit 8 in word 128 of the IDENTIFY response shows which mode the disk is in: 0 = High, 1 = Maximum.

In High security mode, the disk can be unlocked with either the User or Master password, using the "SECURITY UNLOCK DEVICE" ATA command. There is an attempt limit, normally set to 5, after which the disk must be power cycled or hard-reset before unlocking can be attempted again. Also in High security mode the SECURITY ERASE UNIT command can be used with either the User or Master password.

In Maximum security mode, the disk cannot be unlocked without the User password — the only way to get the disk back to a usable state is to issue the SECURITY ERASE PREPARE command, immediately followed by SECURITY ERASE UNIT. In Maximum security mode the SECURITY ERASE UNIT command requires the User password and will completely erase all data on the disk. The operation is slow, it may take longer than half an hour or more, depending on the size of the disk. (Word 89 in the IDENTIFY response indicates how long the operation will take.) [22]

While the ATA disk lock is intended to be impossible to defeat without a valid password, there are workarounds to unlock a drive.

Many data recovery companies offer unlocking services,[23] so while the disk lock will deter a casual attacker, it is not secure against a qualified adversary.

注: 推测厂商有可能将BIOS的Maser Password和硬盘的Maser Password这两个东西合二为一.

风舞残阳

估计是43年代的文章了。

对密码研究少，只知道以前强。
IBM对加密方面做的研究比较多，联想基本上没做。

darwincyc

挖坟。。。。

cacala

密码研究少  IBM对加密方面做的研究比较多，联想基本上没做。
严重同意这句话

allpower

不错！不错！不错！不错！

ildsd

学习一下，虽然我一直都不怎么用密码，连系统密码都没有。
不过说不定以后能用着。