{"id":99272,"date":"2026-02-12T00:17:16","date_gmt":"2026-02-11T23:17:16","guid":{"rendered":"https:\/\/www.infokuryr.cz\/n\/?p=99272"},"modified":"2026-02-11T12:43:44","modified_gmt":"2026-02-11T11:43:44","slug":"rick-findlay-diky-tomu-se-vase-sifrovaci-klice-nedostanou-do-rukou-velkych-technologickych-firem","status":"publish","type":"post","link":"https:\/\/www.infokuryr.cz\/n\/2026\/02\/12\/rick-findlay-diky-tomu-se-vase-sifrovaci-klice-nedostanou-do-rukou-velkych-technologickych-firem\/","title":{"rendered":"Rick Findlay: D\u00edky tomu se va\u0161e \u0161ifrovac\u00ed kl\u00ed\u010de nedostanou do rukou velk\u00fdch technologick\u00fdch firem"},"content":{"rendered":"
<\/div>\n
\n
\n

Skute\u010dn\u00e9 zabezpe\u010den\u00ed za\u010d\u00edn\u00e1 tam, kde kon\u010d\u00ed pohodl\u00ed \u2013 t\u00edm, \u017ee \u0161ifrovac\u00ed kl\u00ed\u010de uchov\u00e1v\u00e1te mimo cloud a ve vlastn\u00edch rukou.<\/span><\/strong><\/p>\n

Kdy\u017e FBI cht\u011bla z\u00edskat p\u0159\u00edstup ke t\u0159em notebook\u016fm spojen\u00fdm s p\u0159\u00edpadem pandemick\u00e9ho podvodu na Guamu, nepou\u017eila hackery ani \u0161pi\u010dkov\u00e9 forenzn\u00ed techniky. Zavolala Microsoftu. B\u011bhem n\u011bkolika t\u00fddn\u016f jim spole\u010dnost p\u0159edala digit\u00e1ln\u00ed kl\u00ed\u010de, kter\u00e9 za\u0159\u00edzen\u00ed odemkly \u2013 sv\u00e9 vlastn\u00ed obnovovac\u00ed kl\u00ed\u010de BitLockeru, z\u00edskan\u00e9 ze server\u016f Microsoftu.<\/span><\/p>\n

Tento okam\u017eik, ti\u0161e poh\u0159ben\u00fd v p\u0159\u00edpadu Spojen\u00e9 st\u00e1ty v. Tenorio, p\u0159edstavuje prvn\u00ed zn\u00e1m\u00fd p\u0159\u00edpad, kdy feder\u00e1ln\u00ed vy\u0161et\u0159ovatel\u00e9 z\u00edskali p\u0159\u00edstup k \u0161ifrovan\u00fdm po\u010d\u00edta\u010d\u016fm s Windows \u2013 ne jejich prolomen\u00edm, ale po\u017e\u00e1d\u00e1n\u00edm o pomoc v\u00fdrobce. Pro ka\u017ed\u00e9ho, kdo si myslel, \u017ee BitLocker znamen\u00e1 \u201ezam\u010deno\u201c, tehdy vstoupil do hry drobn\u00fd tisk.<\/span><\/p>\n

BitLocker je navr\u017een tak, aby chr\u00e1nil ka\u017ed\u00fd soubor na disku Windows pomoc\u00ed \u00fapln\u00e9ho \u0161ifrov\u00e1n\u00ed disku.<\/span><\/p>\n

U\u017eivatel\u00e9 si toho jen z\u0159\u00eddka v\u0161imnou \u2013 a je\u0161t\u011b m\u00e9n\u011b si jich uv\u011bdomuje, \u017ee pokud se p\u0159ihl\u00e1sili pomoc\u00ed \u00fa\u010dtu Microsoft, jejich obnovovac\u00ed kl\u00ed\u010de byly \u201epro pohodl\u00ed\u201c nahr\u00e1ny do cloudu Microsoftu. V tomto p\u0159\u00edpad\u011b pohodl\u00ed znamenalo, \u017ee je FBI mohla z\u00edskat na z\u00e1klad\u011b povolen\u00ed k prohl\u00eddce.<\/span><\/p>\n

Spole\u010dnost Microsoft spolupr\u00e1ci potvrdila. \u201eObnova kl\u00ed\u010d\u016f sice nab\u00edz\u00ed pohodl\u00ed, ale z\u00e1rove\u0148 s sebou nese riziko neopr\u00e1vn\u011bn\u00e9ho p\u0159\u00edstupu, tak\u017ee se spole\u010dnost Microsoft domn\u00edv\u00e1, \u017ee z\u00e1kazn\u00edci jsou v nejlep\u0161\u00ed pozici, aby se sami rozhodli\u2026 jak budou spravovat sv\u00e9 kl\u00ed\u010de,\u201c uvedl mluv\u010d\u00ed. Toto prohl\u00e1\u0161en\u00ed zn\u00ed jako sebeur\u010den\u00ed \u2013 i kdy\u017e rozhodnut\u00ed ji\u017e bylo u\u010din\u011bno na z\u00e1klad\u011b v\u00fdchoz\u00edho nastaven\u00ed hluboko v syst\u00e9mu Windows.<\/span><\/p>\n

Spole\u010dnost uv\u00e1d\u00ed, \u017ee ro\u010dn\u011b dost\u00e1v\u00e1 p\u0159ibli\u017en\u011b 20 takov\u00fdch \u017e\u00e1dost\u00ed, \u010dasto od org\u00e1n\u016f \u010dinn\u00fdch v trestn\u00edm \u0159\u00edzen\u00ed, kter\u00e9 se sna\u017e\u00ed o p\u0159\u00edstup k \u0161ifrovan\u00fdm disk\u016fm. N\u011bkter\u00e9 nelze splnit, proto\u017ee mnoho u\u017eivatel\u016f sv\u00e9 kl\u00ed\u010de nikdy nesynchronizovalo \u2013 ale pokud je to mo\u017en\u00e9, Microsoft vyhov\u00ed.<\/span><\/p>\n

Tento p\u0159\u00edpad byl prvn\u00edm zdokumentovan\u00fdm p\u0159\u00edpadem odem\u010den\u00ed BitLockeru ofici\u00e1ln\u00edmi kan\u00e1ly. In\u017een\u00fd\u0159i l\u00e9ta p\u0159\u00edsahali, \u017ee neexistuj\u00ed \u017e\u00e1dn\u00e1 \u201ezadn\u00ed vr\u00e1tka\u201c. Technicky vzato m\u011bli pravdu. M\u00edsto toho existovala p\u0159edn\u00ed vr\u00e1tka.<\/span><\/p>\n

Od vyd\u00e1n\u00ed syst\u00e9mu Windows 10 se BitLocker automaticky aktivuje na mnoha nov\u00fdch po\u010d\u00edta\u010d\u00edch \u2013 \u010dasto bez pov\u0161imnut\u00ed u\u017eivatel\u016f.<\/span><\/p>\n

B\u011bhem instalace syst\u00e9m Windows d\u016frazn\u011b doporu\u010duje u\u017eivatel\u016fm, aby se p\u0159ihla\u0161ovali pomoc\u00ed \u00fa\u010dtu Microsoft, a ne aby si vytv\u00e1\u0159eli \u010dist\u011b lok\u00e1ln\u00ed \u00fa\u010det. Pokud tak u\u017eivatel u\u010din\u00ed, BitLocker ti\u0161e nahraje obnovovac\u00ed kl\u00ed\u010d za\u0159\u00edzen\u00ed na servery spole\u010dnosti Microsoft.<\/span><\/p>\n

Spole\u010dnost Microsoft prezentuje tento design jako funkci pro v\u011bt\u0161\u00ed pohodl\u00ed. Pokud u\u017eivatel zapomene heslo, ztrat\u00ed p\u0159\u00edstup nebo dojde k syst\u00e9mov\u00e9 chyb\u011b, lze k odem\u010den\u00ed za\u0159\u00edzen\u00ed a op\u011btovn\u00e9mu z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu k soubor\u016fm pou\u017e\u00edt kl\u00ed\u010d pro obnoven\u00ed ulo\u017een\u00fd v cloudu. Pro v\u011bt\u0161inu u\u017eivatel\u016f se to d\u011bje neviditeln\u011b na pozad\u00ed.<\/span><\/p>\n

Kompromis se z\u0159\u00eddka explicitn\u011b uv\u00e1d\u00ed. Ulo\u017een\u00edm obnovovac\u00edho kl\u00ed\u010de si spole\u010dnost Microsoft zachov\u00e1v\u00e1 technickou schopnost odemknout za\u0159\u00edzen\u00ed. \u0160ifrov\u00e1n\u00ed z\u016fst\u00e1v\u00e1 matematicky siln\u00e9, ale kontrola nad kl\u00ed\u010di je sd\u00edlena s t\u0159et\u00ed stranou. Od tohoto okam\u017eiku p\u0159\u00edstup k dat\u016fm z\u00e1vis\u00ed nejen na kryptografii, ale tak\u00e9 na firemn\u00edch z\u00e1sad\u00e1ch a pr\u00e1vn\u00edch postupech.<\/span><\/p>\n

Kdy\u017e Microsoft z toho ud\u011blal standard<\/span><\/h2>\n

Tato zm\u011bna za\u010dala s Windows 10, vydan\u00fdm v roce 2015. Automatick\u00e9 \u0161ifrov\u00e1n\u00ed za\u0159\u00edzen\u00ed a cloudov\u00e9 ukl\u00e1d\u00e1n\u00ed kl\u00ed\u010d\u016f pro obnoven\u00ed se staly st\u00e1le b\u011b\u017en\u011bj\u0161\u00edmi, zat\u00edmco Microsoft siln\u011bji tla\u010dil u\u017eivatele k p\u0159ihla\u0161ov\u00e1n\u00ed pomoc\u00ed \u00fa\u010dt\u016f.<\/span><\/p>\n

S ka\u017edou dal\u0161\u00ed verz\u00ed syst\u00e9mu Windows se proces p\u0159ihla\u0161ov\u00e1n\u00ed pomoc\u00ed \u00fa\u010dtu Microsoft stal v\u00fdrazn\u011bj\u0161\u00edm a mo\u017enosti pro m\u00edstn\u00ed \u00fa\u010dty se st\u00e1valy obt\u00ed\u017en\u011bji dostupn\u00fdmi.<\/span><\/p>\n

Offline \u00falo\u017ei\u0161t\u011b kl\u00ed\u010d\u016f a \u010dist\u011b lok\u00e1ln\u00ed \u00fa\u010dty st\u00e1le existuj\u00ed, ale ji\u017e nejsou v\u00fdchoz\u00ed cestou a snadno se p\u0159ehl\u00e9dnou, pokud u\u017eivatel nev\u00ed, co hledat.<\/span><\/p>\n

V\u00fdsledkem je, \u017ee miliony u\u017eivatel\u016f se nyn\u00ed spol\u00e9haj\u00ed na \u0161ifrovac\u00ed syst\u00e9my, kde jsou jejich kl\u00ed\u010de ulo\u017eeny mimo jejich p\u0159\u00edmou kontrolu \u2013 \u010dasto ani\u017e by o tom byli kdy jasn\u011b informov\u00e1ni.<\/span><\/p>\n

Pro\u010d je to probl\u00e9m s ochranou osobn\u00edch \u00fadaj\u016f<\/span><\/h2>\n

\u0160ifrov\u00e1n\u00ed chr\u00e1n\u00ed data pouze tehdy, pokud kl\u00ed\u010de z\u016fst\u00e1vaj\u00ed v\u00fdhradn\u011b v rukou u\u017eivatele. V mnoha modern\u00edch konfigurac\u00edch Windows ji\u017e tato podm\u00ednka nen\u00ed spln\u011bna.<\/span><\/p>\n

Proto\u017ee Microsoft ukl\u00e1d\u00e1 kl\u00ed\u010de pro obnoven\u00ed BitLockeru, m\u016f\u017ee b\u00fdt ze z\u00e1kona nucen je p\u0159edat vl\u00e1d\u00e1m, kter\u00e9 nad n\u00edm maj\u00ed jurisdikci. Toto ji\u017e nen\u00ed hypotetick\u00e9 riziko.<\/span><\/p>\n

Zd\u00e1 se, \u017ee se jedn\u00e1 o prvn\u00ed ve\u0159ejn\u011b zn\u00e1m\u00fd p\u0159\u00edpad, kdy spole\u010dnost Microsoft p\u0159\u00edmo dodala \u0161ifrovac\u00ed kl\u00ed\u010de americk\u00fdm donucovac\u00edm org\u00e1n\u016fm.<\/span><\/p>\n

Jakmile byly kl\u00ed\u010de poskytnuty, vy\u0161et\u0159ovatel\u00e9 z\u00edskali pln\u00fd p\u0159\u00edstup k za\u0159\u00edzen\u00edm \u2013 nejen ke konkr\u00e9tn\u00edm soubor\u016fm uveden\u00fdm v p\u0159\u00edkazu k prohl\u00eddce. \u0160ifrov\u00e1n\u00ed nezpomalilo ani neomezilo prohled\u00e1v\u00e1n\u00ed. Prost\u011b zmizelo.<\/span><\/p>\n

Tato realita podkop\u00e1v\u00e1 my\u0161lenku \u0161ifrov\u00e1n\u00ed jako\u017eto tvrd\u00e9 technick\u00e9 bari\u00e9ry. P\u0159\u00edstup se m\u00edsto toho st\u00e1v\u00e1 politick\u00fdm rozhodnut\u00edm, zprost\u0159edkovan\u00fdm spole\u010dnost\u00ed reaguj\u00edc\u00ed na z\u00e1konn\u00e9 po\u017eadavky. Z hlediska ochrany osobn\u00edch \u00fadaj\u016f je toto rozli\u0161en\u00ed kl\u00ed\u010dov\u00e9. V\u00fdkonn\u00e1 matematika je k ni\u010demu, pokud n\u011bkdo jin\u00fd m\u016f\u017ee dve\u0159e odemknout.<\/span><\/p>\n

Pro\u010d se t\u00edm Microsoft odli\u0161uje od ostatn\u00edch spole\u010dnost\u00ed<\/span><\/h2>\n

Zp\u016fsob, jak\u00fdm Apple pracuje se \u0161ifrov\u00e1n\u00edm, z\u00e1vis\u00ed na konkr\u00e9tn\u00edm za\u0159\u00edzen\u00ed. iPhony jsou navr\u017eeny tak, aby Apple nem\u011bl p\u0159\u00edstup ke kl\u00ed\u010d\u016fm, kter\u00e9 chr\u00e1n\u00ed data ulo\u017een\u00e1 v za\u0159\u00edzen\u00ed. Toto nastaven\u00ed bylo ve\u0159ejn\u011b testov\u00e1no v roce 2016, kdy spole\u010dnost odm\u00edtla pomoci FBI odemknout iPhony pou\u017eit\u00e9 p\u0159i st\u0159elb\u00e1ch v San Bernardinu. Apple postr\u00e1dal technick\u00e9 mo\u017enosti, aby toto nastaven\u00ed splnil.<\/span><\/p>\n

Po\u010d\u00edta\u010de Mac pou\u017e\u00edvaj\u00ed jin\u00fd model. Pokud u\u017eivatel\u00e9 povol\u00ed obnoven\u00ed p\u0159es iCloud, Apple jim m\u016f\u017ee pomoci znovu z\u00edskat p\u0159\u00edstup prost\u0159ednictv\u00edm jejich \u00fa\u010dtu iCloud. V tomto p\u0159\u00edpad\u011b je obnoven\u00ed mo\u017en\u00e9, ale pouze proto, \u017ee si u\u017eivatel tuto mo\u017enost v\u011bdom\u011b zvolil. Apple automaticky neukl\u00e1d\u00e1 \u0161ifrovac\u00ed kl\u00ed\u010de a neudr\u017euje univerz\u00e1ln\u00ed p\u0159\u00edstup k dat\u016fm na Macu.<\/span><\/p>\n

Spole\u010dnosti Google a Meta se vydaly podobn\u00fdm sm\u011brem a \u0161ifruj\u00ed z\u00e1lohy ve sv\u00fdch cloudov\u00fdch syst\u00e9mech pomoc\u00ed kl\u00ed\u010d\u016f, kter\u00e9 samotn\u00e9 spole\u010dnosti nemohou z\u00edskat. Pokud \u00fa\u0159ady po\u017eaduj\u00ed de\u0161ifrov\u00e1n\u00ed, spole\u010dnosti nemohou nic p\u0159edat.<\/span><\/p>\n

Microsoft pou\u017e\u00edv\u00e1 opa\u010dn\u00fd p\u0159\u00edstup. Jeho syst\u00e9m BitLocker zalo\u017een\u00fd na \u00fa\u010dtech automaticky nahr\u00e1v\u00e1 kl\u00ed\u010de pro obnoven\u00ed, kdy\u017e se u\u017eivatel p\u0159ihl\u00e1s\u00ed pomoc\u00ed \u00fa\u010dtu Microsoft. To zaji\u0161\u0165uje, \u017ee Microsoft m\u016f\u017ee reagovat na legitimn\u00ed po\u017eadavky \u2013 ale tak\u00e9 to znamen\u00e1, \u017ee \u0161ifrov\u00e1n\u00ed z\u00e1vis\u00ed na spolupr\u00e1ci spole\u010dnosti.<\/span><\/p>\n

Alternativy k uchov\u00e1v\u00e1n\u00ed \u0161ifrovac\u00edch kl\u00ed\u010d\u016f ve vlastn\u00edch rukou<\/span><\/h2>\n

Pro u\u017eivatele, kte\u0159\u00ed cht\u011bj\u00ed m\u00edt plnou kontrolu nad \u0161ifrov\u00e1n\u00edm, ani\u017e by Microsoft, Apple nebo kdokoli jin\u00fd vlastnil z\u00e1lo\u017en\u00ed kl\u00ed\u010d, existuj\u00ed spolehliv\u00e9 a osv\u011bd\u010den\u00e9 mo\u017enosti. Tyto syst\u00e9my vy\u017eaduj\u00ed v\u00edce \u00fasil\u00ed k nastaven\u00ed, ale eliminuj\u00ed tichou z\u00e1vislost, kter\u00e1 je spojena s cloudovou obnovou.<\/span><\/p>\n

VeraCrypt<\/span><\/h3>\n

Co to je:<\/span><\/strong>\u00a0VeraCrypt je bezplatn\u00fd \u0161ifrovac\u00ed program s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem pro Windows, macOS a Linux. Vznikl z ukon\u010den\u00e9ho projektu TrueCrypt a zahrnuje modern\u00ed vylep\u0161en\u00ed zabezpe\u010den\u00ed s aktivn\u00ed komunitn\u00ed \u00fadr\u017ebou.<\/span><\/p>\n

Jak to funguje:<\/span><\/strong>\u00a0U\u017eivatel\u00e9 si mohou vytvo\u0159it \u0161ifrovan\u00fd svazek nebo za\u0161ifrovat cel\u00fd disk. VeraCrypt generuje kl\u00ed\u010de lok\u00e1ln\u011b v za\u0159\u00edzen\u00ed a nikdy je nikam nenahr\u00e1v\u00e1. Heslo nebo soubor s kl\u00ed\u010dem si nastavujete sami a jste pln\u011b zodpov\u011bdn\u00ed za jeho bezpe\u010dnost. Pokud je ztrat\u00edte, data jsou nav\u017edy pry\u010d, proto\u017ee je nikdo jin\u00fd nem\u016f\u017ee obnovit.<\/span><\/p>\n

Pro\u010d je to d\u016fle\u017eit\u00e9:<\/span><\/strong>\u00a0Proto\u017ee VeraCrypt nen\u00ed v\u00e1z\u00e1n na \u017e\u00e1dnou cloudovou slu\u017ebu, neexistuje \u017e\u00e1dn\u00e1 t\u0159et\u00ed strana, kter\u00e1 by mohla va\u0161e data odemknout. Org\u00e1ny \u010dinn\u00e9 v trestn\u00edm \u0159\u00edzen\u00ed nemohou p\u0159edvolat k vy\u017e\u00e1d\u00e1n\u00ed kl\u00ed\u010de pro obnoven\u00ed, proto\u017ee krom\u011b toho, kter\u00fd vlastn\u00edte, \u017e\u00e1dn\u00fd jin\u00fd neexistuje. Je transparentn\u00ed, d\u016fkladn\u011b testovan\u00fd a uzn\u00e1v\u00e1n bezpe\u010dnostn\u00edmi profesion\u00e1ly.<\/span><\/p>\n

Nejlep\u0161\u00ed pro:<\/span><\/strong>\u00a0U\u017eivatele, kte\u0159\u00ed cht\u011bj\u00ed \u00faplnou autonomii a nemaj\u00ed probl\u00e9m se spr\u00e1vou vlastn\u00edch kl\u00ed\u010d\u016f nebo ru\u010dn\u00edm p\u0159ipojov\u00e1n\u00edm \u0161ifrovan\u00fdch disk\u016f. Je to m\u00e9n\u011b pohodln\u00e9 ne\u017e BitLocker, ale v\u00fdhodou je pln\u00e1 kontrola.<\/span><\/p>\n

Upozorn\u011bn\u00ed:<\/span><\/strong>\u00a0Pokud pou\u017e\u00edv\u00e1te VeraCrypt pro \u00fapln\u00e9 \u0161ifrov\u00e1n\u00ed disku, ujist\u011bte se, \u017ee m\u00e1te spr\u00e1vn\u011b nakonfigurovan\u00fd bootloader a z\u00e1lohujete d\u016fle\u017eit\u00e9 soubory. Uchov\u00e1vejte heslo nebo soubor s kl\u00ed\u010dem na bezpe\u010dn\u00e9m offline m\u00edst\u011b, proto\u017ee bez n\u011bj nen\u00ed obnoven\u00ed disku mo\u017en\u00e9.<\/span><\/p>\n

Linux s LUKS (Linux Unified Key Setup)<\/span><\/h3>\n

Co to je:<\/span><\/strong>\u00a0LUKS je standard pro \u0161ifrov\u00e1n\u00ed cel\u00e9ho disku ve v\u011bt\u0161in\u011b linuxov\u00fdch distribuc\u00ed, v\u010detn\u011b Ubuntu, Fedory, Debianu a Archu. Je integrov\u00e1n do instala\u010dn\u00edho programu v\u011bt\u0161iny modern\u00edch linuxov\u00fdch distribuc\u00ed.<\/span><\/p>\n

Jak to funguje:<\/span><\/strong>\u00a0LUKS \u0161ifruje cel\u00e9 odd\u00edly nebo disky. Kl\u00ed\u010d se generuje lok\u00e1ln\u011b a nikdy neopou\u0161t\u00ed za\u0159\u00edzen\u00ed. Nedoch\u00e1z\u00ed k \u017e\u00e1dn\u00e9 synchronizaci s cloudem ani k zapojen\u00ed spole\u010dnosti. P\u0159\u00edstup z\u00e1vis\u00ed v\u00fdhradn\u011b na hesle, kter\u00e9 nastav\u00edte b\u011bhem nastaven\u00ed.<\/span><\/p>\n

Pro\u010d je to d\u016fle\u017eit\u00e9:<\/span><\/strong>\u00a0Proto\u017ee je kl\u00ed\u010d lok\u00e1ln\u00ed, \u017e\u00e1dn\u00e1 organizace nem\u016f\u017ee b\u00fdt nucena syst\u00e9m odemknout. \u0160ifrov\u00e1n\u00ed existuje nez\u00e1visle na jak\u00e9koli podnikov\u00e9 infrastruktu\u0159e a neexistuje \u017e\u00e1dn\u00e1 metoda vzd\u00e1len\u00e9 obnovy.<\/span><\/p>\n

Nejlep\u0161\u00ed pro:<\/span><\/strong>\u00a0U\u017eivatele, kte\u0159\u00ed dbaj\u00ed na soukrom\u00ed a ji\u017e pou\u017e\u00edvaj\u00ed Linux nebo se ho cht\u011bj\u00ed nau\u010dit pou\u017e\u00edvat. LUKS nab\u00edz\u00ed nejsiln\u011bj\u0161\u00ed mo\u017enou z\u00e1ruku exkluzivn\u00ed kontroly nad \u0161ifrovan\u00fdmi daty.<\/span><\/p>\n

Upozorn\u011bn\u00ed:<\/span><\/strong>\u00a0Pokud pou\u017e\u00edv\u00e1te notebook, kombinujte LUKS se siln\u00fdm heslem a funkc\u00ed Secure Boot, abyste zabr\u00e1nili fyzick\u00e9 manipulaci. Z\u00e1lohujte si hlavi\u010dku LUKS samostatn\u011b, proto\u017ee jej\u00ed ztr\u00e1ta znemo\u017en\u00ed obnoven\u00ed.<\/span><\/p>\n

FileTreaf v macOS<\/span><\/h3>\n

Co to je:<\/span><\/strong>\u00a0FileVault je vestav\u011bn\u00fd syst\u00e9m \u0161ifrov\u00e1n\u00ed cel\u00e9ho disku od spole\u010dnosti Apple pro macOS. \u0160ifruje cel\u00fd disk pomoc\u00ed XTS-AES-128 s 256bitov\u00fdm kl\u00ed\u010dem.<\/span><\/p>\n

Jak to funguje:<\/span><\/strong>\u00a0B\u011bhem instalace nab\u00edz\u00ed macOS dv\u011b mo\u017enosti obnoven\u00ed:<\/span><\/p>\n

    \n
  • Ulo\u017ete si kl\u00ed\u010d pro obnoven\u00ed u Apple p\u0159es iCloud, co\u017e umo\u017e\u0148uje vzd\u00e1len\u00e9 obnoven\u00ed.<\/span><\/li>\n
  • Uschovejte si samotn\u00fd kl\u00ed\u010d pro obnoven\u00ed, ani\u017e byste ukl\u00e1dali jeho kopii jinde.<\/span><\/li>\n<\/ul>\n

    Druh\u00e1 mo\u017enost zajist\u00ed, \u017ee Apple nebude moci v\u00e1\u0161 Mac odemknout. Kl\u00ed\u010de z\u016fstanou pouze na va\u0161em za\u0159\u00edzen\u00ed.<\/span><\/p>\n

    Pro\u010d je to d\u016fle\u017eit\u00e9:<\/span><\/strong>\u00a0FileVault nab\u00edz\u00ed p\u0159i spr\u00e1vn\u00e9 konfiguraci silnou ochranu. Na rozd\u00edl od BitLockeru Apple automaticky nenahr\u00e1v\u00e1 kl\u00ed\u010de pro obnoven\u00ed. \u0160ifrov\u00e1n\u00ed je bezprobl\u00e9mov\u011b integrov\u00e1no do macOS a po aktivaci b\u011b\u017e\u00ed na pozad\u00ed.<\/span><\/p>\n

    Nejlep\u0161\u00ed pro:<\/span><\/strong>\u00a0U\u017eivatele Mac\u016f, kte\u0159\u00ed cht\u011bj\u00ed spolehliv\u00e9 \u0161ifrov\u00e1n\u00ed cel\u00e9ho disku bez pou\u017eit\u00ed extern\u00edch n\u00e1stroj\u016f. Vyva\u017euje pou\u017eitelnost a kontrolu ze strany u\u017eivatele \u2013 za p\u0159edpokladu, \u017ee je kl\u00ed\u010d pro obnoven\u00ed spravov\u00e1n lok\u00e1ln\u011b.<\/span><\/p>\n

    Upozorn\u011bn\u00ed:<\/span><\/strong>\u00a0Pokud chcete \u00faplnou nez\u00e1vislost, nepropojujte obnoven\u00ed FileVault s va\u0161\u00edm Apple ID. Uchov\u00e1vejte kl\u00ed\u010d pro obnoven\u00ed offline a odd\u011blen\u011b od po\u010d\u00edta\u010de. Pokud ztrat\u00edte kl\u00ed\u010d i heslo, data budou trvale nep\u0159\u00edstupn\u00e1.<\/span><\/p>\n

    \u0160ifrovan\u00e9 kontejnery a n\u00e1stroje na \u00farovni soubor\u016f<\/span><\/h2>\n

    Ne ka\u017ed\u00fd pot\u0159ebuje \u00fapln\u00e9 \u0161ifrov\u00e1n\u00ed disku. N\u011bkdy jde o ochranu konkr\u00e9tn\u00edch soubor\u016f nebo slo\u017eek, zejm\u00e9na pokud jsou ulo\u017eeny v cloudu nebo sd\u00edleny mezi za\u0159\u00edzen\u00edmi. N\u011bkolik n\u00e1stroj\u016f nab\u00edz\u00ed tuto flexibilitu a z\u00e1rove\u0148 umo\u017e\u0148uje m\u00edt \u0161ifrovac\u00ed kl\u00ed\u010de zcela ve va\u0161ich rukou.<\/span><\/p>\n

    Kryptom\u00e1tor<\/span><\/h3>\n

    Co to je:<\/span><\/strong>\u00a0Cryptomator \u0161ifruje jednotliv\u00e9 slo\u017eky nam\u00edsto cel\u00fdch disk\u016f. Byl vyvinut s ohledem na cloudov\u00e9 \u00falo\u017ei\u0161t\u011b, tak\u017ee u\u017eivatel\u00e9 mohou chr\u00e1nit soubory p\u0159ed jejich nahr\u00e1n\u00edm do slu\u017eeb, jako je OneDrive, Disk Google nebo Dropbox.<\/span><\/p>\n

    Jak to funguje:<\/span><\/strong>\u00a0Soubory jsou \u0161ifrov\u00e1ny lok\u00e1ln\u011b a ulo\u017eeny v \u201etrezoru\u201c. P\u0159i synchronizaci do cloudu se nahr\u00e1vaj\u00ed pouze \u0161ifrovan\u00e9 verze. Kl\u00ed\u010de nikdy neopou\u0161t\u011bj\u00ed va\u0161e za\u0159\u00edzen\u00ed. Poskytovatel cloudu vid\u00ed pouze \u0161ifrovan\u00e1 data a n\u00e1zvy soubor\u016f.<\/span><\/p>\n

    Pro\u010d je to d\u016fle\u017eit\u00e9:<\/span><\/strong>\u00a0Cryptomator v\u00e1m umo\u017e\u0148uje pou\u017e\u00edvat cloudov\u00e9 \u00falo\u017ei\u0161t\u011b, ani\u017e byste museli ohrozit sv\u00e9 soukrom\u00ed v\u016f\u010di poskytovateli. Podporuje Windows, macOS, Linux, iOS a Android. Je open source, zdarma k pou\u017eit\u00ed a pro\u0161el nez\u00e1visl\u00fdmi bezpe\u010dnostn\u00edmi audity.<\/span><\/p>\n

    Nejlep\u0161\u00ed pro:<\/span><\/strong>\u00a0Dokumenty, z\u00e1lohy nebo slo\u017eky sd\u00edlen\u00e9 mezi za\u0159\u00edzen\u00edmi. Je vhodn\u00fd pro u\u017eivatele, kte\u0159\u00ed pot\u0159ebuj\u00ed cloudov\u00e9 slu\u017eby, ale cht\u011bj\u00ed m\u00edt plnou kontrolu nad sv\u00fdmi kl\u00ed\u010di.<\/span><\/p>\n

    Upozorn\u011bn\u00ed:<\/span><\/strong>\u00a0Cryptomator chr\u00e1n\u00ed p\u0159ed p\u0159\u00edstupem zven\u010d\u00ed, ale nebr\u00e1n\u00ed p\u0159\u00edstupu, kdy\u017e je trezor otev\u0159en\u00fd. Trezor v\u017edy zamykejte, kdy\u017e jej nepou\u017e\u00edv\u00e1te.<\/span><\/p>\n

    St\u00e1\u0159\u00ed<\/span><\/h3>\n

    Co to je:<\/span><\/strong>\u00a0Age (vyslovuje se \u201eAGE\u201c) je lehk\u00fd \u0161ifrovac\u00ed n\u00e1stroj pro soubory a skripty. Byl vyvinut jako jednodu\u0161\u0161\u00ed a modern\u011bj\u0161\u00ed alternativa ke star\u0161\u00edm n\u00e1stroj\u016fm, jako je GPG.<\/span><\/p>\n

    Jak to funguje:<\/span><\/strong>\u00a0Podporuje \u0161ifrov\u00e1n\u00ed zalo\u017een\u00e9 na hesle a \u0161ifrov\u00e1n\u00ed s ve\u0159ejn\u00fdm kl\u00ed\u010dem. Nejsou zde \u017e\u00e1dn\u00e9 \u00fa\u010dty, \u017e\u00e1dn\u00e1 cloudov\u00e1 p\u0159ipojen\u00ed ani \u017e\u00e1dn\u00e9 slu\u017eby na pozad\u00ed. \u0160ifrov\u00e1n\u00ed prob\u00edh\u00e1 p\u0159\u00edmo v syst\u00e9mu u\u017eivatele.<\/span><\/p>\n

    Pro\u010d je to d\u016fle\u017eit\u00e9:<\/span><\/strong>\u00a0V\u011bk je transparentn\u00ed, minimalistick\u00fd a snadno auditovateln\u00fd. Pou\u017e\u00edv\u00e1 se ve v\u00fdvojov\u00e9m a DevOps prost\u0159ed\u00ed, kde je spolehlivost a jednoduchost d\u016fle\u017eit\u011bj\u0161\u00ed ne\u017e automatizace.<\/span><\/p>\n

    Nejlep\u0161\u00ed pro:<\/span><\/strong>\u00a0Technick\u00e9 u\u017eivatele, kte\u0159\u00ed cht\u011bj\u00ed p\u0159\u00edmou kontrolu a preferuj\u00ed n\u00e1stroje p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku. Ide\u00e1ln\u00ed pro bezpe\u010dn\u00fd p\u0159enos nebo ukl\u00e1d\u00e1n\u00ed mal\u00e9ho mno\u017estv\u00ed dat.<\/span><\/p>\n

    Upozorn\u011bn\u00ed:<\/span><\/strong>\u00a0Age je z\u00e1m\u011brn\u011b zjednodu\u0161en\u00fd. Nespravuje kl\u00ed\u010de za v\u00e1s a nenab\u00edz\u00ed \u017e\u00e1dn\u00e9 grafick\u00e9 rozhran\u00ed. Pokud kl\u00ed\u010d ztrat\u00edte, data budou trvale nep\u0159\u00edstupn\u00e1.<\/span><\/p>\n

    7-Zip<\/span><\/h3>\n

    Co to je:<\/span><\/strong>\u00a07-Zip je \u0161iroce pou\u017e\u00edvan\u00fd program pro kompresi soubor\u016f, kter\u00fd podporuje \u0161ifrov\u00e1n\u00ed AES-256 pro komprimovan\u00e9 archivy.<\/span><\/p>\n

    Jak to funguje:<\/span><\/strong>\u00a0U\u017eivatel\u00e9 vytvo\u0159\u00ed archiv chr\u00e1n\u011bn\u00fd heslem a 7-Zip za\u0161ifruje jeho obsah a \u2013 pokud je tato mo\u017enost vybr\u00e1na \u2013 i n\u00e1zvy soubor\u016f. Kl\u00ed\u010d je odvozen z hesla a nen\u00ed ulo\u017een nikde jinde.<\/span><\/p>\n

    Pro\u010d je to d\u016fle\u017eit\u00e9:<\/span><\/strong>\u00a07-Zip je jednoduch\u00fd, rychl\u00fd a mnoh\u00fdm ji\u017e zn\u00e1m\u00fd. Nevy\u017eaduje \u017e\u00e1dn\u00fd p\u0159\u00edstup k syst\u00e9mu na \u00farovni opera\u010dn\u00edho syst\u00e9mu ani \u017e\u00e1dnou integraci s cloudem.<\/span><\/p>\n

    Nejlep\u0161\u00ed pro:<\/span><\/strong>\u00a0Ochrana mal\u00fdch sad soubor\u016f, dokument\u016f nebo z\u00e1loh. Nen\u00ed to n\u00e1hrada za \u00fapln\u00e9 \u0161ifrov\u00e1n\u00ed disku, ale je u\u017eite\u010dn\u00e9 pro p\u0159enosn\u00e9 nebo do\u010dasn\u00e9 z\u00e1lohov\u00e1n\u00ed dat.<\/span><\/p>\n

    Upozorn\u011bn\u00ed:<\/span><\/strong>\u00a0Zabezpe\u010den\u00ed zcela z\u00e1vis\u00ed na zvolen\u00e9m hesle. Slab\u00e9 heslo snadno znemo\u017e\u0148uje \u0161ifrov\u00e1n\u00ed.<\/span><\/p>\n

    Hardwarov\u00e9 mo\u017enosti<\/span><\/h2>\n

    Pro ty, kte\u0159\u00ed cht\u011bj\u00ed \u0161ifrov\u00e1n\u00ed odd\u011blit od opera\u010dn\u00edho syst\u00e9mu, nab\u00edzej\u00ed hardwarov\u00e9 n\u00e1stroje dal\u0161\u00ed vrstvu kontroly.<\/span><\/p>\n

    \u0160ifrovan\u00e9 extern\u00ed disky s integrovanou kl\u00e1vesnic\u00ed<\/span><\/h3>\n

    Co to je:<\/span><\/strong>\u00a0Extern\u00ed disky s vestav\u011bn\u00fdm hardwarov\u00fdm \u0161ifrov\u00e1n\u00edm a fyzickou kl\u00e1vesnic\u00ed.<\/span><\/p>\n

    Jak funguj\u00ed:<\/span><\/strong>\u00a0\u0160ifrov\u00e1n\u00ed a de\u0161ifrov\u00e1n\u00ed prob\u00edh\u00e1 v\u00fdhradn\u011b v \u0159adi\u010di disku. U\u017eivatel zad\u00e1 PIN k\u00f3d p\u0159\u00edmo na disku p\u0159ed jeho p\u0159ipojen\u00edm k po\u010d\u00edta\u010di. Opera\u010dn\u00ed syst\u00e9m kl\u00ed\u010d nikdy nevid\u00ed a k odem\u010den\u00ed dat nen\u00ed pot\u0159eba \u017e\u00e1dn\u00fd software.<\/span><\/p>\n

    Pro\u010d je to d\u016fle\u017eit\u00e9:<\/span><\/strong>\u00a0Tato za\u0159\u00edzen\u00ed vylu\u010duj\u00ed po\u010d\u00edta\u010d a opera\u010dn\u00ed syst\u00e9m z \u0159et\u011bzce d\u016fv\u011bry. Ani napaden\u00fd po\u010d\u00edta\u010d nem\u00e1 p\u0159\u00edstup k obsahu bez spr\u00e1vn\u00e9ho PIN k\u00f3du.<\/span><\/p>\n

    Nejlep\u0161\u00ed pro:<\/span><\/strong>\u00a0P\u0159enos nebo archivaci citliv\u00fdch dat a pro u\u017eivatele, kte\u0159\u00ed pot\u0159ebuj\u00ed bezpe\u010dn\u00e9 a p\u0159enosn\u00e9 \u00falo\u017ei\u0161t\u011b.<\/span><\/p>\n

    Hardwarov\u00fd bezpe\u010dnostn\u00ed kl\u00ed\u010d<\/span><\/h3>\n

    Co to je:<\/span><\/strong>\u00a0Za\u0159\u00edzen\u00ed jako YubiKeys nebo Nitrokeys, kter\u00e1 ukl\u00e1daj\u00ed kryptografick\u00e1 p\u0159\u00edstupov\u00e1 data pro \u00fa\u010dely ov\u011b\u0159ov\u00e1n\u00ed.<\/span><\/p>\n

    Jak funguj\u00ed:<\/span><\/strong>\u00a0Neobsahuj\u00ed p\u0159\u00edmo va\u0161e \u0161ifrovan\u00e1 data, ale slou\u017e\u00ed jako hardwarov\u00e9 faktory pro odemyk\u00e1n\u00ed syst\u00e9m\u016f nebo spr\u00e1vu \u0161ifrovan\u00fdch z\u00e1loh. Zaji\u0161\u0165uj\u00ed, \u017ee k chr\u00e1n\u011bn\u00fdm dat\u016fm m\u00e1 p\u0159\u00edstup pouze n\u011bkdo s fyzick\u00fdm kl\u00ed\u010dem.<\/span><\/p>\n

    Pro\u010d je to d\u016fle\u017eit\u00e9:<\/span><\/strong>\u00a0Sni\u017euj\u00ed z\u00e1vislost na heslech a cloudov\u00e9m obnoven\u00ed. I v p\u0159\u00edpad\u011b odcizen\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f absence fyzick\u00e9ho kl\u00ed\u010de znemo\u017en\u00ed p\u0159\u00edstup.<\/span><\/p>\n

    Nejlep\u0161\u00ed pro:<\/span><\/strong>\u00a0P\u0159id\u00e1n\u00ed hardwarov\u00e9 bezpe\u010dnostn\u00ed vrstvy do spr\u00e1vc\u016f hesel, \u0161ifrovan\u00fdch kontejner\u016f nebo p\u0159ihla\u0161ovac\u00edch syst\u00e9m\u016f.<\/span><\/p>\n

    Pokud mus\u00edte z\u016fstat u Windows<\/span><\/h2>\n

    Je mo\u017en\u00e9 zmen\u0161it plochu \u00fatoku a z\u00e1rove\u0148 z\u016fstat v ekosyst\u00e9mu Microsoftu \u2013 v\u00fdsledkem je v\u0161ak kompromis, nikoli skute\u010dn\u00e9 \u0159e\u0161en\u00ed.<\/span><\/p>\n

    Kroky:<\/span><\/strong><\/p>\n