About a year ago I had to re-enter the world of MS desktop OS's for commercial use. Given a need to dual-boot (GNU/Linux & Windows 7) I looked at the handful o

About a year ago I had to re-enter the world of MS desktop OS's for commercial use. Given a need to dual-boot (GNU/Linux & Windows 7) I looked at the handful of options that existed for on-disk encryption that was palatable to both, and settled on VeraCrypt (one of the TrueCrypt forks). Biggest surprise was the inflexibility with key management. What you say here -- encryption keys are not like online account passwords (you can't reset them) -- is NOT the default for people coming from dmcrypt[1], for example, where I can have multiple pass phrases / files to the same vault, easily adding and removing them. It feels odd to work with at rest encryptions systems, and I'm guessing Win10 has the same constraint out of the box?, that don't offer this feature. [1] https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption https://wiki.archlinux.org/index.php/Dm-crypt/Device_encrypt...