I also set up FileVault on my Mac, which I don't particularly like because it uses my login password to encrypt the hard drive. I run Mint on my ThinkPad, and

I also set up FileVault on my Mac, which I don't particularly like because it uses my login password to encrypt the hard drive. I run Mint on my ThinkPad, and encrypted the hard drive at install-time (which is LUKS in the background). This means I have a separate password for the OS and my user data. The boot password is very long (it's a saying that is memorable to me) so is pretty difficult to brute-force, while my user password is complex enough for regular use. I also have my user data encrypted. LUKS can leverage the AES instructions on current-gen CPUs to speed up encrypted operations to near-native speeds, but even without it, you'll only notice a slow-down if you're doing heavy IO. My MBP is an old Core 2 Duo and is not unsable with FDE enabled. I also used my Yubikey as a second factor for a time - you can hook this into the LUKS decryption screen to hash the passphrase a second time to generate the decryption key. While I was at it, I had my Yubikey set up to be required to log in or unlock the screen. So while there was a backup passphrase to unlock the hard drive, I couldn't get into my own user account without the Yubikey. I eventually disabled this because I thought it was overkill, but it works pretty well. However, don't forget that encryption ONLY protects data at rest! A laptop in sleep mode is NOT secure, even with FDE. I always shut down the machine completely when I'm in a situation I could lose it (e.g. airport security). Otherwise, the keys are kept in memory, and a determined hacker has ways of getting to them - look up DMA attacks. Downloading the contents of RAM through a firewire port is pretty trivial these days. A final thing to note - none of these methods stop a thief installing their own OS on your machine. Whilst this means your data is secure, you can make things a little bit harder for the thief by adding a boot or BIOS password to prevent them booting from a different medium. There are ways to reset this, admittedly, but since it won't get in your way (much), add another stumbling block for your enemy.