3 ms·

Almost agree 100%, but why would you encrypt the whole disk? There is no need for that. It's 100% free software availabe for anyone. Encrypt your home directory

by paines 9y ago

Almost agree 100%, but why would you encrypt the whole disk? There is no need for that. It's 100% free software availabe for anyone. Encrypt your home directory. And this has Ubuntu figured out quite nicely IMHO.

mxvzr 9y ago
Encrypting the home directory ensures the privacy of your data should someone get his hands on your machine. Under the same scenario, full disk encryption would also gives you the guarantee the system hasn't been tampered with.
- klodolph 9y ago
  That's profoundly incorrect: full disk encryption provides no guarantees that your system has not been tampered with. I don't see how that would even be possible.
  - mxvzr 9y ago
    If the machine is turned off and only the home directory is encrypted, I am at liberty to patch the kernel or binaries, update your package manager or dns settings, or anything in between really. I can do none of that with FDE (assuming I don't already know the key of course). What am I missing here?
    - eikenberry 9y ago
      Once "they" have your machine you have to assume it is compromised. If they have the ability to install kernel patches or custom binaries, they most certainly have the ability to install monitoring hardware and/or modify your bios. That is, no matter what you encrypt your machine is compromised and your only recourse is to recover the encrypted data and move on to a new system. Here "they" is someone who would take your machine, modify it, and get it back to you maybe without your knowing. If you are just concerned with identity thieves and basic asset protection then as long as that stuff is encrypted you are fine, whether that is whole system, home directory, ~/Private directory, or just those specific files.
    - klodolph 9y ago
      It can't be turtles all the way down. If you encrypt /, then you're still not encrypting the kernel and I win. If you encrypt the kernel, then you're still not encrypting GRUB and I win. There's no way to prevent anyone from tampering with your system, or even to make any tampering evident. The best you can do is a cost-benefit analysis and risk analysis of the different options.
nnutter 9y ago
https://wiki.archlinux.org/index.php/Disk_encryption#Data_encryption_vs_system_encryption https://wiki.archlinux.org/index.php/Disk_encryption#Data_en...
klodolph 9y ago
Encrypting the full disk is easy, fast, and you don't have to think about whether e.g. some unencrypted log file is going to have your password in it because you accidentally typed your password into the username box. I use full disk encryption on Debian and macOS and it was easy to set up on both systems.

by paines 9y ago

mxvzr 9y ago

Encrypting the home directory ensures the privacy of your data should someone get his hands on your machine. Under the same scenario, full disk encryption would also gives you the guarantee the system hasn't been tampered with.

klodolph 9y ago
That's profoundly incorrect: full disk encryption provides no guarantees that your system has not been tampered with. I don't see how that would even be possible.
- mxvzr 9y ago
  If the machine is turned off and only the home directory is encrypted, I am at liberty to patch the kernel or binaries, update your package manager or dns settings, or anything in between really. I can do none of that with FDE (assuming I don't already know the key of course). What am I missing here?
  - eikenberry 9y ago
    Once "they" have your machine you have to assume it is compromised. If they have the ability to install kernel patches or custom binaries, they most certainly have the ability to install monitoring hardware and/or modify your bios. That is, no matter what you encrypt your machine is compromised and your only recourse is to recover the encrypted data and move on to a new system. Here "they" is someone who would take your machine, modify it, and get it back to you maybe without your knowing. If you are just concerned with identity thieves and basic asset protection then as long as that stuff is encrypted you are fine, whether that is whole system, home directory, ~/Private directory, or just those specific files.
  - klodolph 9y ago
    It can't be turtles all the way down. If you encrypt /, then you're still not encrypting the kernel and I win. If you encrypt the kernel, then you're still not encrypting GRUB and I win. There's no way to prevent anyone from tampering with your system, or even to make any tampering evident. The best you can do is a cost-benefit analysis and risk analysis of the different options.

nnutter 9y ago

https://wiki.archlinux.org/index.php/Disk_encryption#Data_encryption_vs_system_encryption https://wiki.archlinux.org/index.php/Disk_encryption#Data_en...

klodolph 9y ago

Encrypting the full disk is easy, fast, and you don't have to think about whether e.g. some unencrypted log file is going to have your password in it because you accidentally typed your password into the username box. I use full disk encryption on Debian and macOS and it was easy to set up on both systems.