Ecryptfs is a fantastic solution. If you're using the passphrase-wrapped-by-login-password method (convenient, I think Ubuntu implements this method) then secur

Ecryptfs is a fantastic solution. If you're using the passphrase-wrapped-by-login-password method (convenient, I think Ubuntu implements this method) then security is not that great - because it's ultimately limited by the strength of your login password: if an attacker gets his hands on the wrapped passphrase, such as is the case when your laptop gets nicked, brute-force methods will suffice. As for /tmp and swap: those are not required to be persistent over reboots. So you can regenerate those with a random key on every boot. <a href="http://paste.pocoo.org/show/260932/>Here http://paste.pocoo.org/show/260932/>Here are some pointers to help you do that with dm-crypt</a> for a swap device backed by a loopback device.