3 ms·

The parent was referring to doing it after the installation and he is right, it can't be done without serious hassle.

by Nux 8y ago

majewsky 8y ago
I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.
- chopin 8y ago
  For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive. Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally transparent to users (I need only to type the account password). I wouldn't mind typing in two passwords, other users on the systems not so much.
  - glandium 8y ago
    I did it "manually" a while ago: https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=141 https://glandium.org/blog/?p=141 There are more automated ways to do the conversion now. Here's the first one I found while searching for my own blog posts above: https://www.johannes-bauer.com/linux/luksipc/ https://www.johannes-bauer.com/linux/luksipc/
  - r3bl 8y ago
    You can encrypt /home/<user> relatively easily, but you can't avoid having to type in two passwords if you want FDE. You have to decrypt the hard drive to reach the login screen, and other users would have to do the same as well. You don't need to share any of those two passwords, since LUKS has up to 8 password slots I believe.
  - saint_abroad 8y ago
    > In Windows, encryption is totally transparent to users (I need only to type the account password). With transparent encryption, Windows decrypts the disk at boot using the TPM. Prior to login the disk is already mounted (decrypted). It provides an easy way for enterprise to say, "yes- we have FDE".
    - chopin 8y ago
      So there is no protection if the entire device is stolen (or put in a backroom at a border)? You can just boot it up and acess the disk without having a user? The Wikipedia page on Bitlocker does not mention this problem for TPM mode. Or is only a part decrypted until a user logs in? Edited to add: The best I could find was this discussion: https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_point_of_bitlocker_with_tpmonly_mode_as/ https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_...
throwaway77384 8y ago
Ah, having re-read the post, I still don't really get that from it, but that's probably just down to me missing the point regarding central management of keys. So, then, after installation, yes, I could see how that would be a nightmare. I have never attempted it!

The parent was referring to doing it after the installation and he is right, it can't be done without serious hassle.

by Nux 8y ago

The parent was referring to doing it after the installation and he is right, it can't be done without serious hassle.

I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.

chopin 8y ago
For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive. Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally transparent to users (I need only to type the account password). I wouldn't mind typing in two passwords, other users on the systems not so much.
- glandium 8y ago
  I did it "manually" a while ago: https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=141 https://glandium.org/blog/?p=141 There are more automated ways to do the conversion now. Here's the first one I found while searching for my own blog posts above: https://www.johannes-bauer.com/linux/luksipc/ https://www.johannes-bauer.com/linux/luksipc/
- r3bl 8y ago
  You can encrypt /home/<user> relatively easily, but you can't avoid having to type in two passwords if you want FDE. You have to decrypt the hard drive to reach the login screen, and other users would have to do the same as well. You don't need to share any of those two passwords, since LUKS has up to 8 password slots I believe.
- saint_abroad 8y ago
  > In Windows, encryption is totally transparent to users (I need only to type the account password). With transparent encryption, Windows decrypts the disk at boot using the TPM. Prior to login the disk is already mounted (decrypted). It provides an easy way for enterprise to say, "yes- we have FDE".
  - chopin 8y ago
    So there is no protection if the entire device is stolen (or put in a backroom at a border)? You can just boot it up and acess the disk without having a user? The Wikipedia page on Bitlocker does not mention this problem for TPM mode. Or is only a part decrypted until a user logs in? Edited to add: The best I could find was this discussion: https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_point_of_bitlocker_with_tpmonly_mode_as/ https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_...

throwaway77384 8y ago

Ah, having re-read the post, I still don't really get that from it, but that's probably just down to me missing the point regarding central management of keys. So, then, after installation, yes, I could see how that would be a nightmare. I have never attempted it!