4 ms·

Probably not... any form of partial encryption (ie not the full block device) needs to make sure no sensitive data leaks outside the encrypted parts (/tmp and s

Probably not... any form of partial encryption (ie not the full block device) needs to make sure no sensitive data leaks outside the encrypted parts (/tmp and swap? /var if you only encrypt /home?) Depending on the implementation the filesystem metadata may also reveal more data than needed. The attacker can probably ignore that 4GB file that wasn't modified for a year (a downloaded ISO image?) but that 20KB file that was recently modified might be that passwords.txt he was looking for..

tptacek 7y ago
It depends on what your biggest concern is. Large scale metadata analysis is a concern that block-level encryption does a better job of than "file filter encryption" does. Authenticated encryption, which prevents people from bitflipping your init scripts into bindshells if you lose access to your laptop for a few minutes, is something that file encryption addresses and block encryption basically doesn't. The important thing is that you don't really have to choose; a true encrypted filesystem can give you both things. Block-level encryption can't.