3 ms·

Then, naively, it would seem like anyone with physical access to the machine essentially has the drive decrypted for them auto-magical-ly at boot, defeating the

Then, naively, it would seem like anyone with physical access to the machine essentially has the drive decrypted for them auto-magical-ly at boot, defeating the purpose of encrypting. Of course, nothing prevents using additional encrypted containers within the filesystem for things of greater importance, but I digress… Regarding fingerprint: this is imaginary security, because people leave their fingerprints everywhere and social-engineering a person into placing fingerprints on something to be copied later is trivial. And if you go the extreme route of TV/film, fingers can be used after death or even removed. Now, as an additional layer of security, I like the idea of biometrics such as fingerprints. If Android would let me save fingerprints and enable recognition while still requiring lockscreen pattern, that would seem like a win.

joconde 5y ago
The laptop boots, the key goes into RAM, then the OS asks for a login password. I don't see a simple way to get the encryption key or log in without the password. Unless cold RAM attacks got much easier recently, I don't see where the problem is for an average user. Fingerprints are admittedly not a match against someone willing to collect mine and make a model of them, but I'm not expecting anyone to do this. If I were, I would disable the fingerprint sensor, of course. The point of these features is that they make it very easy to get to a reasonably good level of security. If the only option were an (admittedly more secure) strong passphrase to type at every boot, nobody would use it, which would be much worse.