Linux's full disk encryption (FDE) is probably good at discouraging evil-maid attacks if used with a passphrase that the user enters every boot. But you know h

Linux's full disk encryption (FDE) is probably good at discouraging evil-maid attacks if used with a passphrase that the user enters every boot. But you know how Linux is: anyone can add any feature, no matter how bad of an idea it is. What is probably going on is that Linux's secure-boot support is not good enough to allow secure TPM-based FDE, but someone implemented it anyway. (Or it is good enough if you use a unified kernel image, but most Linux installs do not do that: https://wiki.archlinux.org/title/Unified_kernel_image https://wiki.archlinux.org/title/Unified_kernel_image) Fedora's installer offers me the chance to turn on full disk encryption, but it does not offer me the option of TPM-based FDE. >This attack is a big deal because it provides a workaround to full desk encryption. Security is complicated, and this statement simplifies the situation too much.