3 ms·

Considering this point : > LibreCrypt does not support encryption of the operating system partition, for this we recommend Ubuntu Linux. What are the benefits

Considering this point : > LibreCrypt does not support encryption of the operating system partition, for this we recommend Ubuntu Linux. What are the benefits of encrypting a partition over using an encrypted file mounted as a partition ?

beagle3 11y ago
Note they are discussion the OS partition, not just any partition. If the OS partition is unencrypted, it is easier to trojan a system if you have access to it without the key (just replace some executable that is bound to execute sooner or later). Also, a lot of cruft remains there such as temporary files, registry updates, etc; e.g. even if you work on a Word file inside an encrypted container, you might find enough parts of it in swap space, temporary files, registry etc - all of which are unencrypted. Other than swap and system partitions, there should be no difference. But some programs will leak info regardless - it's better to have everything encrypted than just some parts.
- johnchristopher 11y ago
  Ah, I see. I missed that point, thank you.
- tdk 11y ago
  It is entirely possible to trojan a system with an encrypted OS partition, by using a bootkit. For extra security, you should boot off a removable medium. Even this can be attacked if the BIOS is infected. LibreCrypt is useful against very specific threats. Protecting against attackers that have repeated physical access to your PC, and the technical nous to install keyloggers etc. involves way more than just using a particular Windows program, no matter it's features.
  - beagle3 11y ago
    Indeed, note I said "easier" and pointed one of the easier ways enabled by lack of OS partition encryption. I'll go even farther than parent: If your adversary is determined enough, you should assume that any physical access to your machine, for however short a period, means you should never ever use it again - and that you have no practical way to know if said access has indeed compromised your machine. See e.g., Thunderstrike. corollary: You can never be sure that your machine, which has passed through 10 different hands (factory, tester, packages, store, courier, ...) is not trojaned to begin with.

beagle3 11y ago

Note they are discussion the OS partition, not just any partition. If the OS partition is unencrypted, it is easier to trojan a system if you have access to it without the key (just replace some executable that is bound to execute sooner or later). Also, a lot of cruft remains there such as temporary files, registry updates, etc; e.g. even if you work on a Word file inside an encrypted container, you might find enough parts of it in swap space, temporary files, registry etc - all of which are unencrypted. Other than swap and system partitions, there should be no difference. But some programs will leak info regardless - it's better to have everything encrypted than just some parts.

johnchristopher 11y ago
Ah, I see. I missed that point, thank you.
tdk 11y ago
It is entirely possible to trojan a system with an encrypted OS partition, by using a bootkit. For extra security, you should boot off a removable medium. Even this can be attacked if the BIOS is infected. LibreCrypt is useful against very specific threats. Protecting against attackers that have repeated physical access to your PC, and the technical nous to install keyloggers etc. involves way more than just using a particular Windows program, no matter it's features.
- beagle3 11y ago
  Indeed, note I said "easier" and pointed one of the easier ways enabled by lack of OS partition encryption. I'll go even farther than parent: If your adversary is determined enough, you should assume that any physical access to your machine, for however short a period, means you should never ever use it again - and that you have no practical way to know if said access has indeed compromised your machine. See e.g., Thunderstrike. corollary: You can never be sure that your machine, which has passed through 10 different hands (factory, tester, packages, store, courier, ...) is not trojaned to begin with.