I was recently intrigued to learn that only half of the respondents to a survey said that they used disk encryption. Android, iOS, macOS, and Windows have been increasingly using encryption by default. On the other hand, while most Linux installers I’ve encountered include the option to encrypt, it is not selected by default.
Whether it’s a test bench, beater laptop, NAS, or daily driver, I encrypt for peace of mind. Whatever I end up doing on my machines, I can be pretty confident my data won’t end up in the wrong hands if the drive is stolen or lost and can be erased by simply overwriting the LUKS header. Recovering from an unbootable state or copying files out from an encrypted boot drive only takes a couple more commands compared to an unencrypted setup.
But that’s just me and I’m curious to hear what other reasons to encrypt or not to encrypt are out there.
I don’t https://xkcd.com/538/
I’m convinced the chances of me losing access to the data are higher than encryption protecting it from a bad actor.
Let’s be real, full disk encryption won’t protect a running system and if someone has physical access and really wants it, encryption won’t protect you from the $5 wrench either.
I do encrypt my phone data though, as someone running away with my phone is more realistic.
Who’s gonna come at me with a $5 wrench because they really want my data, though? The attack I’m most likely to experience is someone stealing my laptop while I’m out traveling. That’s what full filesystem encryption solves best.
Or per XKCD, where are they finding a wrench for $5??
Here’s one for less than 4 USD. I imagine 150 mm in length would be sufficient.
Wow that’s cheap!
Watch out crypt nerds!
Edit: crypto, not crypt! Leaving it 🧟♀️
It’s much worse: They can re-use the same wrench.
(Disgusting, I know… 😝 )
I’d imagine you could get a decent bludgeoning wrench for around that at a pawn shop. Doesn’t need to be super functional. A pipe wrench in need of some rehabilitation would work nicely.
Or just a pipe.
I’m not worried about getting raided by the KGB or anything like that, but break-ins happen and my computer equipment would be a prime target for theft.
I occasionally cycle my backup drives off-site, so I want those encrypted as well.
The cost of encryption is very close to zero, so I don’t even entertain the question of whether I should encrypt or not. I just encrypt by default.
Possibly overestimating the value of the data entrusted to me, but whenever I see that xkcd, I like to think that I at least have the option to remain silent and die with dignity if I really don’t want the contents of my disk out there.
Nothing I have is worth dying over. I’d give up on the first threat.
Drives in server are not encrypted but backups to the cloud are. Laptop used to but causes to many issues and it doesn’t really leave the house much.
Tackling the real issues right here!
If I remember correctly, some USA agency said torture is ineffective because you will talk, you like it or not. When you are asking someone for a thing they don’t know they will say a lie just to stop the pain. So I guess anyone will give their password with enough time
It should be encrypted by default because most people don’t take care to dispose of their machines responsibly. I picked up a few machines destined for ewaste and the hard drives were full of tax returns.
Lol police doesnt just use a hammer
My Laptop and Phone have encrypted drives, my Desktop doesn’t.
I don’t think I encrypt my drives and the main reason is it’s usually not a one-click process. I’m also not sure of the benefits from a personal perspective. If the government gets my drives I assume they’ll crack it in no time. If a hacker gets into my PC or a virus I’m assuming it will run while the drive is in an unencrypted state anyway. So I’m assuming it really only protects me from an unsophisticated attacker stealing my drive or machine.
Please educate me if I got this wrong.
Edit: Thanks for the counter points. I’ll look into activating encryption on my machines if they don’t already have it.
is it’s usually not a one-click process
It is, these days. Ubuntu and Fedora, for example. But you still have to select it or it won’t happen. PopOS, being explicitly designed for laptops, has it by default.
If the government gets my drives I assume they’ll crack it in no time.
Depends on your passphrase. If you follow best practice and go with, say, a 25-character passphrase made up of obscure dictionary words, then no, even a state will not be cracking it quickly at all.
If a hacker gets into my PC or a virus I’m assuming it will run while the drive is in an unencrypted state anyway.
Exactly. This is the weak link of disk encryption. You usually need to turn off the machine, i.e. lose the key from memory, in order to get the full benefits. A couple of consolations: (1) In an emergency, you at least have the option of locking it down; just turn it off - even a hard shutdown will do. (2) As you say, only a sophisticated attacker, like the police, will have the skills to break open your screenlocked machine while avoiding any shutdown or reboot.
Another, less obvious, reason for encrypting: it means you can sell the drive, or laptop, without having to wipe it. Encrypted data is inaccessible, by definition.
Encryption of personal data should be the default everywhere. Period.
Well said. LUKS implements AES-256, which is also entrusted by the U.S. government and various other governments to protect data from state and non-state adversaries.
A big benefit of encryption is that if your stuff is stolen, it adds a lot of time for you to change passwords and invalidate any signed in accounts, email credentials, login sessions, etc.
This is true even if a sophisticated person steals the computer. If you leave it wide open then they can go right in and copy your cookies, logins, and passwords way faster. But if it’s encrypted, they need to plug your drive into their system and try to crack your stuff, which takes decent time to set up. And the cracking itself, even if it takes only hours, would be even more time you can use to secure your online accounts.
On Linux, my installs always had a checkbox plus a password form for the encryption.
I think this is true for computers that are in danger of being stolen. Laptops or PCs in dorms or other shared living spaces. But I live in a relatively secure area, burglaries are very rare and my PC never leaves the building. So the benefits of encryption are pretty much negligible.
What are the downsides to encryption? Though you may have negligible benefits, if there are also negligible downsides then the more secure option should be chosen.
- The LUKS encryption can get corrupted
- The password may be forgotten
- harddrives can be corrupted, too. That’s where backups come in
- True, though one could use a security key or password manager to overcome that, or setup secure boot/TPM to where a password isn’t actually needed. If all else fails, again, backups.
So when the laptop dies, the disk cannot be read anywhere because the tpm is lost?
Correct, the hard disk in the laptop can not be read. This is where having a good backup strategy is important. Similar to how if your hard disk dies you’re no longer able to access the material on the hard disk. For me, the downsides of encryption do not outweigh the benefits of having my data secure.
I enabled full disk encryption during OS installation, set up a secure passphrase, and then set up automated encrypted backups to my home server, which are automatically backed up to a remote server.
I gain peace of mind in knowing that if my laptop is stolen I’m only out the cost of the laptop, the data within is still safe and secure.
It is a one click process if you use user friendly distros
GNOME disks is a nice GUI that lets you setup disks with ease. Encryption can be easily setup with it.
I used to, but then I nuked my install accidentally and I couldn’t recover the encrypted data. I nuke my installs fairly regularly. I just did again this past week while trying to resize my / and my /home partitions. I’ve resigned myself to only encrypting specific files and directories on demand.
My phone is fully encrypted though.
Your recovery problem was a backup issue not an encryption issue. Consider addressing the backup issue.
I have and I’ve concluded that I’m not made of money and therefore can’t afford to have multiple terabyte drives just lying around with redundant data just in case.
If I could afford it, then I wouldn’t have been resizing my ‘/’ partition to free up 80GB of space.
Yeah, on my laptop - because I travel with it and confidential data (like from my customers) could land in hands its not supposed to
No, in case of my desktop, because it’s easier to access it in case of failure
My thinking is similar. I’ve seen this news story more than once:
laptop stolen containing customer data… hard drive was not encrypted
I don’t generally have customer data, but it can happen every once in a while.
I don’t, I didn’t do it back then and I ended up using this system for much longer than I thought I would(4+ years). I want to do it next time but I don’t feel like reinstalling just for that.
Good news, you can use cryptsetup to do it in place! https://unix.stackexchange.com/questions/444931/is-there-a-way-to-encrypt-disk-without-formatting-it
I wish I found a guide like that back when I first made the move to FDE. Regardless, I was adamantly against reinstalling and painstakingly replicating my customizations, so I came up with a hacky way of tacking on FDE.
It went something along the lines of:
- Shrinking the root partition as much as possible
- From Live CD, dd root partition to external drive
- Perform minimal encrypted install of Debian
- From Live CD, open LUKS container of the newly-installed Debian and overwrite the root partition within with my old root partition.
- Update fstab, crypttab, initramfs, and grub
- Cross my fingers and reboot
No. I prefer the quickest way to share my data between different computers and operating systems on my home network. I will also mention that my network is not accessible over the internet.
Speaking as someone who doesn’t encrypt their desktop but is thinking about it:
you can’t share (readable) data over one’s home network if the sending PC is disk-encrypted?
For example, are you saying that if I send a video file from my PC, which is disk-encrypted, over LAN to my NAS, then the NAS would not be able to read said file?
Disk encryption does not impact file sharing over the network.
Sure if you sharing by a USB portable drive you have to unlock and lock it every time you use it. That is separate thing though.
The bigger issues of encryption are one should have a good backup and recovery plan both for media and for the keys. One has to consider legacy planning too. How do your personal representatives access.
deleted by creator
I encrypt everything that leaves my house since it could be easily lost or stolen, but it is rather inconvenient.
If someone breaks into my house, I’ve got bigger problems than someone getting their hands on my media collection. I think it would be more likely for me to mess something up and loose access to my data than for someone to steal it.
laptop yeah
desktop nah
Same here. My desktop is in a controlled environment, so I don’t see a need. Plus, if I do have some sort of issue, I will still be able to access those files.
Since I actually take my laptop places, I have that encrypted for sure.
Yeah me too. It goes back to your threat level. How likely is it that someone is going to break into my home to steal my desktop all James Bond-like? The answer is, “not very.” Anything mobile has a significantly higher probability of falling into the wrong hands. These things are encrypted. Even the very old laptop that never leaves my house is encrypted because it could.
I encrypt all my drives. Me and the people I know get occasionally raided by the police. Plus I guess also provides protection for nosy civilians who get their hands on my devices. Unlike most security measures, there is hardly any downside to encrypting your drives—a minor performance hit, not noticeable on modern hardware, and having to type in a password upon boot, which you normally have to do anyway.
Where do you live that you’re getting raided by the police? This sounds like one of those situations where they might use the wrench technique.
I don’t want to say where I live for anonymity reasons, but I will note that it’s fairly standard for political dissidents to be raided by any government so it doesn’t actually particularly narrow down my location.
What’s the wrench technique?
Ah lol sure. It depends on what level of state repression you’re looking at. Regular cops will just not bother trying to decrypt a drive if they don’t have the password and you don’t freely give it up (you have the right to refuse to provide a password here, it’s under the same kind of principle as having the right to not incriminate yourself), but I’m sure military intelligence etc will go to the wrench technique. Also deniable encryption for anything particularly sensitive is good for the old wrench technique.
No.
I spend a significant amount of time on other things, e.g. NOT using BigTech, no Facebook, Insta, Google, etc where I would “volunteer” private information for a discount. I do lock the physical door of my house (most of the time, not always) and have a password … but if somebody is eager and skilled enough to break in my home to get my disks, honestly they “deserve” the content.
It’s a bit like if somebody where to break in and stole my stuff at home, my gadgets or jewelry. Of course I do not welcome it, nor help with it hence the lock on the front door or closed windows, but at some point I also don’t have cameras, alarms, etc. Honestly I don’t think I have enough stuff worth risking breaking in for, both physical and digital. The “stuff” I mostly cherish is relationship with people, skills I learned, arguably stuff I built through those skills … but even that can be built again. So in truth I don’t care much.
I’d argue security is always a compromise, a trade of between convenience and access. Once you have few things in place, e.g. password, 2nd step auth, physical token e.g. YubiKeyBio, the rest becomes marginally “safer” for significant more hassle.
but if somebody is eager and skilled enough to break in my home to get my disks, honestly they “deserve” the content.
The problem with “my disks” is there’s always some other’s people on it, in one way or another.
But of course, it’s your call. We all have gaps in our “walls” and it’s not like I’d be pretending that LUKS is all that matters.
No. I break my system occasionally and then it’s a hassle.
I don’t really see the point. If someone’s trying to access my data it’s most likely to be from kind of remote exploit so encryption won’t help me. If someone’s breaks into my house and steals my computer I doubt they’ll be clever enough to do anything with it. I guess there’s the chance that they might sell it online and it gets grabbed by someone who might do something, but most of my important stuff is protected with two factor authentication. It’s getting pretty far fetched that someone might be able to crack all my passwords and access things that way.
It’s far more likely that it’s me trying to recover data and I’ve forgotten my password for the drive.
My laptops are encrypted in case they get stolen or someone gets access to them at uni.
i’d really like to. but there is ONE big problem:
Keyboard layouts.
seriously
I hate having to deal with that. when I set up my laptop with ubuntu, I tried at least 3 thymes to make it work, but no matter what I tried I was just locked out of my brand-new system. it cant just be y and z being flipped, I tried that, maybe it was the french keyboard layout (which is absolutely fucked) or something else, but it just wouldnt work.
On my mint PC I have a similar problem with the default layout having weird extra keys and I just sort of work around that, because fuck dealing with terminals again. (when logged in it works, because I can manually change it to the right one.)
Now I do have about a TerraByte of storage encrypted, just for the… more sensitive stuff…
While dealing with the problems I stumbled across a story of a user who had to recover their data using muscle-memory, a broken keyboard, the same model of keyboard and probably a lot of patience. good luck to that guy.
Have you tried peppermint or maybe coriander?
Jokes aside, I believe the password entry stage is before any sort of localization happens, meaning what your keyboard looks like doesn’t matter and the input language defaults to English. You have to type as if you’re using an English keyboard. That’s hardly a good solution if you’re unfamiliar with that layout of course.
Initrd has support to configure the keyboard layout used. Consult your initrd generator’s documentation for this
