Hacker News Reader

Comment by keithpeter | Hacker News Reader

I use whole drive encryption to protect data in the event I leave my old X220 (Fedora) on the bus.

I don't mind boot times in the 20s range (X220/Fedora/cheapo SSD) too much, but I do need to close down/reboot a couple of times a day otherwise no point in encryption.

View on HN

> but I do need to close down/reboot a couple of times a day otherwise no point in encryption.

Given, I'm not a Linux user, but I don't understand this at all.

On Windows, encrypted is encrypted-- the lock screen is exactly as secure as the login screen. Are you saying that in Linux the lock screen is easily-bypassed? So you have to keep your computer logged-out when you're in a place it might get stolen?

> On Windows, encrypted is encrypted

Wasn't there a recent story about how Windows is storing keys so that it can wake up in the middle of the night and apply updates? I thought that the conclusion was that locked isn't as secure as logged out.

I believe that would be 'encrypt my home drive' on Linux, then you basically log out to protect files. Not sure though.

What I'm not understanding is why logging out or rebooting is required to keep a computer with full disk encryption secure. That's certainly not the case on competing OSes like Windows.

Usually in Linux the system is installed on an encrypted filesystem (cryptsetup, LUKS). Only kernel and so called initrd image (early boot stuff) is outside the encryption. The disk is opened at very early stage in boot when just about the kernel is loaded. Thus, the encryption is open whenever the operating system is running. Everything is of course still transparently encrypted on disk but the "lock" is open. One must shut down the computer to close the filesystem's encryption.

"Then click Install Now, and follow the rest of the instructions until you get to the “Who are you?” page. Make sure to choose a strong password — if someone steals your laptop while it’s suspended, this password is all that comes between the attacker and your data. And make sure that “Require my password to log in” is checked, and that “Log in automatically” is not checked. There is no reason to check “Encrypt my home folder” here, because you’re already encrypting your entire disk."

Above quote is from the section titled 'How to encrypt your disk in Linux' on the page at

https://theintercept.com/2015/04/27/encrypting-laptop-like-m...

I'm just a bit confused about how Windows can remove keys without messing up file handles &c when suspending to RAM.

The level of security I have now is adequate to my purpose but certainly something for others to take into consideration. Thanks for posting.

Reply on news.ycombinator.com