This makes a world of difference. I know many people may know of it but may not actually do it. It Protects your files in case your computer is ever stolen and prevents alphabet agencies from just brute forcing into your Laptop or whatever.

I found that Limine (bootloader) has the fastest decryption when paired with LUKS at least for my laptop.

If your computer isn’t encrypted I could make a live USB of a distro, plug it into your computer, boot, and view your files on your hard drive. Completely bypassing your Login manager. If your computer is encrypted I could not. Use a strong password and different from your login

Benefits of Using LUKS with GRUB Enhanced Security

  • Data Protection: LUKS (Linux Unified Key Setup) encrypts disk partitions, ensuring that data remains secure even if the physical device is stolen.
  • Full Disk Encryption: It can encrypt the entire disk, including sensitive files and swap space, preventing unauthorized access to confidential information.

Compatibility with GRUB

  • Unlocking from Bootloader: GRUB can unlock LUKS-encrypted partitions using the cryptomount command, allowing the system to boot securely without exposing sensitive data.
  • Support for LVM: When combined with Logical Volume Management (LVM), LUKS allows for flexible partition management while maintaining encryption.
  • gi1242@lemmy.world
    153·
    1 day ago

    I found it better to just encrypt one folder with all my sensitive info (I use gocryptfs). i saw no reason to have my zshrc and init.lua encrypted 🙂 and I just encrypt data I don’t want in the hands of others…

      • gi1242@lemmy.world
        1·
        2 hours ago

        I did think about this… but decided against it in the end. maybe on my next computer

      • gi1242@lemmy.world
        1·
        2 hours ago

        ur def right about this. there are a few other things (e. g. cached mail etc) that would be good to encrypt, which I don’t do right now.

        if my computer gets stolen I figure no one will bother with my data unless they stand to immediately gain financially. e.g. ransom. my data (I have backups) or access my bank info (I keep this encrypted) and steal my identity. so I protect against this as best as I can without sacrificing usability too much

        • Jason2357@lemmy.ca
          6·
          23 hours ago

          Don’t forget /tmp, and maybe logs too. Theres docker storage and kvm image locations if you use that. Maybe others. FDE also makes an evil maid attack much less trivial too.

          • Nalivai@lemmy.world
            1·
            14 hours ago

            I don’t know, I don’t see a lot of damage or unpleasantness stemming from someone getting into my /tmp, but I don’t want any llm being fed contents of my /home. I am less afraid of an attack, as I am irked by corpos putting fingers into my shit

            • Pup Biru@aussie.zoneEnglish
              2·
              9 hours ago

              corpos aren’t who you’re protecting against with encrypted drives… they’re not going to gain access to anything via bypassing your OS: they get everything via software you’ve installed or things like tracking

              the main thing you’re protecting against with encryption is theft (or if you think you’re being physically targeted, it also stops them from modifying your system… eg replacing your kernel or a binary that gives them access somehow)

      • gi1242@lemmy.world
        3·
        19 hours ago

        so the issue with whole drive encryption is that all the data is decrypted 100% of the time I’m using the device. even when I sleep the device …

        with one folder, I ensure it’s unmounted and encrypted before my computer sleeps.

        • Magnum, P.I.@lemmy.dbzer0.com
          2·
          15 hours ago

          But when your Computer is on and the drive is mounted, its also decrypted and available? What’s the attack vector here? Someone coming into my house yoinking my computer while its asleep without interrupting the power?

          • f4f4f4f4f4f4f4f4@sopuli.xyzEnglish
            2·
            12 hours ago

            I have seen the use of such a device by gov’t agencies; basically a large UPS that clips onto the AC plug’s prongs so that a running server or desktop PC can be confiscated without power being interrupted.

            • gi1242@lemmy.world
              1·
              3 hours ago

              this sounds cool. if my desktop is plugged into the wall, how would they unplug it to plug it into their device without my computer losing power momentarily?

          • gi1242@lemmy.world
            1·
            15 hours ago

            usually I sleep my laptop and take it with me. with full disk encryption, if my bag gets stolen my files are all decrypted if the attacker gets past the lock screen.

            getting past a lock screen is much easier than breaking encryption ofc

            more importantly my desktop is online 24/7 with a static IP. if I get hacked they get all my data (bank passwords etc). but with the one folder encryption, if I get hacked they get my zshrc and init.lua 🙂

              • gi1242@lemmy.world
                1·
                3 hours ago

                lol no. i currently reboot once every two weeks and find it a chore. (it’s my one complaint about arch as the kernel updates are so frequent). I’m def not going to waste time reopening all my windows and tabs every time I open my computer just to keep my zshrc encrypted. i realized long ago that security and usability are inversely related, and I picked the middle ground that suits me

          • offspec@lemmy.world
            2·
            17 hours ago

            Files are encrypted at rest, if they are not actively interfacing with the encrypted mount it is secure. If you encrypt your entire system it’s safe from attacks when powered off, but as soon as you’re booted in the machine is fully accessible.