On: New Year's Resolution: Full Disk Encryption on Eve...

[jrgifford]

Unfortunately, the amount of time I spend running/breaking the development version of Ubuntu prohibits full disk encryption, but I do have /home encrypted. Is that "good enough"?

[morsch → jrgifford]

That's what I intend to do the next opportunity I get. Your swap space could still leak confidential information, though.

[jrgifford → morsch]

I'm willing to risk that since I rarely use any of my swap.

[slug → jrgifford]

You can and should encrypt your partition, since your home key might end up there.

https://help.ubuntu.com/community/EncryptedFilesystems

If you want hibernate to work you can use uswsusp for example: https://we.riseup.net/debian/encrypted-swap

Sleep always works, but as mentioned above, your key will be in memory...

[jrgifford → slug]

Interesting.... I think i'll stick with user directory encryption, but thanks for those links.

[slug → jrgifford]

Well, I use /home with luks on some machines and user directory (encfs) on others, but have all of them with swap encrypted or no swap partition at all.

Since the keys/other private info might leak there, you are not doing it right, unless you have sysctl swappness level set to 0.

Not only that, /tmp and other temporary directories might also be another leaky place...

[zurn → jrgifford]

It's not reliable. Think /tmp (deleted temp file data can be recovered), hibernate/swap, log files, and so on. And OS can be more easily tampered with undetected (rootkits/keyloggers etc).

[jrgifford → zurn]

Considering my habit of re-installing the entire OS every few weeks (I tinker a lot with no safety nets), I think I'm ok. I agree that for anyone else though, it isn't enough.