Hacker News Reader

Comment by discordianfish | Hacker News Reader

It's FUD. ext4 with LUKS, which is what pretty much everyone is using on a desktop, is still working and the client supported.

View on HN

Ubuntu's installer for a long while set up an "encrypted home directory" using eCryptFS, i.e., file-level encryption on top of ext4. That's the thing Dropbox is finding painful to support.

Migrating away from that to block-level "full disk" encryption basically requires copying all your files. If you're using <50% of your disk and you feel comfortable doing tricks with partition resizing you can do it, otherwise the best approach is to back up your files (hopefully to encrypted media...) and restore them.

No, it's not FUD. encrypted ext4 is encfs and ecryptfs, not xy on LUKs, and yes, they did drop support.

Just FYI: Ext4 has file-level encryption built-in now [1, 2], so 'encrypted ext4' is actually different from encfs and ecryptfs.

[1]: https://www.kernel.org/doc/html/v4.19/filesystems/fscrypt.ht...

[2]: https://wiki.archlinux.org/index.php/ext4#Using_file-based_e...

I didn't know this, that's new for me.

It's potentially misleading phrasing. "Unencrypted ext4" means that the filesystem Dropbox sees has to be actual ext4, not an encryption layer on top. There can be an encryption layer under it, and generally full-disk encryption works that way, by encrypting a block device and letting you run whatever filesystem you want on top.

"Unencrypted or decrypted ext4" might be slightly more accurate (although I guess it maybe sounds like you need to remove encryption, not that you just need to decrypt files in memory).

"Encrypted ext4" most likely refers to ext4's built-in support for file-based encryption.

In fairness, it's pretty difficult (read: impossible) to enable full-disk encryption on an NVME drive (read: most Ultrabooks including the Dell XPS "Developer Edition.")

https://www.dell.com/community/Linux-Developer-Systems/XPS-1...

Full-disk encryption usually means encryption at the block layer below the filesystem. It doesn't actually have to cover the full disk.

There is almost always at least one unencrypted partition on machines with full-disk encryption, since the boot loader and then the decryption routine have to be launched from somewhere. And yes, OEM recovery partitions or similar laptop-specific needs are another case.

Full-partition would be a more accurate term than full-disk.

I use full-disk encryption on my old thinkpad. As in, the whole disk is encrypted, from first sector to last. There isn't even a MBR or a partition table on it! I boot the laptop from my USB stick which contains the kernel and initrd. That's what I call full-disk encryption ;)

I would love to see a post on how to set that up!

DiskCryptor does it in Windows fairly easily and lets you install the bootloader to USB.

If you've ever installed gentoo, then it shouldn't be too difficult. Follow the installation steps but instead of partitioning the harddrive and installing into one partition, make the filesystem across the whole harddrive (eg. `mkfs.ext4 /dev/sda`) and install into that. The system on the laptop (Lenovo X61) is really old (like 8 years at least), back then I needed to perform some manual steps to ensure the initrd has the necessary tools so it can mount an decrypt the root partition, this is probably not necessary anymore. Upgrading kernels has to be done carefully, because I must make sure the USB stick contains a compatible kernel. I also need to configure the UEFI boot menu so that it knows where to find the kernels. Fun stuff.

I wouldn't know where to start if you want to use ubuntu or another more user friendly distribution though.

You _can_ do it with libreboot on ancient thinkpads, but it requires a decent time (or money) investment and some know-how. https://libreboot.org/docs/gnulinux/encrypted_trisquel.html

Cool. :) Even there, you do have some disk or partition unencrypted, it just happens to be on removable media. Good counterexample, though uncommon.

Just make sure nobody swaps out your stick :)

Isn’t this how FileVault works?

Be more respectful. It broke my workflow which is having my $HOME on NFS which is also nuked with the stupid Dropbox change.

Add it to the already long list of software that misbehaves over NFS.

Ceph/RBD with the filesystem of your choice that supports xattrs is pretty much the only way to get full application compatibility.

Why don't I just keep my data in a database then?

That's essentially what Ceph does. It's just implementing a filesystem interface on top of a generic object store.

Yes, sorry, there was sarcasm involved.

NFS is widely supported and has great performance. I'm open for alternatives, but only if supported by FreeNAS where my files live.

When installing Ubuntu from scratch and follow defaults you end up with ecryptfs, not LUKS

They recently (around 17.10 I think) removed encryptfs, they only support LUKS now.

Reply on news.ycombinator.com