Hacker News Reader

Comment by battery_cowboy | Hacker News Reader

I would guess most folks here use full disk encryption, which would generally preclude you from reading the filesystem if you don't have the password any longer. If not, this is a good article to convince you to do so since anyone could do something similar to your laptop with no encryption.

View on HN

I am scared to use full disk encryption or $HOME encryption because of potential loss of speed, hardware failures because of fragmenting or SSD grinding, the inability to use file recovering tools and being locked out if anything goes wrong. I just read changing the password might lock me out if the key is encrypted (or something).

Any tips?

Speed loss is unnoticeable with any recent hardware (less than a decade old) and typical workloads (even for developers).

If concerns about losing data are a roadblock, then you need a good backup strategy. You're already rolling the dice that you'll never have a hardware failure, human error, natural disaster, theft...

I can't speak to your SSD wear concern or potential issues during password changes.

Run 'cryptsetup luksHeaderBackup' and store it in a safe place. If you manage to corrupt your LUKS header, you can restore it from the backup.

The master encryption key in the LUKS header is still encrypted by your passphrase, so don't use this as an alternative to remembering your passphrase!

There is no loss of speed on any CPU that supports AES instructions, which is pretty much any CPU released after 2010.

encryption password ≠ root password , at least not for me :-)

The root password is pretty useless by itself if you can't decrypt the data.

Sure but you might have forgotten your root password and remembered your disk encryption pw

Reply on news.ycombinator.com