Hacker News Reader

Comment by pkulak | Hacker News Reader

I totally thought they were turning on homed with encryption by default, and was _super_ excited. I've been toying with doing that myself and having someone go first would be great.

View on HN

If this encryption is still the same as it used to be a couple of years ago (encfs, IIRC), it's good they aren't. I stumbled on that multiple times before I learned not to turn this shit on. Every time on a new installation (which doesn't happen that often, so it's natural I was forgetting) I chose "do encrypt" option (because why not?), it was working perfectly fine long enough for me to settle in, and then one day I would be downloading some books via torrents, and torrent wouldn't proceed because of "filepath too long" (which was very confusing, because how could that be on Ext4, given it's perfectly fine for other peers, who must be on NTFS, most likely), and I had to spend time disabling encfs (I guess it wasn't that easy either: creating a new user was the quickest option) in order for things to start working.

So, finally I learned just not to use file-based encryption, except for minor stuff like dropbox directory.

That's a shame. Honestly though, full-disk is just so darn easy, and nearly as secure. I'll probably just stick with that for a good long while.

EDIT: Looks like LUKS is supported now, which is nice:

https://wiki.archlinux.org/index.php/Systemd-homed#LUKS_home...

Full disk encryption is more secure. If you can't trust your system files who knows whats happening when you enter your password.

Isn’t Secure Boot supposed to solve that issue?

How can Secure Boot help against, say, patched libc?

You need either full disk encryption, or something like dm-verity for that.

I misunderstood your post. Of course full disk encryption is vital for security. My point was that without secure boot you can't be sure that software asking for your password is legitimate. Typical setup consists of unencrypted boot partition with Linux kernel which asks for password. You can't be sure that this Linux kernel was not patched, but Secure Boot helps to ensure that.

Reply on news.ycombinator.com