Hacker News Reader

I'm slightly confused. I understand the appeal to putting user configuration inside the home directory, and I definitely approve of encrypting each home directory individually, but doesn't doing both of them together mean that you can't read the user data until it's been decrypted?

View on HN

The encrypted volume has an encrypted copy of the `~/.identity` file in it's metadata fields.

The same key which encrypts the volume decrypts the metadata, but they use different IVs.

You could assume that most systems the key would be secured with the TPM so this won't be much of a big deal to the user, but otherwise when they try to login it would prompt for this password first.

> * I understand the appeal to putting user configuration inside the home directory* […]

I'm not sure I understand the appeal. What does "putting user configuration inside the home directory" mean in this context? Is there a file with the UID, GIDs (primary, secondaries), GECOS, etc?

What is put inside the homedir?

A lot of JSON in a big file.

* https://systemd.io/USER_RECORD/

You'll enjoy the bit about the umask. Yes, this is short on details of where all of the privileged and secret stuff lives.

You home dir including password is on a usb drive and so can move from machine to machine with all your files.

Reply on news.ycombinator.com