Fedora Workstation Aiming To Improve Encryption, Possibly Encrypted Disk By Default In The Future

[Anux]

So does this FDE avoid having to type the password twice? I tried Fedora and OpenSUSE with FDE in a VM and both of them required me to enter the password twice - in Grub and then again in SDDM.

Careful those are two different passwords, one beeing your user password (SDDM) the other your LUKS passwort (used for encryption). You can enable auto login for most display managers, I do it too (with lightdm).

[Sonadow]

I'm 100% against encryption being enabled by default.

Why? Forgetting your encryption password or simply dying unexpectedly (which unfortunately happens to people) results in losing all the data. Far too many people never bother making backups, and in a perfect world you must have at least two copies of the data in physically separate locations.

Those who understand the risks could have enabled encryption for years if not decades.

Like my former employer who mandated that all Windows laptops have Bitlocker enabled...then proceeds to blame ME for not being able to recover any data from a bunch of SSDs after a number of laptops died and the staff forgot their Bitlocker password.

Encryption is a bloody curse.

[user1]

Benefits? Your peers cannot see your data, your porn habits, etc - that is of course if they cannot sniff out your password which is all too easy if you live with someone.

All the x86 CPUs released in the past decade support HW AES encryption/decryption, so the performance impact is minimal.

Thanks. So yeah, pretty much like I thought - pretty useless for me as a desktop PC user and no one has access to my PC beyond me anyway.

What I also don't like about it is that it seems prone to complications for various reasons like the example in the comment above. So I hope Fedora will have a simple switch to disable encryption in the partition setup before installation (not having it buried somewhere in Anaconda's advanced partition setup which is horrendous).

[makitso]

I'd like to see Ubuntu enable encryption by default too. Whether we like it or not, it's kind of the "default" Linux that most people start with, and more security by default will benefit a huge amount of people and the ecosystem as a whole.

The problem is dual-boot systems. I can only encrypt /home and swap.

[skeevy420]

They definitely shouls though i do wonder by how much theyre still the default these days. There arent that many places stil singing their praises like in the old days, or at least not to the same degree. Im not tied into the newbie scenes these days so im not sure whats bouncing around the schools but a lot of the discussions i had with friends who were new to linux over the last 5 years tended to be more the more system tinkery/gamer sort that tried a variant of Arch

As a long-time Arch user using CachyOS, an Arch variant with v3 and some optimizations, IMHO, those people you describe using Arch are using it due to the Pros of Pacman, Makepkg, the AUR, and the Arch Linux tools more than they're using Arch because it's Arch. I say that because practically anybody not straight up stupid and technologically illiterate can figure out how to install Arch and, from there, install and use the things that folks like Michael report on 4-14 months earlier than practically any other distribution.

When you use Not Arch and read the news, Linux tends to suck due to how restricted or limited you can feel/become when using either older or more locked down distributions. You read about all these neat things but you have to wait for the next release of Not Arch to use it. If you're using Arch it's a lot easier to try those things out, especially when combined with snapshots in case stuff happens.

To put that into some perspective: I'd really consider using a distribution like Cent if they switched to Pacman and included the Arch Linux tooling. Stable base with powerful and easy-to-use from-source tools. Yes Please. Rolling release isn't always a desired environment while "stable with the option to pull in some bleeding edge" can be a more preferred environment. Also, the 90s and Dependency Hell are on Line 2.

[ll1025]

I guess. But they better make it easy to mount in liveboot and recover. Linux distros have a hard time mounting ntfs drives and network locations still in 2023. Currently it's working on my pc, but I know fedora failed last I used it.

I've never run into issues mounting NTFS unless it was a dirty drive, in which case I'm pretty sure you can force mount. That certainly has nothing to do with liveboot / recovery.

[ll1025]

I'm 100% against encryption being enabled by default.

Why? Forgetting your encryption password or simply dying unexpectedly (which unfortunately happens to people) results in losing all the data. Far too many people never bother making backups, and in a perfect world you must have at least two copies of the data in physically separate locations.

If you don't make backups, losing your data is a when-- not an 'if'. Encryption's contribution to that problem is insignificant.

[Anux]

The problem is dual-boot systems. I can only encrypt /home and swap.

What does dual boot have to do with it? As long as you don't use TPM to store your keys and therefore have an encrypted EFI partition nothing needs to be considered for dualboot. Just encrypt your / partition and you're ready to go.

If you don't make backups, losing your data is a when-- not an 'if'. Encryption's contribution to that problem is insignificant.

While your statement is true it also is totally disjointed from reality.

[ll1025]

Like my former employer who mandated that all Windows laptops have Bitlocker enabled...then proceeds to blame ME for not being able to recover any data from a bunch of SSDs after a number of laptops died and the staff forgot their Bitlocker password.

Encryption is a bloody curse.

It's incredible to me the number of technically literate luddites that frequent these forums.

Encryption needs to be done right. "Done right" includes using a password you can remember, and if you can't remember it using a shorter password. If you're managing a fleet, then you should probably do the research to learn how to manage bitlocker deployments. Tip: you can escrow the keys in your directory for trivial recovery. Don't blame microsoft, bitlocker, or encryption in general for your own ignorance.

But when done right it actually allows the security guarantees made by your OS to work.

1. No more DBAN; disk decommissioning just involves blowing away the volume key on your drive
2. No concerns about offline OS tampering
3. No trivial bypasses to the user login screen
4. a right against self-incrimination that actually means something

Not using bitlocker on your laptops would be reckless, in 2023, given the huge number of border / evil maid attacks, as well as issues with lost / stolen laptops. PIN + TPM + bitlocker recovery is the way, and its good to see fedora starting to catch up.

@skeevy420 -- The big benefit in your case would be disposal. You don't have to deal with DBAN, you can just nuke the volume header and know your data is safe.

Encryption does not have to be painful. You can enroll your TPM as an unlock source so that the disk auto-decrypts, if it has not been tampered with.

[ll1025]

What does dual boot have to do with it? As long as you don't use TPM to store your keys and therefore have an encrypted EFI partition nothing needs to be considered for dualboot. Just encrypt your / partition and you're ready to go.


While your statement is true it also is totally disjointed from reality.

My statement comes from years of directly dealing with home user IT and a myriad of encrypted disk scenarios ranging from SMBs to "we're going to [repressive, dissident hostile country]". The complaints of forgetting passwords are completely overblown for multiple reasons:

• Anyone managing a fleet should have some method of storing recovery info. Microsoft Account recovery, or a keepass file, or AD-integrated bitlocker recovery....
• Anyone using their encrypted laptop with any regularity will be entering whatever their unlock key is almost daily and so will generally not forget it
• Anyone managing either of these scenarios will, as a consequence of managing things, have an easy location for backing data up (Onedrive, Google drive, dropbox....)
• Home users who have none of those advantages can simply use TPM which is very reliable.
• Any "on by default" encryption system can mitigate the risk of failure by using the user's login password as an alternate for unlock

Are there ways for it to fail? Sure. But there are a hundred other, far more likely ways to lose data. Given that bitlocker has been "on by default" for years now it's a little absurd to pretend that this isn't a solved problem.