System76 Eyeing Disk Encryption By Default

[franglais125]

So now the governments know which Linux users are true criminals

What is this in reference to?

[franglais125]

Last time I checked (which admittedly was a really long time ago), disk encryption had a very significant impact on OS performance, which is why I never got around to adopting it. But it's really been a while since I saw benchmarks for it. Do you think that's worthy of an article, Michael?

Full disk encryption has a non-negligible impact, but I think it is absolutely worth it. Michael frequently posts articles featuring this, a simple google search will give you several. Here is one from 2017: https://www.phoronix.com/scan.php?pa...-encrypt&num=1

Note that I said "non-negligible", which doesn't necessarily mean "large", it depends on what you are doing. Impact on gaming is close to 0 for instance.

[mmstick]

i think this shouldnt be the default, but having an option is nice

The default OEM install will not be encrypted (it would be pointless, for obvious reasons -- encryption has to be set up when it is in the user's hands, not the OEMs). There will be an option to choose to reinstall the system with FDE though. That will boot into the recovery partition to start the re-installation process. Otherwise, if the user chooses not to have encryption, they will simply go on to system/user setup.

[mmstick]

I'd prefer native filesystem encryption, something close to the mac filevault, ios encryption and the new android encryption. Something that allows for multiple keys (for multi-user devices) and that can delete the keys from ram when locked. Full disk encryption as used today is so limited in these regards.

Ext4 encryption is also being pondered, but creating an encrypted LVM partition is generally going to be easier to support than handling filesystem-specific encryption options, and whether or not they support it.

[mmstick]

This should have been made default long ago, if you ask me.

This isn't exactly relevant, but what is up with the price of their systems? The hardware is far from inspiring for what you can get for the same price in the windows world, and linux is free, so there's no OS cost, and yet their mediocre Galago Pro base system costs $959! I just picked up a Lenovo 710 15.6" for $650 with nice hardware (core i5, 256GB SSD, 8GB RAM, IPS convertible display) and slapped my preferred distro on it in less than 15 minutes. So who buys these mediocre, overpriced linux laptops? I can think of way better ways of supporting linux.

You don't seem to understand how markets work. System76 is a small company that is just starting out in this area (check out the About Us page). They aren't a massive OEM like Lenovo or Dell, both of which are manufacturing their own laptops in high volumes to bring costs down. System76 has, however, just recently purchased their own 22.4K sq. foot manufacturing facility in Denver, so they will be selling their own laptops soon. The current models are Clevo units with Intel ME disabled, and preloaded with Pop!_OS / Ubuntu 16.04.

So if you want Linux to succeed on the desktop, then you should invest into System76, even if the hardware is slightly more expensive than you get from a Windows OEM. That money will directly go into hiring more software & hardware engineers to work exclusively on the Linux desktop, and Linux-based desktop hardware solutions. Canonical is not manufacturing Linux-based laptops, and neither is Red Hat. They are more concerned with the Linux server & IoT spaces. The 'Year of the Linux Desktop' will only happen once a company like System76 steps up to start selling hardware to the masses in the same manner that Chromebooks, HP, Dell, Lenovo, etc. systems are being marketed and sold on TV and in stores.

PS: I'm one of their latest hires. We're writing the installer backend in Rust, while the Elementary team is working on the UI frontend which interfaces with distinst. Encryption is a thing that we are working on, as well as replacing GRUB with systemd-boot. There are a lot of issues that Canonical has not addressed, and we are going to pick up the slack to cater to the Linux desktop. Canonical's apparently only interested in server and IoT.

[elvis]

I'd prefer native filesystem encryption, something close to the mac filevault, ios encryption and the new android encryption. Something that allows for multiple keys (for multi-user devices) and that can delete the keys from ram when locked. Full disk encryption as used today is so limited in these regards.

LUKS (the current FDE solution for most distros) supports up to 8 different passwords (called "key slots") to unlock the encrypted volume.

[caligula]

So now the governments know which Linux users are true criminals

[molecule-eye]

This should have been made default long ago, if you ask me.

This isn't exactly relevant, but what is up with the price of their systems? The hardware is far from inspiring for what you can get for the same price in the windows world, and linux is free, so there's no OS cost, and yet their mediocre Galago Pro base system costs $959! I just picked up a Lenovo 710 15.6" for $650 with nice hardware (core i5, 256GB SSD, 8GB RAM, IPS convertible display) and slapped my preferred distro on it in less than 15 minutes. So who buys these mediocre, overpriced linux laptops? I can think of way better ways of supporting linux.

[starshipeleven]

Well, at least on my Lenovo laptop, full disk encryption is supported on hardware level, I don't need any of that OS level nonsense and also there is no performance penalty for enabling encryption.

For those wondering: that's a feature of the hard drive itself (Full Disk Encryption), which is also supported by the PC's firmware. Afaik most PCs support self-encrypting drives, even back in the BIOS era.

The main drawback of this system is that it's relying on closed source to stay secure (both the drive firmware and the UEFI firmware), and also don't crap out at random corrupting my drive, which I quite frankly don't trust that much to begin with.

So yeah, as long as you are just keeping your data safe from thieves or low-level enemies that's ok. If you are actually trying to keep safe very important data from competitors or government agencies, it's a nope for me.

[tinko]

Well, at least on my Lenovo laptop, full disk encryption is supported on hardware level, I don't need any of that OS level nonsense and also there is no performance penalty for enabling encryption.

Basically when you power on the laptop, the first thing you see is a password prompt, and without entering the password there is no way to even find out what operating systems I have installed.

https://support.lenovo.com/en/solutions/migr-69621

Isn't that a proprietary implementation? Why would you trust that?