How many on here use encrypted drives? and why or why not

[suplero]

Hi,

I've recently tried to move to Kubuntu 16.04, and find there are issues with the encryption process.

1) the installer does not encrypt at all besides when using the whole disk setup. This option only provides the preset partition types and sizes, with no control other than just the passphrase. Secondly, when I have tried to mount an encrypted drive this way to merge data, it always fails, meaning that there is no way to recover any data if the main partitioning fails. I'm not a fan of this approach.

2) the manual method - notably for Kubuntu - does not actually work, and crashes the installer. The step where the passphrase is entered has been borked since 12.10 at least, and it doesn't seem like there is any desire to fix it [five years?]

3) if encryption is used in 16.04 - and possibly later - every *buntu flavor, installing proprietary Nvidia drivers causes boot crashes at the passphrase prompt.

I'm wondering how many people here have encountered problems trying to encrypt partitions when installing Kubuntu, as the installer seems to never allow this, and what the general sentiment is for encryption using Kubuntu, especially at install.

I like to use encrypted partitions just for the security and added protection. I also like having a separate /home partition for copying data from drive to drive as I upgrade along the way.

I've looked for info on how to do an encrypted install with partitions in *buntu, and either my hardware is just the wrong setup [tried on multiple machines - hp and dell] or the installer has issues. I finally managed to get an encrypted / partition without the whole drive by installing Ubuntu one one partition [creating 2 crypto partitions causes the installer to crash in at least Ubuntu and Xubuntu as I've tried both installers] and then going back and creating an encrypted partition by hand for /home. That works but is not ideal.

The last good version where several encrypted partitions could be created was 12.04 alternative. I don't know what happened after that, but it seems encryption just hasn't been a priority.

Thanks for listening and for any discussion

[SpecialEd]

No experience with Kubuntu but I encrypted my Home partition, the last time I installed Neon, without a hitch. I also use VeraCrypt to make a couple encrypted virtual disks but I do that via files, not partitions.

[oshunluvr]

I do not and I can't see why I would. Of course, I'm using Linux primarily on my server and desktop PC, but even my laptop isn't encrypted. There's little on it of much consequence and the likelihood of anyone targeting me is extremely slight. I'm probably more likely to die from a snake bite or lightening strike than suffer from stolen data on my laptop, but I don't walk around in high boots all the time or with a lightening rod. I try to apply some logic and common sense before taking steps that will complicate my life. Things are complicated enough without adding unnecessary layers of faux security just so I feel better about a potential event that will almost certainly never occur.

My wife's laptop is encrypted because she uses Windows and uses it in the medical field.

I did meet once with a head of the security department of the agency I work for and he told me the biggest threat they worry about was botnets and rootkit attacks. When I told him I strickly used Linux on my computers he told me that made me 99% safer than most.

[Rod J]

I've never bothered with encryption.

Seems to me it's just complicating things for no good reason, really, unless you have business needs that requires that level of security. I also think it has to slow the PC down somewhat as there must be some overhead required and I don't want anything like that slowing my computer down (I'm a power user). It's one of the reasons I dislike Windows so much, just the thought of having my hard drive constantly being churned by anti-virus/anti-malware scans, etc, etc. I believe in K.I.S.S.

[Snowhog]

Set up your drive (partitioning) as you want. Install Kubuntu normally. Verify all is working. Then, if you desire, encrypt afterwards.

[suplero]

This is a very good discussion and I was hoping that it would be.

In the past when having to deal with protecting security, it always makes it easier to just do everything, and then not worrying as much. I know everyone has their own uses for security. For example, having to log in to secure websites that store cookies - banks, email, etc - I feel better knowing that the cookies are encrypted so even that extra layer makes it just a little more at ease.

I do understand the overhead, but i don't have tons of stuff going on most of the time, and my computer doesn't get taxed too hard. I don't think i've noticed that much of a slowdown tho, even when transferring home directories from drive to drive - but the drives are both internal SATA, so I might not notice anyway.

Snowhog, that sounds very interesting. I haven't seen any tutorials on that, and I think that when encrypting, the data is destroyed when creating a normal LUKS encryption partition.

Are there any resources that you have used to move the file system? I think the fstab needs to know the encrypted drive mapping afterwards, which would require modifying before/after to be able to boot? I'll also do a search and post back any findings.

thanks

[GreyGeek]

If I had files which were so private and important I needed to use encryption I would move them to an encrypted USB stick and leave my laptop alone so I can use it in comfort. I keep DD-WRT's firewall active on my wifi router, and I have ufw guarding the laptop. I also have rkhunter and clamv on cron.

Mentioning DD-WRT reminded me of the FCC rule which requires router makers to prevent users from accessing the transmit power of wifi's. The mfgs are taking the lazy way out and blocking any attempts to overwrite their firmware with DD-WRT or any other, even though the FCC says that is not what the intent of their ruling is. TP-Link lost a lawsuit against them when they blocked firmware update, but it hasn't wound its way through all possible court proceedings yet.

I changed to DD-WRT when, about a month after I purchased my Linksys E2500 I got a popup notice from Cisco stating that if I wanted to continue with a security update to the E2500 firmware I would have to create a Cisco cloud account!
I declined and checked around. The skuttlebutt was that the NSA had a back door in the update and Cisco decided to make lemonade out of the lemon the NSA tossed them. I went to the DD-WRT site and download and installed their firmware for the E2500. It's HTML pages gave me FULL access to everything the Cisco HTML pages wouldn't, one thing being able to change the transmit power. It was set at 125mw. I dialed it down to 70 mw because I only needed to reach 50'. My E2500 will last longer because I could do that. Now, the mfgs can set the power to something higher and reduce the life of their wifi's, forcing new customer business.