Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Huh? I've been using LUKS for FDE (with unencrypted /boot) way before 2015, and it's never been a problem. Debian has offered an option to set it up during installation, and it was 100% smooth sailing from there.

More recently, you can even set up GRUB to ask you for the passphrase, so even /boot is encrypted, you only need a tiny 2MB partition at the front to hold the bootloader.



Well I remember getting completely stuck at one part and the cause was my samsung SSD's funny behavior in the "locked" state.

I had to set some kind of kernel flag or something (sorry, it's been years) to get it to ignore the drive until I unlocked it, as there was some kind of tight-loop where it would just keep trying to connect infinitely and not progress/fail/timeout.

I've been meaning to get back into linux again but it's going to be on a pristine/new machine.


You're definitely overcomplicating it. Security that's too hard to make use of isn't really accomplishing anything.


Well the work is in setting it up. Once it's working you just enter a password. I'm sure hardware FDE support in linux has come a long way since I last tried.


There shouldn't be that level of work required to set it up. The tools are lacking if it's not just a couple of commands or toggles to get a fully encrypted disk with a secure boot chain.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: