FDE is the norm for desktop/laptop users, we're well beyond that in the GNU/Linux world.

The exception these days is leveraging secure boot and the tpm to ensure the kernel and initrd being booted and asking for your dmcrypt password can be trusted. That's our next challenge to make the standard.

Maybe it's just my experience but I haven't seen FDE be the norm within any of the companies I've worked for, and I've been in startup all the way to fortune 15...

I had an encryption requirement at both Oracle (for Windows) and Canonical (for Linux). For Windows they used some endpoint protection suite; for Canonical the functionality is built-in to the Ubuntu installer.

Also since I own a Mac as my primary laptop, I've just always used filevault there and it helps me sleep a lot at night. Means I am not concerned if it gets stolen, my derpy photos won't be in someone elses hand. I don't care so much about the hardware.

For Ubuntu, are you referring to LUKS or /home/user encryption?

If you want protection from someone booting up your computer in single/rescue mode to read/modify files you'd have to encrypt the entire disk (using LUKS, for example).

Doesn't matter, both of them are offered by the OS installer and are easy to set up.

FYI: only full disk encryption is available now in 18.04:

"The installer no longer offers the encrypted home option using ecryptfs-utils. It is recommended to use full-disk encryption instead for this release." https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes#Other_base...

Are you even talking about GNU/Linux? Most of the comments in this thread have been about MacOS and Windows, and I made no claim regarding those.

FDE with LUKS/dmcrypt has been an out-of-box installer-supported mode in all the major distros for a long time now.

> FDE is the norm for desktop/laptop users, we're well beyond that in the GNU/Linux world.

Huh? The norm? For what sorts of users?

I mean, that's best practice, sure. But hardly the norm. Even, I bet, among HN users.

It's on by default for macOS and Windows users:

https://www.theguardian.com/technology/2014/oct/17/apple-def...

https://www.howtogeek.com/173592/windows-8.1-will-start-encr...

It's certainly not "on by default" for all Windows users, twice in the last month I've broken into machines for clients where users forgot their password, both times using nothing more than a USB stick (then replacing utilman.exe with cmd.exe)

Both boxes had fairly recent hardware and were running Windows 10 Pro.

So maybe those two users opted out of FDE, or had company requirements that told them to.

They didn't opt out of FDE and there are no company policies/requirements either.

I have three laptops on my desk right now, one HP Probook and two different Lenovo Ideapads. All three are running Windows 10 Enterprise (2x LTSB 2016, 1x 1803).

NONE of them have FDE enabled or have ever asked asked me about it.

Given the bold claim "[FDE is] on by default for (...) Windows users" - without mention of caveats re: login account types, domain memberships, or hardware requirements - it seems the counterexamples just keep coming.

It's only on by default in windows if your computer has a TPM, is instantGo compatible, and has a microsoft.com account. I don't think this combination is very prevalent.

It's the norm for GNU/Linux users who run it on the bare metal of their laptops, in my experience. I haven't seen a laptop boot a linux distro without a LUKS passphrase prompt in years.

I can't say the same for Windows and Mac users.

Last two employers recommended FDE but made no strict requirements because apparently it was non-trivial for non-Linux users.

It's a no-brainer feature for any sufficiently fast portable device. If the installer supports it why would you disable it? I haven't had to worry about the data on my laptops should they be stolen for what must be over a decade now, GNU/Linux has supported it that long.

OK, I'm impressed. But I think that we've been talking past each other. When you say it's the norm, you mean among your peers, right? Technical people. Start up, enterprise, etc.

Me, I've been talking about PC users, generally. Not just Linux, and not just technical people. Sadly enough, I doubt that FDE is very common, let alone the norm.

And even worse, for many it'd likely be a curse. Inexperienced people don't do well at keeping track of complex passphrases, keys and so on. I've seen that over the years in forums where people plead for help to access TrueCrypt volumes. After losing passphrases, accidentally formatting, and so on.

The context of this thread was Linux and being able to circumvent the boot process via something like init=/bin/sh in the boot parameters. Someone pointed out that strategy doesn't really work with FDE, which was challenged as being uncommon.

I am only speaking to the prevalence of FDE among Linux users; it's not uncommon.

You're correct in that these are technical people. Most people running a GNU/Linux distro on bare-metal in their possession are at least somewhat technical, wouldn't you agree?

I can't speak for others, but I always enable it on any installation I preform on my devices. Ubuntu is nice in that it makes it very trivial to enable during the installation process.