Re:“I would like to maintain the floppy driver”
by lukeschlather on Friday August 02, 2019 @02:45PM
(#20595504)
I tried getting the Dell XPS 13 Ubuntu edition for work but couldn't enable full-disk encryption due to NVME not being supported at the time. The only thing to do was homedir encryption, which I believe are mounted as loop, at least in the standard Ubuntu config. So there are still circumstances today in which it's the only way to get encryption. (Incidentally, I gave up on that laptop because an ecryptfs mounted homedir broke inotify integration with a vagrant guest VM.)
[ Parent
| on HN ]
Re:“I would like to maintain the floppy driver”
by blattimwind on Friday August 02, 2019 @03:02PM
(#20595636)
ecryptfs doesn't use loop, rather it acts like a (windows term) file system filter, encrypting every file separately and storing it as a separate file in the underlying FS.
Re:“I would like to maintain the floppy driver”
by tptacek on Friday August 02, 2019 @05:17PM
(#20596725)
Ironically, at least as a design (I'm unfamiliar with the implementation), this is probably more secure.
Re:“I would like to maintain the floppy driver”
by unilynx on Friday August 02, 2019 @05:53PM
(#20596943)
Probably not... any form of partial encryption (ie not the full block device) needs to make sure no sensitive data leaks outside the encrypted parts (/tmp and swap? /var if you only encrypt /home?)
Depending on the implementation the filesystem metadata may also reveal more data than needed. The attacker can probably ignore that 4GB file that wasn't modified for a year (a downloaded ISO image?) but that 20KB file that was recently modified might be that passwords.txt he was looking for..
Re:“I would like to maintain the floppy driver”
by tptacek on Friday August 02, 2019 @06:38PM
(#20597238)
It depends on what your biggest concern is. Large scale metadata analysis is a concern that block-level encryption does a better job of than "file filter encryption" does. Authenticated encryption, which prevents people from bitflipping your init scripts into bindshells if you lose access to your laptop for a few minutes, is something that file encryption addresses and block encryption basically doesn't.
The important thing is that you don't really have to choose; a true encrypted filesystem can give you both things. Block-level encryption can't.
Re:“I would like to maintain the floppy driver”
by blattimwind on Friday August 02, 2019 @05:33PM
(#20596840)
Proper AEAD becomes a lot simpler, on the other hand a lot of structural information is just plain there.