What are the benefits of full disk encryption?

General Discussions
1

What are the benefits of full disk encryption compared to a solution where the a /boot partition with the kernel remains unencrypted?

As far as I understand, the benefit of having a full disk encryption is to prevent a malicious actor to inject bad code on the kernel (for example that code could reveal the encryption password making the encryption useless).

Otherwise, having a full disk encryption complicates the set-up as the boot loader should know how to open an encrypted partition and the initramfs should contain the key to work on the root partition.
In a full disk encryption environment there is also the need for a method that prevent arbitrary modifications on the boot loader, if not the additional security over unencrypted kernel is lost.

Some argues that similar benefits of FDE are in any case obtainable with a bootloader that check the hash of a kernel before let the control to it.

Do you think that -from a home set-up prospective (not in a high security scenario)- there are some points about FDE that I missed?
What is the most balanced configuration for a typical home laptop that balance simplicity and security (for the typical risk having your machine lost/stolen)?

2 Likes
2

That’s wrong. Full disk encryption starts early when system boots. Since then it works transparently for all users. That is, if a malicious actor penetrates working system, then nothing prevents malicious code injection or stealing of personal data.

Disk encryption can protect system and/or user data only in case of theft or unauthorized access to (powered off) computer.

4 Likes
3

And remember if you ever forget the password you are locked out too.

1 Like
4

Ah yes, that’s for sure. I mean that if you leave your computer (powered off) unattended a malicius actor could currupt your booting process. BTW, I don’t think this is a typical threat for a domestic pc.

1 Like