this post was submitted on 25 Dec 2023
94 points (98.0% liked)
Linux
48338 readers
385 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
In theory, the TPM can be used to verify that the bootloader, kernel and injtamfs haven't been tampered with, which is very very useful as FDE (in the running machine) is only good if that remains true.
I've heard that before, but there are two main problems that stick out to me:
I'm not saying that it's all just a scam or anything like that, but it really feels like I'm missing something important and obvious.
If the device is stolen, your disk is still encrypted at all time. If you believe your OS's login system is reasonably secure, then the attacker should have no way to access your data: they cannot access the data from software because it is blocked by login screen, they cannot access the data from hardware because it is protected by FDE.
One of the misconceptions I had before is that I assumed that the disk will be decrypted when you enter the LUKS password. This is not true, the password is loaded into the ram, and only decrypts necessary parts to RAM. All the data on the disk is never decrypted, even when you are working in your OS.
The system may still be vulnerable to over the network exploits. So for example, if the system is running
sshd, and a couple of months from now a root exploit is found (à la heartbleed), the attacker may get inside.It's somewhat of a long shot, but it's still a much larger attack surface than butting your head against a LUKS encrypted drive that's at rest.
RAM is not protected by FDE. There are (obviously non-trivial) ways to dump the RAM of a running system (Cold Boot attacks, and other forensic tools exist). So if the attacker is dedicated enough, there are ways.
Hah! That would be impractical :) Imagine having to decrypt your entire 32TB drive array everytime you booted your computer.