Hi! I want to try out fedora workstation in the near future (once 39 is out) and was wondering if systemd-homed is ready for everyday use yet.
I’m a bit paranoid and really need my private data encrypted. However, I don’t think that full disk encryption is practical for my daily use. Therefore I was really looking forward to the encryption possibilities of systemd-homed.
However, after reading up on it, I was a bit discouraged. AFAIK, there’s no option to setup systemd-homed at installation (of fedora). I was an Arch then Manjaro, then Endeavour user for years but don’t have the time/patience anymore to configure major parrts of my system anymore. Also, the documentation doesn’t seem too noob-friendly to me, which also plays into the time/patience argument.
Is it ready? Can anyone seriously recommend it for a lazy ex-Arch user who doesn’t want to break another linux installation?
Thank you in advance. :)
Pardon my ignorance here, but I don’t get it how is the whole thing still safe with unlocking from TPM instead of me providing the password at boot time?
Considering now anyone can just boot the machine into the installed system then bruteforce/exploit something to get login/get read permissions and make a plain copy of the data?
Where, without tpm, as long as I do not type in the encryption password myself I have a pretty high guarantee that the data is safe, especially when I am not at the (powered down) computer.
The idea behind it is that the files are stored encrypted at rest, which is really what you want, because once a system is booted, you have to play by the computer’s rules (respect file permissions, policies, etc.).
The TPM provides a secure mechanism to provide a decryption key to the computer during boot, eliminating the need for direct interaction.
Could it be compromised? Probably, but it would take considerably more effort than a man-in-the-middle on your keyboard via a logic analyzer.
This is a common misunderstanding insofar as how encryption works. You can’t flick a bit and TURN your storage unencrypted nor can you plausibly make your computer obey restrictions.
If your storage is encrypted it remains encrypted always including the file you have open right now. Your takes a plausibly length usable string and uses it to compute or retrieve the long binary number actually needed to decrypt your files. This number is stored in memory such that encrypted files can be decrypted when read into memory.
Once that key is loaded in memory anyone with 10 minutes and access to google could trivially unlock your computer in several different ways. It is virtually exactly like having no security whatsoever.
If you don’t actually enter a passphrase to unlock you have no meaningful security against anything but the most casual unmotivated snooping.
Your little sister might not be motivated enough to read your diary but the dipstick that stole your laptop will definitely be spending your money.
Once that key is loaded in memory anyone with 10 minutes and access to google could trivially unlock your computer in several different ways. It is virtually exactly like having no security whatsoever.
I highly doubt it.
If you have any tips for how I can personally bypass my computer’s encryption in 10 minutes without being able to login, I’d love to try my hand at it.
