Monday, April 29, 2024
 Popular · Latest · Hot · Upcoming
19
rated 0 times [  19] [ 0]  / answers: 1 / hits: 5442  / 2 Years ago, wed, august 24, 2022, 1:36:56

I am planning on installing Ubuntu on my computer. I studied the installation instructions, and I discovered that one of the steps is to select whether the Ubuntu system will be encrypted. I understand that encryption enhances security. If a computer with no encryption is stolen, the thief could access the data simply by using a boot disk to circumvent the Linux login. However, I read that there also are some possible disadvantages to encryption, but what I read was not entirely clear to me. I was wondering if somebody could please clarify this issue.


An article about the pros and cons of encryption is at


https://www.makeuseof.com/tag/4-reasons-encrypt-linux-partitions/


As noted in this article, an obvious disadvantage is that the data on a computer become inaccessible if the user forgets his or her encryption key. I would choose an encryption key I would never forget. So, this should not be an issue for me. The article notes that another disadvantage is that encryption can slow a computer, but this is not much of an issue for today's machines.


The article also claims that in the event that something goes wrong with an operating system, encryption can make data retrieval more difficult. I found the explanation of this point to be confusing, and I was wondering whether somebody could please elaborate on this.


I understand that one can choose to encrypt an entire hard drive, only the home directory, or only certain parts of the home directory. I would be interested in encrypting either the entire hard drive or the home directory, and I was wondering how these two options compare in pros and cons.


I understand that encrypting the entire hard drive only is possible when installing Ubuntu, but that one can encrypt the home directory at any time. Is that correct?


Since all my data would be in the home directory, I do not see a need to encrypt the entire hard drive. Am I correct that there is no advantage in doing this, and encrypting the home directory is sufficient to protect data from a computer thief?


If I were to encrypt only the home directory, would data retrieval from a corrupted Ubuntu system be easier than if I encrypted the entire hard drive? Can data retrieval also be a problem if only the home directory is encrypted?


I suspect that a machine with only an encrypted home directory would run faster than a computer with an entirely encrypted hard drive. Is that correct?


The article notes that a recovery disk might be needed if something goes wrong with the Linux operating system, and that recovery will be impossible if the disk has been encrypted and the key has been forgotten. I do not see a reason to encrypt a recovery disk, since it would not contain personal data. Would recovery on a system with an encrypted hard drive or home directory still be difficult, even if the recovery disk has not been encrypted?


I understand that I should regularly back up my data. Still, I would like data retrieval to be as easy as possible. I also understand that encryption of a computer only protects privacy in the case that somebody physically steals the machine, and that additional security measures always are necessary.


Finally, if there are any potential issues which I missed, then I would appreciate somebody pointing these out to me.


Thank you for your help.


More From » encryption

 Answers
2

The benefit of encrypting a laptop is indeed that data are inaccessible when a laptop is stolen. For daily use, you will never notice the drive is encrypted. The added overhead required to encrypt and decrypt data for storage is on modern laptops not practically noticeable.


Whether to encrypt or not, how to configure your system, etc. is only of secondary importance. An operating system that breaks is easily downloaded again and reinstalled in less than an hour.


What is of primary importance is a good backup strategy for your personal data. Your personal data are unique and can never be downloaded again when lost. So make sure, first of all, that you have a few up-to-date spare copies of your personal data. Anytime. There is always a possibility something goes wrong with your computer, whether you encrypt or not, whether you use Linux, Windows, or MacOS.


With respect to encrypt or not, it is your decision. If you think it is very critical none ever gets hold of your data when the laptop is stolen or someone attempts to have access, then encrypt. Personally, I don't, but that is my sole decision. There is always a balance to be made: more security entails usually less convenience. In case of data encryption of the hard drive, the loss of convenience is, for daily use, almost nothing - you only have to provide a password on boot, which you do not need to do if there is no encryption.


Answers to specific questions



As noted in this article, an obvious disadvantage is that the data on a computer become inaccessible if the user forgets his or her encryption key. I would choose an encryption key I would never forget. So, this should not be an issue for me.



It is critical that indeed you do not forget: otherwise nobody ever can access the drive again.



The article notes that another disadvantage is that encryption can slow a computer, but this is not much of an issue for today's machines.



So it is.



The article also claims that in the event that something goes wrong with an operating system, encryption can make data retrieval more difficult. I found the explanation of this point to be confusing, and I was wondering whether somebody could please elaborate on this.



You have to make sure in the first place that data retrieval is never needed, because you have good backups of your data. So this is less of a critical point.


You probably can imagine for yourself that data that is encrypted is by design more difficult to access, so retrieve. Even with a file system gone, binary data that is not encrypted can still be recognized and carved from the disk into a useable file (using tools such as photorec. There is no chance for this, of course, if the data on disk are garbled by the encryption.



I understand that one can choose to encrypt an entire hard drive, only the home directory, or only certain parts of the home directory. I would be interested in encrypting either the entire hard drive or the home directory, and I was wondering how these two options compare in pros and cons.



Ubuntu used to support encryption of the home directory out of the box, but does not anymore. The most thorough, and actually also simple, form of encryption is encryption at a deeper level, at that of the actual file system.



I understand that encrypting the entire hard drive only is possible when installing Ubuntu, but that one can encrypt the home directory at any time. Is that correct?



Yes, you can for yourself install and enable per-directory encryption.



Since all my data would be in the home directory, I do not see a need to encrypt the entire hard drive. Am I correct that there is no advantage in doing this, and encrypting the home directory is sufficient to protect data from a computer thief?



For practical purposes, you may as well encrypt the entire drive if you want encryption. That option is integrated in the operating system, whereas other ways of encryption have to be manually set up. There is not much advantage indeed in encrypting system files, but then, there are no disadvantaged neither. Anyway, read some advise on this Stackexchange site on security.


If I were to encrypt only the home directory, would data retrieval from a corrupted Ubuntu system be easier than if I encrypted the entire hard drive? Can data retrieval also be a problem if only the home directory is encrypted?



I suspect that a machine with only an encrypted home directory would run faster than a computer with an entirely encrypted hard drive. Is that correct?



Not that you ever will notice.



The article notes that a recovery disk might be needed if something goes wrong with the Linux operating system, and that recovery will be impossible if the disk has been encrypted and the key has been forgotten. I do not see a reason to encrypt a recovery disk, since it would not contain personal data. Would recovery on a system with an encrypted hard drive or home directory still be difficult, even if the recovery disk has not been encrypted?



If a system breaks, there are different possible approaches to bring it back to life. There is one that will always work, and that likely is the most simple for the desktop user: reinstall from scratch and restore the data from your backup. Manipulations of a broken system at a recovery prompt or from a recovery disk will be somewhat complicated if the volume is encrypted, because indeed that volume needs to be decrypted. And of course, it will be impossible if the password is lost.



I understand that I should regularly back up my data.



Make that your uttermost first priority. All else is secondary. If your personal data are safe, you are safe even if you laptop drops in the swimming pool.



Still, I would like data retrieval to be as easy as possible.



If you made a backup, your already have the easiest data retrieval possible. Just copy the data back on the system.



I also understand that encryption of a computer only protects privacy in the case that somebody physically steals the machine, and that additional security measures always are necessary.



Yes, you need to take care of your stuff.



Finally, if there are any potential issues which I missed, then I would appreciate somebody pointing these out to me.



None, if I convinced you that, as a desktop user, you are all set with good, up-to-date and current spare copy.


[#480] Wednesday, August 24, 2022, 2 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
oreera

Total Points: 472
Total Questions: 121
Total Answers: 116

Location: Mayotte
Member since Thu, Dec 17, 2020
3 Years ago
;