Full-Disk Encryption, Linux Mint 15

Plaa's instructions for full-disk encryption at http://community.linuxmint.com/tutorial/view/1166 work fine for Linux Mint 15. This is for a new installation, or a new Mint partition. Do it.

For convenience, I have reproduced his instructions here:

(1) Boot your system using the Linux Mint 15 live CD or USB stick.

 

(2) Open a terminal and enter the following commands:

$ sudo apt-get remove ubiquity

$ sudo apt-get update

$ sudo apt-get install ubiquity

$ sudo ubiquity

Early Impressions of LXDE

I'm using LXDE (Lightweight X11 Desktop Environment) on my laptop. First of all, it seems to be a resurrection of the long dead Unix philosophy: simple tools that do specific things well. Second of all, it makes no sense to use Mint on a laptop until Mint makes whole-disk encryption easier. It's a piece of cake in Lubuntu.

LXDE seems to be missing some very basic things, but it also does some very basic things right. In Mint, there are no themes (okay, maybe if I wanted to spend my life looking through themes designed for 12-year-olds) that provide significant contrast between the window with focus and the other windows. LXDE does this in an attractive fashion. It has panels, rather than the brain-damaged crap the Gnome project is trying to foist on people.

Why am I more willing to spend time adding functionality to LXDE than to figure out how to customize, say, Mate? Mate is a very heavy-weight environment. Overall Mate is well thought-out and well-implemented, and it is available for more secure environments than Mint, but it is yet another attempt to make Linux into a Windows clone.

With a new Mate installation, I have to spend hours uninstall useless crap, disabling useless background daemons, etc. LXDE saves this hassle--I have a machine I can halfway trust before pounding on it for a week.

LXDE is a better idea than Mate, and a much, much better idea than Gnome Shell. It's worth spending time on. Or so I think so far.

Ubuntu 10.10 Day 0

Yesterday I installed Ubuntu 10.10 on my laptop, and have a couple quick encryption-related comments.

I installed from the alternate install image. The standard image does not include encrypted LVM. It does, however, allow one to encrypt user home directories. Is this good enough? No.

(1) In Ubuntu, encrypting a user's home directory fails to protect users who lose their passwords. This could happen a number of ways. It happened to me once via shoulder surfing. Many people use the same password for multiple services--a bad idea. The user password and encryption pass phrase should be distinct.

(2) Users tend to use weak passwords. Hopefully they choose better pass phrases.

(3) With just the home directory encrypted, swap is in the clear. This is a well-known leak and part of why secure software generally overwrites passwords and keys in memory as soon as they are no longer needed. Garbage collection is not good enough for keys. In general any data could show up in swap, and so swap should be encrypted.