Mint: a great OS, but ...

[just_herbert]

I recently switched over from vista to linux on most of my machines. After having tested most mainstream linux distros with mixed results, I discovered Mint and sure gave it a try (Mint 6 Felicia x64 that is). Suffice to say that I really liked the improved interface and the nifty tools that are included as well as all the codecs, it all worked really well and I would be glad to continue to use it as I consider it the most user friendly linux distribution, BUT there is one major flaw that really concerns me and is in my opinion a knock-out argument for Mint: There is no filesystem or full-disk encryption! I searched the internet and looked for solutions but didn't find any way to fully encrypt my machine under Mint. (There probably is a way involving 50 or more cryptic lines in a terminal, but currently I am no good at working with that and I am neither going to jump through hoops nor relying on some improvised solution). As I am a security conscious person, I have used encryption on all my devices for years and especially on my notebook I'd never do without. So I had to switch back to Ubuntu 8.10, at least the alternative installer CD for Ubuntu includes encrypted LVM, and works more or less well on my laptop.

So as a feature request for, well the next version of Mint I guess, I suggest ENCRYPTION, just one radiobox during the partitioner stating "Use whole disk and set up encrytped LVM" would be enough, nothing complex, just like the Ubuntu alternative installer (without the command line interface that is). Do this and you will have build the ideal operating system. And I'll gladly continue to use it.

-herbert

[Decemberdoom]

You could use TrueCrypt, encryption software rarely comes pre-installed since the average person doesn't need it. It's a fully graphical program as well.

Get it by opening up a terminal and typing

sudo apt-get install truecrypt

Or just go to the package manager and install it from there if you really don't want to use the Command Line.

[Fred]

Decemberdoom has a good suggestion. I have used TrueCrypt before and have been happy with it. In Linux you can't currently encrypt the system partition however. This isn't a big problem with Linux as it would be in Windows. Data is scattered all over the Windows partition. In Linux you should have no data in the OS proper anyway, so it is easy to encrypt the data partition or partitions and still be safe. There is nothing in the OS itself worth protecting. OSs are a dime-a-dozen.

Fred

[just_herbert]

Due to my windows background I know about TrueCrypt, I have used it for years and it works perfectly, well except - as you have already stated - I cant encrypt my OS under linux with TC, and I'd really like to be on the save side and encrypt it as well, since it is possilbe that temporary files, tool settings, saved passwords and stuff like that are stored in an OS. The TrueCrypt guys do a wonderful job with their prog., but I dont know when TC will finally support OS encryption under linux, so I use the OS' tools for that and Mint just doesnt have one, which is unfortunate. Although the "average user" doesnt use encryption he/she would certainly not be confused by just one more radiobutton during the partitioner and all the "advanced users" and "paranoid peoble" would certainly appreciate the feature (and hopefully use it as well).

[Fred]

just_herbert,

Actually, I can't think of any user specific files that are stored outside of the user's /home. Having said that, I admit it would be nice to have the ability to hide an operating system in an encrypted volume and show a honey pot system, so-to-speak.

Fred

[just_herbert]

I am not necessarily talking about completely hiding the OS and putting fake OS in place for the sake of plausible deniablility, like it's possible with TC. Just having the system behind a layer of encryption like the encrypted LVM would be fine. The boot loader can tell the user that behind the encryption is Mint OS, that would be fine anyway (like the Ubuntu alternative install with encr. LVM). Just having everything inside the encrypted partition is the issue.

[element]

i did a fedora install about a week ago and was able to choose encryption and ext4 at the partioning stage. i would also like to see that in mint.

[Zipdot]

Yes, and as the original poster has stated (maybe some of you are unaware of this), this is a simple checkbox more or less in a default Ubuntu text-mode installation. I'm surprised it's not available in Mint.

[llobach]

I have switched from Linux Mint to openSUSE then to Fedora because of the lack of an encryption option during installation. I believe Linux should lead the way with user security and this should extend to offering encryption at installation - especially as now more than half of PCs sold in the UK are laptops or netbooks. No other security option can beat encryption at safeguarding your data once that PC is lost. So come on Mint, give me a reason to come home!

[DrHu]

There is no filesystem or full-disk encryption! I searched the internet and looked for solutions but didn't find any way to fully encrypt my machine under Mint. (There probably is a way involving...

If you need plausible deniability, then you have to go the route of encrypting the whole space needed by the OS
http://wiki.archlinux.org/index.php/LUKS_Encrypted_Root
https://www.privacy-cd.org/en/features- ... encryption
http://en.wikipedia.org/wiki/Comparison ... n_software

For the usual case, where you want to keep only your data safe (encrypted) full hard drive encryption is not necessary, and you would only need to be concerned with encryption of

/home (where most of your data will be)
/tmp
swap location, you can check that via cat /etc/fstab , in the Terminal
--if it is even being used by the normal operations on your system)

Other options you have is to mount tmp (tmpfs) onto a RAMdisk, which is deleted whenever the system is rebooted..

Problems..
Your hard drive must show the same activity levels for the encrypted drive vs the open (unencrypted) drive
--or you can't deny it is there..
Performance issues..
http://bbs.archlinux.org/viewtopic.php?id=65372
--post # 3 ., post # 25 (why it wouldn't help).., one reason it is not worth it in the normal case..

[frijsdijk]

For me the topic says it all. I haven't found an OS that matches Mint, but I'm missing the full disk encryption. It's a pitty since it's in the alternate installer of Ubuntu. Perhaps a howto how to 'convert' an Ubuntu install to a Mint install?

I know about truecrypt and all, but I still want the full disk encryption. Please Mint!

[markfiend]

http://xkcd.com/538/

[remoulder]

still want the full disk encryption

How to here http://forums.linuxmint.com/viewtopic.php?f=42&t=18743

[BrianD]

http://xkcd.com/538/

hahaha!! this is my second-favorite xkcd strip, right after "/Everybody Stand Back/ I know regular expressions"

[DrHu]

http://xkcd.com/538/

Markfiend is correct.

If anyone has data that is valuable to someone else, they can get to it more directly by simply "asking with menaces"

• We have all your bank and credit cards, give us your pin numbers, and you are coming with us to the ATM
  No
• Are you sure
  NO
• OK, lets go
  Oh, OK then, I will...

Admittedly most notebook thefts are crimes of opportunity, so whether or not the data is valuable is usually irrelevant to the thief

They simply sell it off as fast as they can, either the whole machine or pull the hard drive and replace it (with the hard drives they have already stolen and dump the notebook's original hard drive
--so no evidence, not even the low-jack feature that some people use for theft tracking

The new user "receiver of stolen goods" simply deletes the hard drive, reformats and replaces the OS or can do the same, and simply replace the hard drive, as they are fairly cheap, and they may be able to get a better product such as 7200rpm vs 5400rpm hard drive.

Unless the thief is curious, then whether or not the hard drive is encrypted really matter not one whit to them.

Whether it is the whole drive or just part of it..

[frijsdijk]

I don't get the point of these reasons not to encrypt a harddrive.

- Social Engineering? there might never be an opportunity (I could forget it somewhere, it could be a drive-by, or part of a larger robbery)
- Thief dumps HDD? Perhaps. If there IS valueable data on the HDD, would you want to take the risc? Thing big! Think professional. It might not be your own data, but data that you are responsible for.

It's a no brainer. Anyone else thinks otherwise is being ignorant.

[tinca]

I don't get the point of these reasons not to encrypt a harddrive.

- Social Engineering? there might never be an opportunity (I could forget it somewhere, it could be a drive-by, or part of a larger robbery)
- Thief dumps HDD? Perhaps. If there IS valueable data on the HDD, would you want to take the risc? Thing big! Think professional. It might not be your own data, but data that you are responsible for.

It's a no brainer. Anyone else thinks otherwise is being ignorant.

Hi there,

from your post I must ask the question "where on earth do you live", when you can talk about drive-by or larger robbery??
Your last line "Anyone else thinks otherwise is being ignorant" sounds as if anybody who thinks differently to you is ignorant, not just has a different opinion. The statement sounds not ignorant but arrogant.

Best regards Keith

[frijsdijk]

I don't get the point of these reasons not to encrypt a hard drive.

- Social Engineering? there might never be an opportunity (I could forget it somewhere, it could be a drive-by, or part of a larger robbery)
- Thief dumps HDD? Perhaps. If there IS valueable data on the HDD, would you want to take the risk? Thing big! Think professional. It might not be your own data, but data that you are responsible for.

It's a no brainer. Anyone else thinks otherwise is being ignorant.

from your post I must ask the question "where on earth do you live", when you can talk about drive-by or larger robbery??
Your last line "Anyone else thinks otherwise is being ignorant" sounds as if anybody who thinks differently to you is ignorant, not just has a different opinion. The statement sounds not ignorant but arrogant.

Hi Keith,

Don't mean to be arrogant. Don't take me on the literal words, English is not my native language. The point is full disk encryption, and reasons why it should not be ignored as a feature to have in Mint.

Specially Mint is installed on loads of laptops. In home environments (those probably do not care), but in professional environments (my case) too. My laptop might contain data that should never ever come into some random guy's hands.

It could be my holiday snaps, but it could be a database dump containing sensitive data. It could be anything. I don't want to have to care.

The robbery is just an example of ways to loose your laptop, a situation where it isn't likely the guy robbing you is going to ask you for your pass phrase (the example of BrianD).

Is this more clear perhaps?

[tinca]

frijsdijk ,

sorry for jumping on you.

Best regards Keith

[Pierre]

Hmmmm,
you guys sure must live in some dangerous place

I can't think of any reason to encrypt my /data partition

even when it has my finances / photos / assignments stored on it.