Torvalds Warns the World: Don't Use the Linux 5.12-rc1 Kernel

[λ the β-Redex Reducer]

You're lucky enough to never had decryption issues at boot time. You're lucky. But your good luck doesnt mean everyone will be that lucky. Have a google search. It's not as if it wasn't usual.

Actually, I am not lucky. I once had issues with decryption at boot time. After an upgrade I could not decrypt my hard disk anymore. But:
1. NixOS has rollback.
2. I make unencrypted back-ups which I store at a safe location at all times.
So in that case I just rolled back and quickly solved the issue and then upgraded again. The Pyra has no roll-back feature, but back-ups alone are good enough too. It just means that restoring the system will take longer and that I will have to wait until I am home. That is acceptable to me.

So lets make thing clean. Say you're encrypting the whole system (excluding /boot or not), then if you cant decrypt it at boot, your only option will be to reflash to be able to use your pyra. But then all your sensible data that goes with it are lost too. If you dont encrypt the whole system, but only your user data, if for some reason decryption doesnt happen, you still have a valid system to debug your issue. Your data aren't lost (just yet) and you have some tools at hand to analyze/fix your issue.
If losing your sensible data is not an issue, then why willing to encrypt it in the 1rst place ?

So imagine that my Pyra has decryption issues and cannot decrypt anymore. What happens? I wait until I am home and then re-install everything and restore from back-up. Problem solved. Much preferable over me losing my Pyra and someone else finding it and then viewing my data. The risks of encryption are very low if one keeps proper back-ups, which one ought to anyway.

BTW, what are "lambda users"?

 

[Bosbeetle]

2. I make unencrypted back-ups which I store at a safe location at all times.

But those are vulnerable and defeat the whole idea basically want to encrypt your whole system but leave a unecrypted version "lying around"

 

[pyrat]

But those are vulnerable and defeat the whole idea basically want to encrypt your whole system but leave a unecrypted version "lying around"

But there's no one true solution because there's no one true problem. You may trust the people you live with or not. You may want to protect your mobile device data anywhere or only on the way. There're most often situations where one solution is reasonable that wouldn't be in another.
Btw. I think I've heard new uboot can handle LUKS2 ? There might not be need of unciphered /boot . The Pyra uses u-boot doesn't it ? Is it very upstream, a little patched, or needs a very specific old version or ... ?

 

[λ the β-Redex Reducer]

But those are vulnerable and defeat the whole idea basically want to encrypt your whole system but leave a unecrypted version "lying around"

They are always hidden at home behind locked doors. That makes them much harder to lose than the Pyra which I plan on taking with me. Encrypting only the devices that I am most likely to lose definitely makes sense.

I will explain how so. Suppose that I have x chance to lose my Pyra each year, y chance to have someone break into my house and find my disks each year, x > y by a significant margin, and y is very close to 0. If I would not encrypt anything then I would have y + (x * (1-y)) chance of having my data accessed by others each year. But if I would encrypt only my Pyra then I would have y chance of having my data accessed by others each year. Considering that x is significantly larger than y and that 1-y will be very close to 1, it is clear that just encrypting my Pyra is much safer than encrypting nothing at all.

So that is why encrypting a mobile device that you take everywhere with you increases safety even if you have unencrypted back-ups locked away in a safe place somewhere.

 

[netcat]

full disclosure: i have had several situations where all the blood drained from my face because i realised some of my data might have been accessible by the wrong people. i'm talking about messaging app & email data. one particular situation was very messy with lots of money involved, legal action and confiscated hardware. not fun. i should have enabled encryption.