From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id E7430138010 for ; Tue, 4 Sep 2012 19:20:06 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 618E7E0527; Tue, 4 Sep 2012 19:19:28 +0000 (UTC) Received: from mx1.hadt.biz (sil.hadt.biz [5.9.16.100]) by pigeon.gentoo.org (Postfix) with ESMTP id C3CE8E00B5 for ; Tue, 4 Sep 2012 18:48:23 +0000 (UTC) Received: from [192.168.255.100] (p5B340F16.dip.t-dialin.net [91.52.15.22]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.hadt.biz (Postfix) with ESMTPSA id C44A140037 for ; Tue, 4 Sep 2012 20:48:21 +0200 (CEST) Message-ID: <50464CF5.6050309@hadt.biz> Date: Tue, 04 Sep 2012 20:48:21 +0200 From: Michael Hampicke User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20120903 Thunderbird/15.0 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 To: gentoo-user@lists.gentoo.org Subject: Re: Aw: Re: [gentoo-user] dm-crypt + ext4 = where will the journal go? References: , <504518A3.7000207@binarywings.net>, , <50463C4C.6040602@fu-berlin.de> In-Reply-To: <50463C4C.6040602@fu-berlin.de> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Archives-Salt: e8ab25fb-f091-41f8-9445-238e468e7bd1 X-Archives-Hash: da2c597c51a4e6d64ffd9d1bd6713c87 > In theory grub2 is able to open a luks-encrypted volume though it > seems to have some disadvantages: you'll need to enter the passphrase > (or pass the keyfile) two times, because grub itself needs to decrypt > the volume to get the later stages from the encrypted volume and > afterwards the decryption in the bootprocess itself takes place. > > I can't give any real advice about it though, because I use an > unencrypted boot partition. Depending on your needs it could be an > increase of security, because you can stop an attacker from injecting > malicious code into your kernel (or replace it completely). I don't think so, I still can replace your bootloader and grab your password. If you really think you might need something like this, I suggest you put your kernel and bootloader on a USB stick and boot your machine from that. When not in use keep the stick on your person. That still does not protect you from physically tempering with your device. Anyway, what about one those fancy tin foil hats to protect oneself against the governments mind control rays :)