Re: [gentoo-user] Encrypted drive setup at login and locking on logout.

[Rich Freeman <rich0@gentoo.org>]

On Mon, Jul 6, 2020 at 5:05 AM William Kenworthy <billk@iinet.net.au> wrote:
>
>  It also makes the point that any adminstrator will have access to the sticks data - not just the user (same as root under Linux).

This is just a fundamental issue about how computers work.  If you
attach your storage media to a computer, then potentially anybody who
had either physical access or administrative access to that computer
before you can read the storage media.  If it is encrypted and you
enter the decryption key into the computer, then that includes the
encrypted data too.

There are of course operating systems that try to make this sort of
thing harder, but there are many ways to bypass this sort of thing at
either the hardware or software level.  If you are plugging your USB
drive into a computer you don't control, you really have no way to
know what hardware or software it is using.  It could contain hardware
keyloggers, the OS might be tampered with, if the device is supposed
to prevent OS tampering you don't know if the hardware was swapped out
with hardware that doesn't prevent tampering, and so on.  This is why
things like hardware password/key managers often implement a
minimalistic serial/keyboard interface - to prevent the host they are
plugged into from actually being able to directly access their secure
storage.

I realize that you already said that this is your own hardware - I
just wanted to point out this fundamental limitation.  This is one of
the reasons that when I select laptops/tablets I tend to select ones
that are very light/portable - the more likely I am to have it with me
the less likely I am to need to access my private data from systems I
don't control.

-- 
Rich