Skip to main content

An attempt at full-disk encryption: Vera Crypt


The project is to build a Linux Mint machine to have the identical functionality and ergonomics as the existing Windows 10 machine.

This stage relates to testing full-disk encryption using VeraCrypt.

Environment & required functionality

Full-disk encryption needs to run on the following machines:
  • The Linux Mint Xfce 18.3 laptop "Gandalf";
  • The Windows 10 laptop "Legolas".

The objective requirement is to protect user data from the physical theft of the physical machine, to provide an additional line of defence against data loss.

This is probably more important for Windows than for Linux Mint.  Even so, in both cases, the operating system is likely to log activity which can reveal personal data and user (meta)data.

Full-disk encryption does not mitigate against Microsoft’s sinister telemetry functionality, for which the main solutions seem to be:
  • Either to use tools whose developers are constantly on the prowl, hunting for the latest ways in which Microsoft seeks to breach users’ privacy;
  • Or to use Linux Mint instead of Microsoft Windows.

Alternatives

For Windows, there is no viable free alternative than VeraCrypt.  The next available alternative was to run BitLocker, for which Windows 10 would need an upgrade to Windows 10 Professional at a cost of GBP 110.

For Linux Mint, the users’ file space $HOME can be encrypted using encryptfs as part of Mint’s normal operation.  The only time this is possible in the graphical user interface appears to be when creating the user’s account, although there must be some way of changing the encryption status by command line.  In addition, Mint 17 had a process using LVM and cryptsetup, by which a single partition on a hard disk could be encrypted, resulting in the same outcome as using VeraCrypt for full-disk encryption.

A longer list of encryption tools for Linux appears on https://www.tecmint.com/file-and-disk-encryption-tools-for-linux/, of which VeraCrypt is one suggestion.

Software selection

For this experiment, VeraCrypt was the sole selection, because it works on both Windows and Linux.

Installation experience

On Legolas/Windows, VeraCrypt worked exactly as instructed by the HowToGeek.  Legolas is an HP machine, so Windows Updates always overwrites the bootloader to an incorrect "Windows knows best" script.  VeraCrypt’s developer published a utility VcFixBoot that restores the correct bootloader for VeraCrypt to work.  It is a bit freaky to see a laptop declare that it is going to repair Windows: this is what happens when Windows Updates uncorrects the bootloader, then tries to boot Windows from an encrypted partition that it cannot decrypt.

On Gandalf/Linux, VeraCrypt installed normally, but demands root privileges to mount the encrypted file as a partition.  This isn’t permissible for a non-admin user.  But it’s clearly possible, because google-drive-ocamlfuse permits a non-admin user to mount a virtual device.  So it looks like VeraCrypt’s design is flawed, such that its demands the best be the enemy of the good.  In reality, the local admin must have the exclusive right to install software, but must not have universal access rights to all data on the machine.  There is one workaround, which grants all non-admin users on the machine root privileges.  This is a bad workaround.

Conclusion

VeraCrypt failed to work on Gandalf/Linux.

VeraCrypt worked as described on Legolas/Windows.

End of post.

Comments

Post a Comment

Popular posts from this blog

Downgrading of the project: Calc has a fatal bug - it cannot reliably link workbooks

The project is to build a Linux Mint machine to have the identical functionality and ergonomics as the existing Windows 10 machine. This stage relates to on-going work to make LibreOffice Calc workable. Unfortunately, it turns out that LibreOffice isn't fit for purpose.  Specifically, it cannot reliably link workbooks, even in its own native workbooks. As a consequence, the project is now downgraded.  My time is now better spent doing other, more productive things, with a greater chance of success. Background On 29Jul2018, I complied a detailed test using fresh, sample data created specifically for the purpose, in Excel on Windows 10, then had a virtual machine running LibreCalc on Linux Mint to import it. The basic spreadsheet functionality of linked workbooks failed haphazardly. I logged the test results on 29Jul2018 on AskLibreOffice  and, to date, have yet to see any evidence of anybody taking ownership of recognising the issue and thus fixing it. The s...
Post a Comment
Read more

Deployment of Wine

The project is to build a Linux Mint machine to have the identical functionality and ergonomics as the existing Windows 10 machine. Having established that there is no way to migrate fully from Windows to Linux , the project now needs to consider running Windows apps in Linux.   This is a big change to the strategy of the project.   This is a big change to the deployment of a Linux workstation, a crushing admission of failure, and the opening of a whole new world of risks to an otherwise secure operating system. Environment & required functionality For this blog post, Wine was tested on: The Linux Mint Xfce 19 virtual machine " Bilbo ", on host Windows 10 laptop " Saruman " The Linux Mint Xfce 18.3 virtual machine " Gimli ", on host Windows 10 host " Legolas ". Alternatives There are alternatives to Wine/PlayOnLinux, notably the paid software Crossover. Software selection Wine and PlayOnLinux are present in L...
Post a Comment
Read more

The Big Bang: Microsoft Windows goes for good, positive adaptations required

On 27Mar2021, Linux Mint ate Microsoft Windows 10 on Legolas. Three months on, I conclude beyond any doubt that wiping out Windows was the best decision I ever made. The second best decision I ever made was to test Linux Mint in Virtual Box five years ago. The third best decision I ever made was to take ownership of the learning curve that migrating in Windows really entails. A quick reminder: what’s Microsoft Windows like nowadays? I still need to use Windows at work. I cannot easily describe how painful it now is to use Windows. So I’ll try to describe it difficultly. My work machine is a powerful beast, but it exhibits constant latency. For a keyboard-orientated power user, this means that some keystrokes go walkabouts when other services on the Windows machine go to nuclear war with each other, scrambling to feed their narcissistic self-importance for besieged system resources wholly at the user’s expense. Something on Windows tends to clear the keyboard buffer randomly, resulting ...
Post a Comment
Read more