Hi! I want to try out fedora workstation in the near future (once 39 is out) and was wondering if systemd-homed is ready for everyday use yet.
I’m a bit paranoid and really need my private data encrypted. However, I don’t think that full disk encryption is practical for my daily use. Therefore I was really looking forward to the encryption possibilities of systemd-homed.
However, after reading up on it, I was a bit discouraged. AFAIK, there’s no option to setup systemd-homed at installation (of fedora). I was an Arch then Manjaro, then Endeavour user for years but don’t have the time/patience anymore to configure major parrts of my system anymore. Also, the documentation doesn’t seem too noob-friendly to me, which also plays into the time/patience argument.
Is it ready? Can anyone seriously recommend it for a lazy ex-Arch user who doesn’t want to break another linux installation?
Thank you in advance. :)
Short interception here: I actually appreciate the question. I think I didn’t thoroughly explain what bugged me with FDE. And the X Y problem is something I’d like to be aware of.
The implied problems with FDE might actually not fit my situation or threat model, why I think it was important to elaborate.
Edit: Just thought of it in this way: In this context, I’d rather be asked than have things inferred about me.
Wth kid. I stick up for you against someone assuming you don’t know anything, and then you stick your hand up and say you actually don’t? Fine, you deserve one another.
For the record, if you can afford the performance hit and are on SSD, I recommend either LUKS FDE or filesystem based encryption (ZFS, for example) + Home directory encryption. Don’t forget to encrypt the swap, too. That way if you ever have to share the FDE passphrase with someone you share a computer with, your data in your home directory is still safe, and it can encrypt the filenames, too. If you’re on spinning disk, you can still go that hard, but it’ll be noticeably slower.
FDE is fine for most work computers. Home directory encryption is for shared computers, or to stack on FDE if you’re sufficiently paranoid.
