Linux disk encryption

>"It's one line in /etc/fstab to have swap automatically encrypted, with a fresh keey randomly generated at each boot. Simple (provided you don't also want to have suspend-to-disk)."

I suppose you could use a separate swap partition for storing hibernation images, unencrypted and not used for actual swapping by the system (as in not defined in fstab). The "hibernation partition" could then be securely wiped manually or via an automated script just after the system gets up and running. To be certain, it would take some additional messing around with conf files (directing the hibernation to use that specific partition, telling the bootloader to use that partition to load suspended images, preparing a script to clean the traces after booting up) but people worried enough about their privacy to learn how to use dm_crypt would probably have no trouble with that.

>"As for whole disk encryption, I'd recommend just encrypting swap, /home and /var - there really isn't anything worth hiding in /usr/bin (for an Open Source OS !)."

Agreed, encrypting the entire disk is not only useless but could also add some painful overhead to the system. I'd like to add a few more points:

- you forgot about /tmp. Quite a few apps leave traces in there. The good news is that in almost all cases /tmp's contents from previous sessions can be completely discarded and thus allowing the use of random one-time encryption keys similar to the swap approach and completely transparent to the user (no need for typing long passphrases during boot-time).

- /home and /var while a treasure trove for private information are integral parts of the system and thus you have to bother to type in passphrases while the machine is still booting up - adding a certain discomfort. There is no easy way out of this (perhaps reading the key from a USB pen? - but then you'd have to keep a hammer always handy to _try_ to obliterate it in a moment's notice) and choosing to encrypt a different partition for important documents while "micro-managing" access to a gazillion application-related files in your $HOME is perhaps even worse of a pain, let alone the higher probability of skipping something significant.