[Request for input] Encrypt all the things

fredldotme

I want to start a discussion about encrypting more data stored in the /userdata partition, for extra security/paranoia.

Right now we have /home/phablet encrypted when done so via system-settings, but there's room for improvement. I would like to also encrypt:

Wifi settings
Apps
Potentially more which I don't see yet

For apps I have created a script which does the encryption in an easy-to-follow manner. This will require a device with policy version 2 support. It's available here: https://gist.github.com/fredldotme/696ab1e22bec4ed296caee471aa89a87

ATTENTION: Don't try to force the script to run on a system which only supports v1 policies, this will break app installation and uninstallation.

The script keeps the unencrypted original in /userdata/system-data/opt/click.ubuntu.com-bak which you will have to remove manually after rebooting.

Encrypting data which is usually accessed by non-phablet users will require v2 policy suppport, so keep that in mind when coming up with ideas.

Any input?

ikoz

@fredldotme Encrypting WiFi settings (/etc/NetworkManager/system-connections) is a must-have, as they contain passwords. But what is the reason to encrypt apps' installation? The executables and assets are public anyway, I don't know any app that stores sensitive data in /opt.

fredldotme

@ikoz Encrypting apps would prevent tampering with executables and replacing them with malicious ones by evil actors.

uxes

@fredldotme
what about bluez data and system logs?
/etc/shadow so an attacker can't substitute their password?

gpatel-fr

@uxes

encrypting logs would mean that no software could run before having entered a decryption key.
Using a phone to call for help would be impossible for a person not having the code. Could be awkward at times. Or even legally dubious.

fredldotme

@uxes IIRC with fscrypt in place, just replacing shadow breaks the protectors of fscrypt, leaving the system with a broken state. Also that's the dog biting it's tail: decrypting based on the password while the file containing the password is locked, that doesn't work.

Regarding bluez data: that would break bluetooth at the greeter, which might be required for some usecases.