Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TPM-backed Full Disk Encryption is coming to Ubuntu

ubuntu.com

Post reply on HN
Print view View original

21–30 of 71 posts

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#21

Post by vladvasiliu »

criddell wrote: post #10
FirmwareBurner wrote: post #9

Earlier quoted context omitted.

>Windows these days prefers what they call modern standby and you probably don't want it. Who cares what Windows prefers, when I'm the user and I prefer Hibernate which works out of the box and I use it precisely because it avoids the issues you mentioned. Why don't you use Hibernate? SSDs are fast enough that a wake from hibernate is not much slower than a wake from sleep. On Ubuntu I don't even have this option bec…

Windows can wake itself from hibernate. Killing all of the wake timers and editing specific keys in the registry will usually fix this, but it's messy and not something typical users are comfortable doing.

This. During lockdowns, I dusted off an old PC and set it up with windows for gaming. The computer was in front of my bed. One out of two nights, the thing would randomly wake out of hibernation, blasting the freaking blue bitlocker screen at me (password unlock, since that PC didn't have a tpm).

This PC was kept reasonably up to date, too (usually installed whatever update at the most a day or two after they came out, complete with the reboot), so not sure what it was hoping to do, exactly.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#22

Post by FirmwareBurner »

distract8901 wrote: post #18
FirmwareBurner wrote: post #9

Earlier quoted context omitted.

>Windows these days prefers what they call modern standby and you probably don't want it. Who cares what Windows prefers, when I'm the user and I prefer Hibernate which works out of the box and I use it precisely because it avoids the issues you mentioned. Why don't you use Hibernate? SSDs are fast enough that a wake from hibernate is not much slower than a wake from sleep. On Ubuntu I don't even have this option bec…

That very much depends on your definition of "works". Does the machine go through the steps to save memory to disk and enter a low power state? Yes. But then windows can and does decide to wake itself up at any time, resulting in physical damage to the machine if it's stored in a closed bag. Discharging the battery and heating up the entire machine dramatically reduces your battery's lifetime. You cannot disable this…

>So yes, it 'works', with the caveat that the machine may wake itself at any time, burn through the entire battery and possibly do irreprable damage to your machine.

You haven't read my comment fully or are confusing hibernate with sleep. I was talking about hibernate which 100% works, not sleep. Hibernate can't wake up your laptop as your machine is completely powered off.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#23

Post by vladvasiliu »

FirmwareBurner wrote: post #13
criddell wrote: post #10

Earlier quoted context omitted.

Windows can wake itself from hibernate. Killing all of the wake timers and editing specific keys in the registry will usually fix this, but it's messy and not something typical users are comfortable doing.

What do you mean? Hibernate works out of the box. There nothing to "fix" in the registry for that to work.

There are supposedly fixes for it to stay hibernating.

The issue isn't that it doesn't go to sleep. It's that it doesn't stay asleep.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#24

Post by FirmwareBurner »

criddell wrote: post #10
FirmwareBurner wrote: post #9

Earlier quoted context omitted.

>Windows these days prefers what they call modern standby and you probably don't want it. Who cares what Windows prefers, when I'm the user and I prefer Hibernate which works out of the box and I use it precisely because it avoids the issues you mentioned. Why don't you use Hibernate? SSDs are fast enough that a wake from hibernate is not much slower than a wake from sleep. On Ubuntu I don't even have this option bec…

Windows can wake itself from hibernate. Killing all of the wake timers and editing specific keys in the registry will usually fix this, but it's messy and not something typical users are comfortable doing.

>Windows can wake itself from hibernate.

You're confusing that with sleep. Windows can't wake itself from hibernate as the machine is fully powered off, not in some sleep state.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#25

Post by heavyset_go »

michaelt wrote: post #5

> the bootloader (shim and GRUB) and kernel assets will be delivered as snap packages (via gadget and kernel snaps), as opposed to being delivered as Debian packages. And there it is. I suppose having your kernel command line signed by Canonical and unmodifiable by the system owner without a pain-in-the-ass manual 'machine owner key enrolment' process is very much on-brand for Snap.

That's disappointing, but not surprising.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#26

Post by forty »

FirmwareBurner wrote: post #15
botanical wrote: post #11

Earlier quoted context omitted.

I have hibernate after following this: https://ubuntuhandbook.org/index.php/2021/08/enable-hibernat... But I don't have full disk encryption so I don't know how it works with it.

I tried that and it didn't work on my work ThinkPad (also those steps are dangerous it could brick your system if you so much as make a single mistake). But that doesn't answer my question of why something as basic as Hibernate (copy RAM contents to HDD on power-OFF, then reverse on power-ON) isn't something that works out of the box on Linux distros, and instead requires 2h of tutorial reading and dangerous low-lvel…

The Linux kernel disable hibernation when secure boot is enabled for security reasons (it enables the lockdown mode). I don't think it's especially an Ubuntu/distro problem. When secure boot is disabled, I think hibernation is supposed to work fine.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#27

Post by tredre3 »

FirmwareBurner wrote: post #13
criddell wrote: post #10

Earlier quoted context omitted.

Windows can wake itself from hibernate. Killing all of the wake timers and editing specific keys in the registry will usually fix this, but it's messy and not something typical users are comfortable doing.

What do you mean? Hibernate works out of the box. There nothing to "fix" in the registry for that to work.

He means Windows can set a timer to wake up after a while to run scheduled tasks. You might not have noticed those wake timers because they are few and it usually works as expected with windows hibernating back after a few minutes.

The difficulty of disabling wake timers has been exaggerated, though. It's in the advanced power settings, there's no need for the big scary registry.

https://www.tenforums.com/tutorials/63070-enable-disable-wak...

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#28

Post by vladvasiliu »

FirmwareBurner wrote: post #15
botanical wrote: post #11

Earlier quoted context omitted.

I have hibernate after following this: https://ubuntuhandbook.org/index.php/2021/08/enable-hibernat... But I don't have full disk encryption so I don't know how it works with it.

I tried that and it didn't work on my work ThinkPad (also those steps are dangerous it could brick your system if you so much as make a single mistake). But that doesn't answer my question of why something as basic as Hibernate (copy RAM contents to HDD on power-OFF, then reverse on power-ON) isn't something that works out of the box on Linux distros, and instead requires 2h of tutorial reading and dangerous low-lvel…

It worked out of the box on my Arch install. I'm running a LUKS volume which holds an LVM with the ext4 fs for the system and the swap.

I'm also running TPM + PIN / FIDO2 unlocking.

Didn't need to fiddle with anything. The most part of this install was going through the manual process of creating filesystems and whatnot.

Bonus points compared to Windows for actually staying asleep instead of randomly waking up while in my bag.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#29

Post by vladvasiliu »

forty wrote: post #26
FirmwareBurner wrote: post #15

Earlier quoted context omitted.

I tried that and it didn't work on my work ThinkPad (also those steps are dangerous it could brick your system if you so much as make a single mistake). But that doesn't answer my question of why something as basic as Hibernate (copy RAM contents to HDD on power-OFF, then reverse on power-ON) isn't something that works out of the box on Linux distros, and instead requires 2h of tutorial reading and dangerous low-lvel…

The Linux kernel disable hibernation when secure boot is enabled for security reasons (it enables the lockdown mode). I don't think it's especially an Ubuntu/distro problem. When secure boot is disabled, I think hibernation is supposed to work fine.

It works fine with secure boot enabled on my arch install.

But I do use a unified image which the UEFI boots directly (EFISTUB, no grub or anything). I don't know if that makes a difference.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#30

Post by cgb223 »

nine_k wrote: post #12
michaelt wrote: post #5

> the bootloader (shim and GRUB) and kernel assets will be delivered as snap packages (via gadget and kernel snaps), as opposed to being delivered as Debian packages. And there it is. I suppose having your kernel command line signed by Canonical and unmodifiable by the system owner without a pain-in-the-ass manual 'machine owner key enrolment' process is very much on-brand for Snap.

Looks perfectly aligned with corporate and especially government IT practices. There the user is by far not the owner.

So if Ubuntu is pivoting hard into big corporate/govt

Who’s the new big community desktop distro?

Post reply on HN