Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TPM-backed Full Disk Encryption is coming to Ubuntu

ubuntu.com

Post reply on HN
Print view View original

31–40 of 71 posts

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#31

Post by tredre3 »

FirmwareBurner wrote: post #24
criddell wrote: post #10

Earlier quoted context omitted.

Windows can wake itself from hibernate. Killing all of the wake timers and editing specific keys in the registry will usually fix this, but it's messy and not something typical users are comfortable doing.

>Windows can wake itself from hibernate. You're confusing that with sleep. Windows can't wake itself from hibernate as the machine is fully powered off, not in some sleep state.

No, he's right. Windows can wake the computer from total shut down even (S5). It uses RTC alarms: https://en.wikipedia.org/wiki/Real-time_clock_alarm

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#32

Post by stonogo »

FirmwareBurner wrote: post #9
criddell wrote: post #8

Earlier quoted context omitted.

Windows these days prefers what they call modern standby and you probably don't want it. I have a ThinkPad and this is what it's like: Close the lid and stuff laptop into my backpack. I travel to work and when I pull my machine out of my bag, it has 12% battery left, is super hot, and the fan is screaming like the machine is trying to fly away. All because Microsoft thinks PCs should be more like iPhones.

>Windows these days prefers what they call modern standby and you probably don't want it. Who cares what Windows prefers, when I'm the user and I prefer Hibernate which works out of the box and I use it precisely because it avoids the issues you mentioned. Why don't you use Hibernate? SSDs are fast enough that a wake from hibernate is not much slower than a wake from sleep. On Ubuntu I don't even have this option bec…

On Ubuntu you do have this option, you just have to set it up yourself. They don't prioritize support for it because "people who want to hibernate a laptop" is a rounding error in their customer population statistics.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#33

Post by Aerroon »

FirmwareBurner wrote: post #9
criddell wrote: post #8

Earlier quoted context omitted.

Windows these days prefers what they call modern standby and you probably don't want it. I have a ThinkPad and this is what it's like: Close the lid and stuff laptop into my backpack. I travel to work and when I pull my machine out of my bag, it has 12% battery left, is super hot, and the fan is screaming like the machine is trying to fly away. All because Microsoft thinks PCs should be more like iPhones.

>Windows these days prefers what they call modern standby and you probably don't want it. Who cares what Windows prefers, when I'm the user and I prefer Hibernate which works out of the box and I use it precisely because it avoids the issues you mentioned. Why don't you use Hibernate? SSDs are fast enough that a wake from hibernate is not much slower than a wake from sleep. On Ubuntu I don't even have this option bec…

After hibernate Windows thinks I have a laptop keyboard. If num lock is turned on then yuihjkbnm keys turn into a numpad. A restart or replugging the keyboard fixes it. Still annoying though.

Windows also likes waking itself up for various reasons, but I don't remember if that was hibernate or sleep. Turning off everything except the power button wake up fixed it though.

But I do agree - I would like a working hibernate in any OS I use. The next best thing is never turning it off though.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#34

Post by FirmwareBurner »

vladvasiliu wrote: post #23
FirmwareBurner wrote: post #13

Earlier quoted context omitted.

What do you mean? Hibernate works out of the box. There nothing to "fix" in the registry for that to work.

There are supposedly fixes for it to stay hibernating. The issue isn't that it doesn't go to sleep. It's that it doesn't stay asleep.

In hibernate the laptop stays powered off and nothing is running, you can even pull the power cord. It can't wake up from that. It will only wake up when you power it back on, not by itself. The wake up issues are for sleep mode, not hibernate where the CPU is completely off and unpowered.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#35

Post by palata »

distract8901 wrote: post #14
michaelt wrote: post #5

> the bootloader (shim and GRUB) and kernel assets will be delivered as snap packages (via gadget and kernel snaps), as opposed to being delivered as Debian packages. And there it is. I suppose having your kernel command line signed by Canonical and unmodifiable by the system owner without a pain-in-the-ass manual 'machine owner key enrolment' process is very much on-brand for Snap.

Well shit, we were just joking the other day on mastodon about the kernel being distributed as a snap. I guess this is it, then. I'm tired of computers being awful :(

Just don't use Ubuntu, there are plenty of fish in the sea :-)

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#36

Post by mr337 »

michaelt wrote: post #5

> the bootloader (shim and GRUB) and kernel assets will be delivered as snap packages (via gadget and kernel snaps), as opposed to being delivered as Debian packages. And there it is. I suppose having your kernel command line signed by Canonical and unmodifiable by the system owner without a pain-in-the-ass manual 'machine owner key enrolment' process is very much on-brand for Snap.

Hard pass. I'm slowly been dumping Ubuntu due to the force snaps down your throat strategy they have. Still irritated I have to jump through hoops to get Firefox without a snap.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#37

Post by alexeldeib »

jandrese wrote: post #6
wiktor-k wrote: post #3

Earlier quoted context omitted.

> but those have a downside of the TPM needing to be updated with every new kernel. This depends on the configuration. If you don't bind the key to PCRs at key creation time kernel updates don't affect the workflow and you still will take advantage of other TPM features such as locking the key after several unsuccessful attempts. Take a look at the systemd configuration: https://www.freedesktop.org/software/systemd/m…

IMHO the PCRs are way too much trouble and defend against attacks that are rare outside of extremely spooky circles. They were the biggest problem with Bitlocker too.

Yeah, I recently went down this path. It’s all doable but frankly I’m not a nation state target and getting locked out after a kernel update or similar would be far more annoying.

Instead I’m leaning toward separate boot and root disks, with a root/data disk encrypted with LUKS with a detached header. dm verity on a read only root with a separate data partition also seems simple/appealing. Of course, these all allow attacks full secure boot/tpm/etc avoid, but it’s a balance.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#38

Post by Xiol32 »

cgb223 wrote: post #30
nine_k wrote: post #12

Earlier quoted context omitted.

Looks perfectly aligned with corporate and especially government IT practices. There the user is by far not the owner.

So if Ubuntu is pivoting hard into big corporate/govt Who’s the new big community desktop distro?

Perhaps not exactly 'community distro', but Fedora is genuinely a joy to use.

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#39

Post by nine_k »

cgb223 wrote: post #30
nine_k wrote: post #12

Earlier quoted context omitted.

Looks perfectly aligned with corporate and especially government IT practices. There the user is by far not the owner.

So if Ubuntu is pivoting hard into big corporate/govt Who’s the new big community desktop distro?

No idea! Debian proper? Fedora? Nix? Arch?..

(I personally run a relatively niche distro, https://voidlinux.org/)

Re: TPM-backed Full Disk Encryption is coming to Ubuntu

#40

Post by FirmwareBurner »

tredre3 wrote: post #27
FirmwareBurner wrote: post #13

Earlier quoted context omitted.

What do you mean? Hibernate works out of the box. There nothing to "fix" in the registry for that to work.

He means Windows can set a timer to wake up after a while to run scheduled tasks. You might not have noticed those wake timers because they are few and it usually works as expected with windows hibernating back after a few minutes. The difficulty of disabling wake timers has been exaggerated, though. It's in the advanced power settings, there's no need for the big scary registry. https://www.tenforums.com/tutorials/6…

>He means Windows can set a timer to wake up after a while to run scheduled tasks.

Yes, it can se timer to wake automatically from hibernate, but that doesn't mean it does that automatically withotu you setting those timers. I can understand there have been some bugs in the past but that's anon-issue today.

Post reply on HN