Hacker News new | ask | show | jobs
by polotics 26 days ago
Well yes and I don't see how this can be avoided.
2 comments

Do you mean with with current software? How to avoid it in general is straightforward.

If you're the only one with the disk password then the simple answer is make both passwords the same and make the different parts of the system communicate better.

If you want multiple users, give them each a different boot password and encrypt a separate copy of the disk key with each one. That password can be their login password too, or it can encrypt their login.

I have always been thinking LUKS was supposed to be enrolled in TPM, so you should not have to enter this key manually; this is just to prevent someone from unplugging the hard drive and reading on another machine. Of course, this depends on one's threat model.