• deadcade@lemmy.deadca.de
    link
    fedilink
    arrow-up
    4
    ·
    13 hours ago

    There is a way, but no point in doing so. As such no OSes offer such an option out of the box. For file encryption to be of any use, you need there to be some kind of authentication before being able to access those files (like a password).

    The easiest method would be to encrypt the entire drive, as modern Linux and Windows both support using the TPM for automatic unlocking. With that, set up standard user autologin and you’ve made the drive encryption useless.

    • Natanael@infosec.pub
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      5 hours ago

      What TPM does for automatic unlock when combined with secure boot is to record certain steps of the OS boot and check various file hashes, if they’re unchanged then it releases the decryption key. This doesn’t authenticate the user but it verifies disk integrity (making sure your OS boots normally without injected malware), so your login prompt security can’t easily be bypassed*

      * this does not prevent hardware based attacks like malicious RAM sticks or DMA attacks if the firmware isn’t patched

      Then you could also set up separate home folder encryption and tie unlock to entering your password at login, or for various types of automated logins you could use the TPM again, like through checking for presence of some device you carry (like a smartwatch, etc), or even use a physical security key with one touch login (preventing remote attacks)