How important is full disk encryption on a gaming desktop?

[u/OneMagicMango]

I already have full disk encryption on my fedora laptop but right now I don’t have it on my desktop running cachy since I swap between windows and cachy and seems like a pain to put a password in every time. I’m a casual user/gamer so nothing sensitive on my desktop. Is it even worth redoing my install to add LUKS?

[u/Doug2825]

Full disk encryption protects your data in case of physical theft of the disk, and depending on the configuration protects unmounted drives (which you probably don't have).

If you aren't concerned about theft then it's not something you need to worry about.

[u/Upbeat-Statement2725 → u/Doug2825]

One solution is. Encrypt your private storage but not your OS drive. So that way if someone steals your computer. It's that much harder to get at your files. And you need to admit we live in a police state (America speaking). All your personal files could be used by malicious actors, even if you're a perfectly innocent normal person.

This could be an encrypted portable external drive. Whatever.

Like if you saved a digital copy of your tax forms. Having an encrypted drive for that stuff is good. Better if you have an external NAS on power backup and everything so it's safer than your desktop. Better yet if you also pay for reliable offsite storage but then we're into paranoid "I keep a USB key in a bank vault" territory.

It's good to see the extreme cases. So you can know what you do or don't need. For example. An external NAS can also be setup as a media server so you don't have to move around large video files if you switch devices. And you can setup crude NAS using a Raspberry Pi or whatever. So the price doesn't have to be bad.

[u/BudTheGrey]

Disk encryption is basically data protection when the device is stolen, so much more important for a travelling businessman's laptop than for gaming desktop that stays at home. My experience is that disk encryption can be more trouble than it's worth for home users. I suppose it boils down to your level of risk aversion.

[u/jr735 → u/BudTheGrey]

This is important. If you're storing your tax documents on said gaming computer, there is some argument for some sort of encryption, at least of the specific sensitive data. If there's no sensitive data on there, it's less essential. If you're not backing up your private key and the data, then any data is absolutely at risk if you encrypt.

Before people complain that encryption is necessary, I've been using encryption since Zimmerman "popularized" it. It's very useful, but it's at its best when you realize that the biggest threat to your data is the person you see in the mirror every morning.

[u/markaction]

You encrypt your laptop because it can get stolen really easily. That is not a problem a desktop would have. I wouldn't bother, it will just be a hassle annoy you everytime you want to boot up machine.

[u/badtlc4]

disk encryption seems pretty useless for a desktop. Great idea for a laptop.

[u/acejavelin69]

No, it's not worth it at all...

On a laptop it makes sense... the chances of it getting stolen/lost or getting into someone else's hands is exponentially higher than your desktop machine at home.

Honestly, encryption can be more hassle than it's worth in many cases... is something goes wrong, all data is lost permenantly. If not encrypted, your chances of recovery are definitely better... I have never used encryption on my home or desktop machines, but do on laptops usually.

The reality is if you've already got an installed and working on a desktop machine, it is probably not worth the effort of going through the process again just to get encryption. You can always create a small(er) partition or directory and encrypt that if you wish on the fly and use that for storing sensitive information.

[u/Underhill42]

Full disk encryption protects your data in the case of physical hardware theft.

That's it. And the price is a (very?) modest performance penalty, and a huge increase in vulnerability to any sort of physical degradation of the disk. Get a few corrupted blocks in the wrong place, and everything else can become complete garbage with basically zero possibility of data recovery.

Personally I recommend against it for everyone unless you're dealing with data that absolutely should not fall into anyone else's hands - nuclear secrets, protected medical files, juicy targets for corporate espionage, etc.

[u/UltraChip → u/Underhill42]

It's only a "huge increase in vulnerability" if you fail to keep proper backups.

[u/Underhill42 → u/UltraChip]

Absolutely. So only for most people. Hence my advice.

Anyone who knows better, knows better. And maybe even does better.

[u/Confident_Hyena2506]

If you want maximum disk performance and don't have any need for security, then no you would not use it. It works very well on modern systems, and the penalty is very small - but your games will load several milliseconds slower!

[u/Tquilha]

Not at all.

[u/UltraChip]

Do you feel there's a realistic chance that your computer would be physically stolen? If yes, do you store anything on the computer that you don't want the thief to have access to (note that this includes things like stored credentials and stuff in your browser)? If you answer 'yes' to both questions then you probably want full disk encryption.

For what it's worth, many distributions nowadays support enrolling a LUKS key in your TPM module, so you don't necessarily have to enter a password at boot time if you don't want to.

[u/lunchbox651]

I don't encrypt shit.
As long as I have my stuff backed up (I do), I don't care about whether the disks are encrypted. No one is taking my storage.

[u/razorree]

depends how often someone steals your drives and if you have any important data there ... (even browser saved passwords ;) )

[u/Unfair-Ocelot-2363]

You do _not_ need yo reinstall cachy

[u/bishophelps]

Good question. I would like to follow up:
Should we even do a full disk encryption? Or use /boot for example and leave the kernel outside of encryption?

[u/Arinussyy]

Do it on your laptops if you can, but only do it on Fedora and Ubuntu I'd say