Re: LUKS-encrypted root and unencrypted /boot ?

["Clément Lassieur" <clement@lassieur.org>]

Benjamin Slade <beoram@gmail.com> writes:

> Thanks, Clément.

You're welcome!

>  > >  > Do you use Libreboot?
>  > >
>  > > Yes, I'm using Libreboot. Does this make a great difference over the
>  > > manufacturer firmware in this case?
>
>  > It might, because the GRUB used is the one shipped with Libreboot.
>  > So it has nothing to do with Guix.  I think talking to the libreboot
>  > people would help you more.  (Disclaimer: I have the same issue, I
>  > find that pressing 'c' and typing 'cryptomount ahci0,gpt3' makes the
>  > process faster.)
>
> Thanks, I'll look into that. For the moment I've just switched to having
> an unencrypted root and encrypted /home partition (where the swapfile
> also lives),

> ...which seems to me better from a security standpoint (I can
> use --iter 500, sha512, &c. without an issue).

But it's easier put a malware in an unencrypted root ;)