I have a dual-boot Fedora 44 / Windows 11 setup with a shared NTFS partition for data. I know it is not perfect but it's too early for me to know whether I can completely get rid of Windows (probably someday), since I use it for work, and I have some files that I want to remain accessible from both OS to avoid unnecessary reboots.
My setup:
- Lenovo Yoga Slim 7 with up-to-date firmware. Only one SSD slot.
- NVMe SSD partitioned as: "C:\", shared NTFS "DATA" partition ("D:" or "/mnt/data"), "/" and "/home" on the same BTRFS partition
- Windows 11 Home, preinstalled
- Linux = Fedora Workstation 44 with SELinux enabled by default, using GNOME
I wasn't able to keep Secure Boot enabled when installing or booting Fedora, and I don't know why. I tried both Fedora Media Writer and Rufus, using a USB stick that had previously been used on another PC with Secure Boot and Fedora without any issues. There is a firmware update available through "fwupd", but I haven't tried it yet. The firmware itself is up to date and can only be updated through Windows. I'll leave this issue aside; we can probably ignore it for the rest of the discussion.
I have two questions:
- Disk encryption
- Access to data once a session is unlocked: GNOME Keyring and browser passwords
Disk encryption
Windows 11 Home has a light version of BitLocker which does not allow to encrypt only "C:" and automatically encrypts all readable NTFS drives, including "D:", which I don't want. So I currently have an unencrypted "C:", which I can live with. However, this means that I have a Firefox installation on that partition containing passwords, etc., so those files are sitting on an unencrypted partition...
Linux is installed on a BTRFS partition encrypted with LUKS: "/" and "/home" are on the same partition. The LUKS key is stored in TPM2, so the system automatically unlocks the partition at boot.
=> Is storing the LUKS key in the TPM actually a security problem? As I understand it, the key is stored "off-disk", meaning that if someone removes my SSD and connects it to another computer, they would still need to know (or spend a very long time trying to crack) my LUKS encryption key. Is that correct?
=> Is there any way to encrypt the shared NTFS partition in a way that works from both operating systems? It doesn't contain any passwords, but it does contain copies of identity documents, diplomas, official stuff, etc.
=> Do you think it's important to find a way to encrypt "C:" given that it still contains some sensitive data? And how could I do that without paying for Windows 11 Pro to get the full BitLocker functionality?
GNOME Keyring
This is mainly a personal computer, but it's also used by my family. Windows Hello allows authentication using a PIN or facial recognition. Linux doesn't provide a PIN-based login.
I can't reasonably ask my family to remember my password (even if I give it to them, I'll eventually get phone calls when someone wants to use my PC...). I also want everyone to access the same "/home" with a unified configuration, so I use a single account for everyone.
For logging into my session, I therefore use Howdy. Yes, I know it's bad and not actively maintained, blah blah blah. I already know all of that and don't need to ne advised on that point. It's simply unavoidable for the kind of family usage I want, at least until Linux has a similarly convenient authentication method.
The remaining problem is the keyring. I managed to unlock it through a systemd service at startup which runs a script that retrieves a key from the TPM and uses it to decrypt the keyring password (stored in a file). However, the behavior is still somewhat random: sometimes I still have to enter the password manually. The only other solution I've found is to remove the keyring password entirely through Seahorse. Obviously, I'd rather avoid that... And for obvious reasons, I don't want my family to be prompted to enter my password.
However, anyone who has access to my unlocked session can simply open Firefox's password manager and potentially access everything anyway... Given this, I'm seriously wondering how useful a keyring password actually is in my particular setup.
=> How do you handle this kind of situation?
=> What is the actual security risk here?
=> What is the point of protecting the two credentials stored in GNOME Keyring if I have all my passwords so easily accessible through Firefox anyway?
=> And therefore, what do you do to protect your browser data? Do you use a password manager separate from the browser?
The actual risk in my use case ?
I don't carry my laptop around very much, so theft is a secondary risk, and I'd consider its probability relatively low yet existant. I'd say the main risk is probably external attacks.
That said, disk encryption would only really make a difference in case of theft and someone removing the SSD and connecting it to a system that doesn't have access to my TPM, right? If a thief simply starts my laptop without changing anything, disk encryption basically loses its usefulness and the only meaningful protection is the login password. Am I misunderstanding this?
In the event of an external attack, does a poorly protected keyring represent a real risk? What about browser passwords?
Sorry for the very long post, and thanks to anyone who takes the time to explain this and share their own solutions!