this is more of a personal choice type question
but imho encrypted home is more than fine
thats where most personal things should be stored
#Linux installation and encryption
vale thunder
so the thing about any encryption is once its decrypted its no different than if it was never encrypted at all
encrypting your hdd is mostly for physical access attacks
if someone where to take your hardware while its turned off they cant see whats on it w/o the key
but say you just leave it logged in, and someone walks over, they can view it all just as you could
(or a hacker who has a backdoor)
think about it like a phone you have a lock, as long as its locked noone can see whats inside
if they find it already unlocked they can see everything
most hackers are going to just wait in the background until you decrypt then jump in
and snatch w/e
theres just in time decryption for things like passwords ex stored on a pc but that isnt this
mint does have that by default tho, it can ask for sudo password before logging into an app with stored credentials
im on your unlocked desktop i try and open your discord, i cant unless i have the keyring password to use the actual saved credentials
hot hill
As Friendo says, this is more of a choice matter than one of correct/incorrect.
You do need to use the Logical Volume Manager for full disk encryption because the vanilla filesystem simple doesn't have this feature, but LVM does. LVM is not a bad thing in itself, but it adds a layer of complexity, which only a minority of Linux users bother with. So in case of issues, you might have a hard time finding good resources to resolve them. That does not mean issues are common, just that if they happen, they tend to get complicated.
Which encryption to use? Depends on the use case. If government agencies are after you, you probably want to go full nomad and use TAILS, like Ed Snowden did with success. If you simply want to protect your data and privacy in case of stolen device, full disk encryption is probably the most seamless and performant way to do it (/home encryption was benchmarked to be slower than FDE). However, if you only want to keep a selection of private files private, consider simply running an encrypted container file. This would mean you need to actively unlock the container to work with these files, but could leave it completely alone and just use the rest of the system otherwise. Tools like Cryptomator can do this for you.
Anyway, welcome to Linux.
heavy moss
@soft drum I don't like lengthy explaination so here is a single question you can answer and decide for yourself:
"Do you see getting your computer stolen and the theif accessing your data an issue?"
If yes, use full encryption. If no, no need for it
sick breach
You SHOULD use encryption on any laptop. It will protect your privacy if anyone should steal or seize your laptop because they wont be able to read your files. It will not protect you from hackers. Whether you use LVM is from your perspective perfectly meaningless. You CAN treate more than one physical storage device as one logical device with LVM but using LVM doesn't configure your machine thus. It's like having a tow ball on your truck doesn't install a boat on the other end.
Full disk encryption is a bit more secure although both options are perfectly fine. More importantly full disk encryption performs better making it the overall better choice.
heavy moss
@soft drum short answer is that you can, but it’s at hard drive level
Basically some SATA and most NVMe disks support self-encryption provided by the drive controller itself which locks the drive at the device and does not rely on the OS doing it
sick breach
Self-encryption has historically been of poor quality
heavy moss
Honestly the only case I've seen LVM being a menace is if you want to expand a physical volume
Otherwise it's fine
hot hill
You activate LVM on a per-volume basis, so you should be fine running an encrypted device with LVM, and having any number of other devices without it - or with it, your choice.