Hi folks,
I’m a long-time user of that blue hat distro for ~15 years now, but in the recent years I tried OpenSUSE Leap once in a while to see what’s good, what’s bad and what’s new.
There is one thing in particular was bugging me with all the OpenSUSE (Leap) releases I have tested, and that is the user experience when installing with Full Disk Encryption / LUKS.
By default, the installer does not propose or create an unencrypted /boot partition, and that lead to two very ugly password/decrypt prompts on boot.
I’m happy to see that with Leap 16.1 beta plymouth(?) is active and the second decrypt prompt is now graphical.
However, the main problem with the double prompt persist. The right solution, in my opinion, would be to create a separate unencrypted /boot partition in the installer by default if the user selects the disk encryption option. There may be more or less valid security arguments for an encrypted /boot, but I think an encrypted /boot only has a security advantage in a niche situation when an attacker has physical access to your device. An unencrypted /boot would be the better option for almost all users:
- In theory Secure Boot exists to verify the integrity of the boot chain.
- Full Disk Encryption is about keeping your data safe in case the device get’s lost or stolen. Most people propably don’t expect it to be a reliable tamper protection of any kind.
- If an attacker has physical access, he would propably rather install a physical keylogger instead of compiling you a custom kernel or reconfigure your grub…
- A proposed partition like a separate /boot by default in agama can be removed with only two clicks if unwanted, but adding a separate boot partition at the start of the disk requires you to remove all proposed partitions and completely partition yourself, which is way more elaborate.
- An experienced user that requires to have an encrypted boot partition for whatever reason will propably make sure to partition exactly as wanted manually.
- The default should be a great experience for the most users, and I think a lot of users who use FDE/LUKS struggle with the default partitioning.
- It should at least be easier to configure a slightly less secure, but better working FDE setup in the installer.
My actual technical suggestions:
- Make agama propose a unencrypted /boot by default when enabling disk encryption
or - On the encryption page, add a second option like “create separate unencrypted boot” and inform the user which implications these choices have.
Please don’t see this as criticism. I’m a nobody coming from another distro and I certainly do not want to tell anyone how OpenSUSE should do certain things. This is just my honest feedback as an outsider and a suggestion on how to improve the user experience for a lot of users. There are certainly aspects to this topic that I don’t see or understand, but the compromise would propably be worth it for many users.
If you use FDE/LUKS, I would really like to hear you thoughts on this.