Today i took my first steps into the world of Linux by creating a bookable Mint Cinamon USB stick to fuck around on without wiping or portioning my laptop drive.
I realised windows has the biggest vulnerability for the average user.
While booting off of the usb I could access all the data on my laptop without having to input a password.
After some research it appears drives need to be encrypted to prevent this, so how is this not the default case in Windows?
I’m sure there are people aware but for the laymen this is such a massive vulnerability.
Most Linux users run fully unencrypted drives as well. Its a vulnerability and a risk but its not a massive threat to the average person.
Idk if the average person is a laptop user but laptop users would definitely place a higher value on disk encryption.
Yes, any laptop without an encrypted storage drive will have its data accessible by someone booting from a live USB.
It really is a massive vulnerability, but it’s not well known because so few people even understand the concept of a ‘live USB’ to make it a widespread threat or concern.
So yeah, if you’re ever in possession of a Windows machine that doesn’t have an encrypted disk, you can view the users’ files without knowing their password via a live USB.
It’s also not limited to laptops.
This is not that big of a deal most of the time, since you are the only person interacting with your computer, but it’s worth remembering when you decide to recycle or donate – you have to securely wipe in that case. Also bear in mind, if you do encrypt your drive, there are now more possibilities for total data loss.
Oh, fun fact: you can change a users windows password inside Linux. Comes in handy for recovery, ie, user forgot their password.
Modern windows machines will be installed with bitlocker (full disk encryption). With manual installs it might not be.
I think Bitlocker isn’t even supported on Windows 11 Home. I was shocked when I wanted to set up disk encryption on my wife’s notebook.
It’s got like a “lite” version. You have to use the terminal to check if it’s enabled but that’s that Microsoft started doing in win10 home. I assume some asshat in marketing got the agreement they could keep their branding even if Microsoft gave out encryption for free.
Personally I found it made more sense to just bring an old pro license so I could be sure it was enabled.
I have a Windows 11 work laptop, I might try it out and see what happens
Your work laptop most likely is domain joined and controlled. Which I surely hope has bitlocker enabled.
I’m happy that you’re on a journey of discovery. This is not an insult. The word is partition. Someone corrected me on the spelling of something last night. We all make mistakes.
(especially with reference to a country with separate areas of government) the action or state of dividing or being divided into parts.
bookable Mint Cinamon USB stick
Does book still mean cool?
No idea, it’s meant to be bootable
It’s the same situation with Linux just a simple login only has very basic protection you need to encrypt your disk if you want to make sure no one can read it.
This is a case where Windows-bashing is hypocritical. Almost no Linux distro has disk encryption turned on by default (PopOS being the major exception).
It’s dumb and inexcusable IMO. Whatever the out-of-touch techies around here seem to think, normies do not have lumbering desktop computers any more. They have have mobile devices - at best laptops, mostly not even that.
If an unencrypted computer is now unacceptable on Android, then it should be on Linux too. No excuses.
It’s dumb and inexcusable IMO
No, it’s a choice, because:
-
History… encryption didn’t exist in the beginning. Upgrades won’t enable it.
-
Recovery… try telling the people that didn’t backup the encryption key - outside of the encrypted vault - that their data’s gone.
-
Performance… not such an issue these days, but it does slow your system down (and then everyone complains)
So, please continue to encrypt your data as you choose and be less judgemental on others, esp. anyone new
No excuses.
You can’t enable encryption after the fact? What a backwards system…
For which OS?
It can be enabled at any time on Windows & Linux. It’s just optional.
It’s your bullet point number 1
That says that upgrades won’t enable it… the user can still enable it.
I will definitely say I wish encryption setup was a lot easier in Linux. Windows is like “wanna Bitlocker?” Done.
With most Linux installers, if you’re not installing in a very default way, and clicking that box to encrypt the drive, it’s time to go seriously digging. For a while.
I managed to encrypt a secondary drive with the same password on my EndeavourOS laptop, but I still need to enter the same password 2 times before getting into the OS.
I consider that a feat, and I’m not touching it for fear of losing everything lol.
Yes, I feel your pain.
Encryption drives sound like a good idea until the subject of unlocking them comes up… and automatically unlocking the drive for the OS isn’t really helping.
But, for user data, it can be unlocked automatically during login. The Arch wiki covers this.
But backup your data 😉
Blah blah blah. Unencrypted data is the wrong default in 2025 for any OS. Linux should not be a poor man’s OS.
It depends on your use-case.
Encryption of data at rest (this discussion) is mostly helpful for physical theft, so a device that never leaves the house, there’s little reason for encryption.
Similarly, on a lower powered mobile device, maybe you only want / need user data to be encrypted, and there’s no need to encrypt the OS, which keeps the performance up.
Maybe you want the whole thing encrypted on your high performance laptop.
So, it’s difficult to define a sane default for everyone, thus making it an option for the end user to decide on.
Linux has more choice than Windows - and the encryption algorithm(s) can be verified - so it’s definitely the better choice.
-
If an unencrypted computer is now unacceptable on Android, then it should be on Linux too. No excuses.
When is the last time you carried your desktop outside? Forgot it somewhere?
Almost no Linux distro has disk encryption turned on by default (PopOS being the major exception).
it’s usually an option in the guided disk partition
If an unencrypted computer is now unacceptable on Android, then it should be on Linux too. No excuses.
Linux is about choice, not whatever someone else thinks it’s acceptable
Echoing Jubilant Jaguar’s sentiment about defaults mattering, I think that sometimes an excess amount of choice can be overwhelming such that a user is less empowered to make choices about things they do care about (Leading to a less steep learning curve). Sensible defaults need not remove anyone’s choice
I don’t disagree with the premise. I may disagree encrypted hard drive by default a sensible choice
Sure. But defaults are important.
Defaults are generally who do not want to understand in depth what they are doing (no offence). Example from other sphere: in R-Cran (used to write statistical models), some functions have defaults to either choose a particular algorithm or an optimisation value. I have heard almost about nobody among students, PhDs and even higher up the ladder, who took the time to understand what is happening below the shell. Instead these people took just the defaults, it worked (result was significant), done. However, if they may have chosen another algorithm, things may have turned differently, which would open up a box with many questions concerning modelling adequacy and understanding of data. It is the same with defaults in Linux.
I always turn on LUKS during install. The only exceptions are when I’m doing tests of different distros on my machine that I lovingly call “FuckAround”.
It really is the best way to find out.
I think on laptops Windows i trying to encrypt the drives. Maybe online if you are logged in to a Microsoft account for bitlocker to save the encryption key. Encrypting the drives should be your decision to take.
Yes, my sister bought a laptop it had windows and bitlocker installed.
She doesn’t know what any of those things are nor does she have an encryption key.
So she was not able to resize her partition to try to dual boot linux - she’d have to totally kill windows (which I suggested, of course, but you know. . . ).
It stops her doing what she wants because she was given something she doesn’t understand by people who didn’t explain it. At least she is “safe” though according to someone else’s definition. I guess coud’ve just said “Basically, microsoft” for short.
Microsoft makes all the decisions for you.
Try using a virtual machine before doing a full switch
Yup. You’ll need to tkinker with Linux too if you want disk encryption. At the very least, set a BIOS password.
Windows does support encrypted drives with Bitlocker, unfortunately Bitlocker’s default settings leave it vulnerable to many different attacks.
Anon discovers computers
I still remember years ago one time windows fucked itself and god knows why I couldn’t fix it even with USB recovery or stuff like that (long time ago, I don’t remember).
Since I couldn’t boot into recovery mode the easiest way to backup my stuff to a connected external drive was “open notepad from the command line -> use the GUI send to… command to send the files to the external drive -> wait and profit” lol.
By the way, no different for Linux, if you boot off of USB you can mount partitions and access anything if not encrypted and linux windows, encryption is not the default.
A secure future proof Whenblows 11 is akin to a healthy wealthy fentynal addict.
