As long as it's a strong Debian/etc base with LUKS encryption and a password you've never used anywhere else, yes, you'll be fine. NO MAC NO WINDOWS
You may want to look into cryptsetup-nuke-password , if you put in the special nuke password it'll wipe the encryption headers and keys, making the information useless.
Thanks for the tip about cryptsetup-nuke-password. I wonder if LE would bother decrypting the running system, or if they would (or are required to) remove the drive and clone it before trying to decrypt it? I suppose that if one uses the BIOS internal SSD encryption, then the SSD might be paired with the machine, unless there is a back door for LE, or they bypass the BIOS password to boot from USB and then access the drive on the running machine. If they have to use your OS to get in, then LUKS on top of all of that could pressure them into typing the special password. I'm not sure about the legal consequences of destroying evidence if one is being investigated though.
I'm using LUKS, but not Debian... Any thoughts about why you recommend a Debian based distro? It's true that there is less package churn, which can help with reliability, but I like having new software. It's also a lot of work for Debian maintainers to backport bug fixes to old versions of software, so software often remains unpatched until the next release.
cyyptsetup would be before they get to your door use, not once you are in handcuffs. KickSecure if you want a tight ship, but it's a bit too restricted for me.
Please share more of " main personal Linux machine" - I would probably say no on this, but if you want to give a little bit more detail. Encrypted? What distro? etc
Yes, my main personal machine is encrypted with LUKS, and the OS is OpenSUSE Tumbleweed, partly because I like staying up to date on kernel patches.
My main concern is that if I have Whonix on my main OS install, and I happen to download a malicious PDF file while browsing the clearnet outside of Whonix, then open it in a non-sandboxed PDF viewer, that could infect my whole system, granting access to the Whonix data. Of course, getting infected at all on a personal machine would also be a major issue, even if Whonix is not there.
If LE asks me to decrypt my main laptop, a secondary one, or an external drive, I know to not help them with that, God willing I have the courage to remain silent. If LE were to decrypt either laptop, they would know that I'm using Whonix, but that's also true of any external drive.
I get that there is no perfect security, so maybe I'm overthinking it. But I don't have a strong threat model, so it's hard to say what the pros / cons are here.
The newest version of Whonix has two users. User and sysmaint. When you are under the daily activities user, You have zero root access. You have to restart and go to the sysmaint to update packages, etc. Might be a thought. It's a little annoying but I'm already used to it and I like it.
The other is if you use Virtualbox, you can encrypt the workstation VM also. I go over that here - /post/bf134a488007596b453a
That would make your PDF scenario more difficult to accomplish.
That's basically how I have my device setup. Also used FDE on workstation and gateway. I think that it's virtually secure.I also have the host encrypted using LUKS.
It's GNU Privacy assistant - it's a decent backup if Kleopatra crashes on decryption but I rarely use it. I would know the basics of gpg instead. /post/e38f9957f595b6d102e1
You may want to look into cryptsetup-nuke-password , if you put in the special nuke password it'll wipe the encryption headers and keys, making the information useless.
I'm using LUKS, but not Debian... Any thoughts about why you recommend a Debian based distro? It's true that there is less package churn, which can help with reliability, but I like having new software. It's also a lot of work for Debian maintainers to backport bug fixes to old versions of software, so software often remains unpatched until the next release.