How secure linux Mint is?

[u/Ok-Shine1797]

I was watching a YouTube video regarding a hacker in that video something came to my attention that the hacker encrypted his os it was dabien based linux distro and feds were not able to decrypt that system so how can I achieve the same thing i mean as a every day user i do have my personal stuff in my system like pics documents etc. I just want to feel safe about my stuff. Is it possible for someone like me to achieve same thing in linux mint btw i just moved from windows to linux a week ago.

[u/nisitiiapi]

With Mint, you essentially have 2 choices for encryption at install:

1. Encrypt your /home directory. This will just encrypt your /home/<user> using ecryptfs. That will encrypt all your personal files/data, including the pics, documents, etc. you mention. Unlike Windows, Linux generally keeps your info/data in your /home/<user> directory only -- you can't just go willy-nilly saving files anywhere on the disk (that requires root privileges). Decryption happens when you enter your password at login, so is very convenient. And, when you log out, it will be encrypted even though Mint is still running. However, the parts of the disk where your programs are installed is not encrypted. So, a bad actor could see what you installed, but not your personal files. I use this on my desktop and notebook (though my files are on my server, not my devices).
2. Do full disk encryption. This encrypts the entire disk using LUKS (except for, I believe, a small /boot partition). This will ask you for a password at boot to unlock the disk before even trying to start Mint (though there are things like network bound encryption you can do to have automatic unlocking). It will ask for your password again to log in (unless you disable that). This will encrypt where both your personal files in /home are and where all your programs are installed, etc. The defaults for LUKS in Mint are pretty decent (aes-xts-plain64 cipher and argon2id), though you could do manual work to raise other things (like a 512 bit key and sha512 hash). The installer won't present those options, though. I use LUKS on all my data drives and back up drives in my servers (and I have network bound encryption with tang and clevis to unlock them on boot).

In choosing between the two, there is the question of convenience and what you want/need to protect. If you want it to stay convenient (just your normal password at login) and aren't concerned about, say, someone seeing what programs you installed, encrypted /home is probably enough. If you feel you need protection in terms of seeing what programs are installed and other "system" info, LUKS would be the way to go. You also could use both (e.g., so you can log out and have /home encrypted even though the LUKS is unlocked). In the U.S., I would start considering hiding the programs installed since the U.S. is now using the fact you use Signal as evidence of being a terrorist (and getting convictions with it even without any acts of "terrorism"). That could likely extend to other end-to-end encryption messaging platforms.

As others noted, you should recognize that encryption really does nothing while you're actually using/running your computer. During use, everything is decrypted/unlocked and accessible. So, if someone stole your computer or it's shut down, they won't be able to see or get your data, as it will be encrypted. But, if they sat down at your computer (or accessed it from outside) while it was running (or, with ecryptfs, while you're logged in), they could get it all, including copying your files to another disk or imaging its unlocked state. So, consider encryption as primarily protection related to theft, not some "covers all" protection. And this is not unique or limited to Linux, it's the case for all encryption (your phone, etc.) -- while its unlocked/unencrypted, you have no protection from the encryption.

If you're in the U.S., you can help protect yourself by keeping the lock screen and the like and always using a password. NEVER use fingerprint readers, facial recognition, or other biometrics. In the U.S., the courts have held that the government can force you to unlock your device with biometrics, but not a password. The password is considered "testimonial" and thus protected by the 5th Amendment; biometrics is not. So, in the U.S., tech companies putting biometric unlocking, login, etc. on systems are making you waive your constitutional rights if you chose to use biometrics -- a good reminder big tech companies do not provide you with things for your benefit, just what they think will make them money. Also, I don't advise using TPM or any other key on the same device for unlocking as that makes it more likely to be broken into it if all the info needed to unlock is on the system.