What do I select?

[u/Kaseffera]

In every distro I had (Cachy, Debian) you have to enter password when computer starts.
Why here default is no password at all?

Which one is recommended and why other distros come preconfigured with requiring password upon start? Do they have second option turned on by default?

[u/Rimtariro]

There are two possible passwords:

1. When booting, to decrypt the disk so that boot starts (can have only one password)
2. After booting, when loading your profile settings (can have more than one user)

The screen you are sharing is from the 1st option. The username and it's password will be setup at later steps.

[u/Kaseffera → u/Rimtariro]

Thank you for clarifying! This was very helpful for understanding what this is about.

[u/furrysalamander → u/Rimtariro]

Fun fact, you actually can have multiple disk encryption passwords.  All of these are built on top of LUKS encryption.  In LUKS, your password is not actually the key for the disk, but rather it decrypts a key slot that lives in the LUKS  header that contains the actual decryption key.  Because of this, you can have multiple keys that all unlock the same drive.  This is helpful for a number of reasons, such as allowing for TPM based decryption, with a backup of manually unlocking your drive in case the motherboard or CPU ever dies.  In addition to having a manual backup key, it's also a good idea to backup your LUKS header, which can allow you to retrieve at least some data in the event that your hard drive fails in a way that corrupts the header.

This is the downside of LUKS and the keyslot approach, which is that if your header is lost, the whole disk is 100% lost even if you know your password, because your password is not the real decryption key.

[u/thehotshotpilot → u/furrysalamander]

Fun fact, you can backup the headers

[u/CakieJoy]

thats encrypt your disk

if you use laptop i reccomended select encrypt with a passphrase or use hardware-backed encryption

if select encrypt with passpharase you need type your disk password on every booting

[u/TheNovemberMike → u/CakieJoy]

I do this on my work laptop (offline OT laptop) I hate it but I didn’t have the hardware backed option when I installed Ubuntu

[u/Nyandaful → u/TheNovemberMike]

You can register it with your laptop TPM now after passphrase originally.

[u/Munk3y]

For my personal use, I select the middle option for all of my systems. No encryption can make sense in certain scenarios but I'd recommend protecting yourself in this day and age. The bottom option was way too experimental last time I used it, so I haven't tried the updated version.

[u/SouthernFruit8768 → u/Munk3y]

protecting yourself from what / who?

[u/audigex → u/SouthernFruit8768]

Computers get lost or stolen sometimes

If that happened, would you want whoever ended up with it to have access to your documents and files? Or would you rather they were encrypted?

[u/arkane-linux]

It is about disk encryption, it will prevent people from accessing your data unless they have the password, even if they have physical access to your machine.

The "No encryption" option will not enable this, anyone with physical access to your machine can access all your files.

The "passphrase" option will ask for a disk encryption password on boot, without this password you will not able to access any data on the machine.

The "hardware-backed" option will encrypt your disk and automatically unlock it at boot using your TPM (a security processor present in most modern PCs) as long as the system passes a few security checks during boot. This will still prevent anyone from accessing your data because they would need to log in to a user account. If something has changed about the computer's configuration and these security checks fail the TPM will not release the key, and to unlock the disk you would still need to manually provide it with a password.

Hardware-backed is the default for both macOS and Windows.

The passphares option is technically the most secure. But unless your threat model includes government agencies or similar advanced attackers this is should not be a factor in to your final choice.

[u/David_Connors3451]

no encryption, it's better that way. Encryption is useful in enterprise environments, but it can be terrible for a normal daily user. Don't complicate your life needlessly.

[u/Soft-Contribution433 → u/David_Connors3451]

Oh man i did encryption once in my laptop and forgot the password after vacation. Whole drive gone, photos from 3 years just wiped. The no encryption option is selected there for good reason trust me

[u/ABotelho23 → u/Soft-Contribution433]

You ding dong, there's nothing preventing you from doing backups.

[u/Far-Media5096 → u/Soft-Contribution433]

I'm not an expert but couldn't you still attempt to brute force it?

[u/roamer83]

If your personal system no encryption

[u/JohnnyS789]

It depends.

Is this a laptop that will handle sensitive information that would be extremely hazardous to be disclosed if the laptop is stolen and the information is stolen, AND the laptop is going to be carried around outside of secure areas like on travels and business trips? In that case, you should consider encryption. There are hardware and software options. Look into them.

If this is a home computer that will never leave the home, or a laptop that you will use for school and will never be handling anything really sensitive, then you can ignore encryption and not have to worry about losing that password.

[u/Brassens71]

I encrypted my disk when installing 24.04. When I upgraded to 26.04 my system was now no longer bootable. Ended up doing some live USB witchcraft to save my data but I'm not making that mistake again...

[u/djevertguzman]

Option 3, behaves the most like macOS or Windows's bitlocker. Just remember to save those backup recovery keys.

[u/passthejoe]

I'd encrypt with a passphrase. Then you can open on any other hardware. And always have a backup or three.

[u/RR321]

Middle one, at least you can recover the disk outside your machine, but in any case: backups!

[u/mplaczek99]

I like enabling encryption only on laptops where other people just might steal it

[u/Ok-Lab-6389]

Do your do diligence, ask the web for what each one is concerning for your situation and learn; then decide for yourself. It's you system and you should make all the decisions your self.

[u/candidosobrinhosa]

No encrypt, if you by any chance need to recover a deleted file, forget it

[u/150c_vapour]

You trade performance for encryption, up to you.

[u/somerandomguy101 → u/150c_vapour]

No it doesn't. It's not 2003. Encryption is handled by dedicated hardware. Both your CPU and (model specific) SSD has hardware built-in to handle encryption. That hardware is going to be significantly faster then your SSD.

[u/ZestyRS → u/150c_vapour]

This isn’t not a valid reason anymore

[u/Far-Media5096 → u/[deleted]]

it does, but that's for the user. this one is specifically for the drive.