Does the ROOT partition being unencrypted present any security vulnerability?

Our PureOS OEM install creates a separate unencrypted /boot partition, and an encrypted root partition and swap partition. The root partition is encrypted with a key you end up setting on first boot, while the swap partition is encrypted using a key that’s randomized at each boot–this is why hibernate won’t work on a default PureOS install–the randomized key used for swap means the data there is wiped out at each boot.

I’m not sure who would have told you we encrypt /home separately as we haven’t had a separate /home partition (or one of those post-boot encrypted /home setups like you sometimes see on Ubuntu) for as long as I’ve been here.

5 Likes