[Feature] Full disk encryption

[zhulik]

Your system information

• Steam client version: does not matter
• SteamOS version: 3.0
• Opted into Steam client beta?: No
• Opted into SteamOS beta?: Yes
• Have you checked for updates in Settings > System?: Yes

Please describe your issue in as much detail as possible:

Currently SteamOS does not encrypt anything: browser data, steam data, contents of sd cards and so on are easily explorable and modifiable if you connect the SD or SSD to another computer. Most of the users usually do not think about security concerns and may believe the recently added lockscreen is enough.

The only way to securely store sensitive data on the deck is using plasma vaults, but OS image does not include it's default backend (cryfs).

Yes, I know SteamOS is not a general purpose OS, but it gives users possibility to store and process sensitive data on the device but does not care about security putting it on the end user who is not always technically educated enough and used to trust platform holders in security questions.

I believe there must be a way to encrypt root fs and all partitions that may contain user data without making unlocking annoying to the user as the password for root fs may be equal to lockscreen pin and passwords for other partitions including the SD may be stored on the encrypted root and may be unique per partition. It must be even possible to use secure boot and everything almost transparently to the user.

WDYT?

[hftl-kalle]

I agree very strongly. I really do not want to lose the deck and have people access to my stuff.
I created a new Arch install on my SD card where I had the home partition encrypted and auto unlocked on login. Maybe the new pin system could be combined with auto unlocking the encrypted folders/drives

[SeveredinTwain]

+1. In this day and age you simply can not have a mobile device that does not have full disk encryption enabled by default. Especially when you are touting the features of it being a full fledged PC. Less tech savvy people will erroneously believe they can store their secure information on what might very well be their only portable computing device, only to have it seized during travel or stolen. I imagine you could ship the devices with full disk encryption already enabled and just require the use to change the encryption password on registration of the device.

[zhulik]

Fscrypt could be also fine. It's pretty easy to use, it plays nice with ext4, can be unlocked on log in and already works on every single android device

[andritolion]

I'm not sure if this is possible on Linux, but using hardware-backed encryption with automatic unlocking using the TPM, just like on Windows, can enable fully transparent disk encryption with next to no change to the current login experience. The encryption keys kept on the TPM could be backed up to Valve servers, like how BitLocker backs up encryption keys to your Microsoft Account.

[zhulik]

@andritolion it's possible in general and even more possible when you fully own a platform like valve. Personally I'd prefer good old passwords, but tpm would sill be better than no encryption at all

[andritolion]

However, I'd argue that the user's experience should not change when encryption is enabled or not. Considering that SteamOS's files used for large parts of the user interface (like the Steam Client) is located on the user partition, encrypting the user partition without automatic unlocking will change the user experience (they need to login twice, or login then wait a while until the system loads) and because of the change in device behavior, some people may decide not to encrypt their drives because they don't want to wait longer to boot. The best security is security that is invisible to the user. Additionally, the login screen is implemented in the Steam Client, and as that will be encrypted if the user partition is, the login screen will need to be rewritten. (Then again, maybe it's a good idea to rewrite it. There are so many issues I have with it, I think I might open an issue about it.)

[FlonneEx]

+1, I consider this essentially required. I'm going to have to do a lot of complicated hacking to make SteamOS support this for my own install, and I'm guessing updates will bork it. This device is marketed for more than just games, and I intend to use it as such, and that requires security.

[DistortedBit]

I share the same sentiment. Mobile devices can be stolen/lost easily.

Even if the user does not store anything important, the steam account is not protected and can easily be accessed outside of steam deck by copying over cookies etc.

But given how steam deck is such a versatile device, a good portion of the user base will use it as a personal computer as well. This is where fde become important.

Imo FDE is a mandatory feature in this day and age. Specially since Linux already supports this, making it an eventual reality shouldn't be difficult.

If a seamless experience cannot be achieved, at least allow power users to use it without having to implement it themselves.

[aminehmida]

FDE is a solution but not the only solution. In my opinion, we don't need to encrypt the A/B root partitions. the content is already available from Valve's servers. I am not sure about the other 2 /var partitions though (anything confidential in there? Wifi passwords maybe?)

The home partition is more important, a LUKS+TPM encrypted systemd-homed could be used. Or even just encrypting /home with LUKS + TPM for auto decryption without systemd-homed. Using the TPM is specifically desirable as it will keep the current user experience (not forcing a password/pin if the user doesn't want it)

I was really surprised that the steam deck doesn't encrypt home by default. I think it's irresponsible to offer a web browser that people can use to login to their private accounts without enabling encryption. Also, the current security lock gives a false sense of safety if someone looses their device. (A non sophisticated attacker could just pop out the SSD, mount it in another machine, and read the browser cookies in clear text).

A nice write up about a similar setup could be found here

[jg00dman]

My steam deck is ordered and on the way... a little concerned to read that it isn't secure by default.

[kulmin]

+1 for this, even if it's just a key combination of just pin + TPM.
Every cheap android device from 4 years ago has full disk encryption enabled by default.
It would make the steam deck with the docking station a viable alternative to a big clunky desktop PC, which right now is not a choice because the steam deck is also a mobile device.

It's just too risky in case it gets stolen.

[kainzilla]

The Steam Deck is an incredible device, and has the ability to be a primary-use computer in my household, except this single concern is one that prevents truly using it for the desktop capacity.

For the time being, I can use it as a gaming device, but things like password managers, allowing access to file syncing services like Dropbox, saving sensitive site login cookies, etc. are all vulnerable without full disk encryption.

[klesher]

The Steam Deck is an incredible device, and has the ability to be a primary-use computer in my household, except this single concern is one that prevents truly using it for the desktop capacity.

For the time being, I can use it as a gaming device, but things like password managers, allowing access to file syncing services like Dropbox, saving sensitive site login cookies, etc. are all vulnerable without full disk encryption.

I agree with this 100%. I don't even use un-encrypted devices that always stay in my home (I.E. my desktop) due to the possibility of theft. Encryption is even more important for a device that you're intended to travel with.

This severely limits the use cases for my SteamDeck in desktop mode, particularly for anything that would require authentication. I'm glad I took pause and did some research before I even signed into any accounts on my SteamDeck. Mobile Steam library gaming via Discord sure would be nice. 😞

[synthead]

I agree with this. It's a mobile device that is easily lost or stolen. It would be a real shame for that to happen and have credentials stolen. These days, email is the source of truth for identity (i.e. password recovery gets sent to email with full trust), so as long as a user simply signs in to their email account, they risk most of their credentials being stolen.

[e-minguez]

Just FYI, postmarketos uses https://wiki.postmarketos.org/wiki/Osk-sdl which allows unlocking the mobile devices using the touchscreen. I guess it shouldn't be too hard to port it to SteamOS.