On Saturday, February 2, 2019 10:37 PM, Jonas Meurer <jonas@xxxxxxxxxxxxxxx> wrote: > > I see that the discard option has security implications. Absolutely. > Whether those are minor or major is debatable. My take on this is, that > the tradeoff is acceptable and for the vast majority of users > neglectable. On the other side, having fstrim working per default even > on encrypted volumes is a huge advantage. > > In general, I don't believe that choosing the most secure option without > taking other aspects into account is always just right. Sometimes, > accepting a small tradeoff towards usability can help a lot. It lowers > the barrier to use cryptographical software. And users who care about > more sophisticated attack vectors and want to put security first, are > still free to change their settings. > You are right that there is a tradeoff and we should seek the balance between security and performance. The problem is that 'performance people' tend to overplay their arguments without providing any data to support that claims. TRIM has greatest advantages for very small capacity flash storage which may be found on tablets. I wonder how many of them run Debian or any other distro with LUKS. Raising storage capacities and technological advancement of ssd/nvme disks make TRIM more and more irrelevant thus enabling it for encrypted devices is as neglectable for performance as disabling it is for security. So please don't frame it as cancer cure vs painkiller. Jordan _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx https://www.saout.de/mailman/listinfo/dm-crypt
