i found out that if you forget one of your 1-8 passwords for luks it can still be possible to recover it as a keyfile and then set a new password with that keyfile without remembering your old passwords, but you have to be logged in to the luks disk already at the time of recovery. isn't this a huge security hole that gives anyone that has access to your unlocked laptop the possibility to change your luks passwords without even knowing any of your current passwords? i know that you should never give anyone access to your unlocked laptop without your supervision, but let's say for example a coworker or fellow student sees your screensaver lock password when you type it in and snatches your computer while you're away then they will have the chance of bypassing you're luks encryption and even make you not have knowledge of the luks passwords for the machine anymore!


No, that's not a huge security hole. You just misunderstand the threat model of LUKS. It's meant to protect your computer while it's off. While it's on, your screen locker is meant to protect it instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.