I want to use Ubuntu but I am afraid about the encryption. We all know about prism the surveillance program used by the NSA and regular hackers and i would like to know if the OS encryption is good and safe that my files can be protected.

I would also like to know if there are security softwares that I can use to help protect my data. I just want to be protected.

  • Which data do you want to protect against whom? – David Foerster Aug 12 '16 at 8:37

If you are really worried somebody could spy on your digital data,
shut down your computer, unplug the power, sharpen your axe and smash it...

I'm sorry, but that's the only possible way to full 100% digital privacy and data security. It's not really usable in these days any more though, so let's not spend too many words on it.

After destroying your naive illusions of total security and protection, let's become serious.
Here are a few things (this list does not attempt to be complete!) you can do to improve your data security and raise your protection against specific attacking scenarios, but none of them will lead to universal security.

However, although the basic security tips should always be followed by every user, I don't recommend to blindly follow every advanced security advice here or anywhere else on the web. Instead, thoroughly reflect each method's advantages and downsides and only do what you think is useful for your situation.

Please note that when I'm talking about malware etc. in general, this does not only include destructive malware which wants to delete your data etc., but also programs that can spy on you and steal your data.

Basic security tips

  • Keep your system updated

You should always install all available updates to fix possible security vulnerabilities in your applications or the system as soon as possible. Fortunately this is very easy with automatic updates which are enabled by default on Ubuntu. See How do I enable automatic updates?

  • Install software only from trusted sources

Ubuntu uses repositories to provide you all available software packages and updates. The four official Ubuntu repositories main, restricted, universe and multiverse as well as the partner repository can be considered very safe with regards to malware. Applications you find in your Software Center are only from those sources by default.

However, Ubuntu is open and you can add unofficial third party repositories or PPAs (personal package archives on https://launchpad.net) to your list of software sources. Those are not tested and should be used with care. Commonly used PPAs can also normally be assumed safe though.

You can also download single .deb packages or source code archives you have to compile yourself from any arbitrary website. Those are usually not tested in any way by Canonical or reviewed by the community and must be used extremely carefully. You should avoid them wherever possible.

  • Do not just copy-paste and run commands from the web

I mean, of course you can and will do this, especially here on the site you get told to run this or that command all the time. However, you should invest a few minutes to read the command you encountered and understand what it does. The man command to show manpages of commands is your friend here, make heavy use of it.

A common example are the various "jokes" (not funny though) that advise you to run rm -rf / or variants of that. If you type this command correctly (I left out some stuff), it deletes every single file on your computer. Such accidents can be prevented if you know what the command you are going to run is supposed to do.

To sum up, use your common sense. You would not jump out of the window if some stranger told you to do so, right? Run commands advised on the web with the same care.

Advanced security tips

  • Use a simple firewall at least

Ubuntu offers you a very simple firewall, ufw, which you can just install and forget. It will run automatically and its default configuration is usually good enough for home users. YOu should not mess with it unless you understand what you do. It has a graphical frontend (gufw) which can make configuring it a bit easier for you though.

  • Perform malware scans on a regular base

This point may be debated, some say that there are no Linux viruses, others say you need antivirus software. Let's say there is few malware that could attack Linux systems directly and some which are platform independent. The question whether you should have an antivirus scanner installed is heavily discussed here: Do I need to have 'antivirus software' installed?

However, there is another kind of malware called rootkits which does very well exist for Linux. They can be hard to detect and remove though. More information might be found e.g. at How do I remove rootkits? and Best rootkit removal tool for a server?.

Of course you should scan data passing through your Linux computer for Windows threats if you have Windows machines in your network though that might receive the data.

  • Encrypt your partitions

If you care about security (inaccessibility) of your data in case someone gets physical access to your machine, you should use full disk encryption or at least encrypt your home directory and the swap space.

But please note that any kind of disk encryption only protects data on turned off computers from attackers with physical access. While your computer is running, the encrypted disks are mounted and the key is stored in memory. That means every program that can access your computer can also access all data on the encrypted (but unlocked) disks. I wrote more about this in my answer about securing computers against hackers with physical access, you can find the link at the bottom (or here).

What you could do instead would be to separate sensitive data from the rest of your system and use many small encrypted containers to store them. That way you can always unlock only those containers you need for your current work and lock them again as soon as you're finished. This way you minimize the time during which the sensitive data is accessible.

  • Surf anonymously

Most data companies and agencies can obtain about you will not be obtained by hacking your computer though, but by looking at your online identity and by tracking your browsing behaviour.

The rule of thumb not to post any content publicly online (e.g. in social networks) with which you would not be comfortable if someone wrote it above your front door always applies, of course.

But also seemingly private channels like unencrypted emails or Skype chats can be read along by at least the companies responsible for delivering them. You should not use them for really private data.

You can also get tracked while simply browsing the web, e.g. if you use Google, Facebook etc. to log into multiple sites, a profile of your behaviour on all linked sites can be made easily. Avoid this and better log in with email and password separately for each service. You use different passwords (and ideally different emails, eventually throwaway addresses) for each site, of course.

Another technique to recognize you as unique visitor to the same site even if you visit it at different times are cookies. They are not evil by themselves, they are just small text snippets stored in your browser that may be accessed by the site who wrote them. It can be used by sites to store your preferences, your login status, or a unique ID that helps to recognize and identify you. Many services require cookies to work, so I would not entirely disable them but set your browser up to delete them (with a few exceptions for sites you trust and for which it is useful) whenever you close the browser window.

If you are really paranoid, there is even more stuff you can do, like disabling Flash, JavaScript, HTTP referrers, OS information in HTTP request headers etc. to give companies a hard time to build a profile about you and track your behaviour. Some of them like disabling JS might even protect you from some other attacks.

To even hide your real IP (which can be used to identify you as real person with the help of your Internet Service Provider), there are two common ways, browse through a VPN (few free offers, but often you need to pay unless you are okay with very restricted bandwidth and data volume - and you must ultimately trust the company to protect your traffic and identity) or TOR (free and secure, but slow).

There are tons more advices how you can leave less traces on the web, but if you have read this far, I'm already really proud of your stamina and don't want to bother you much longer. Research the topics that caught your interest on the web or leave a comment to ask about a particular clarification.

You may also want to view my answers to these security questions:

  1. How to secure my laptop so that hacking by physical access is not possible?
  2. Is Linux getting less or more secure?
  • this is by far the most beautiful thing I've ever seen. – TheCodingKlam Aug 18 '16 at 3:11

As for encrypting your files, you can choose to encrypt your home directory (where most of your files are) when you install the operating system.

Hackers don't really target Linux and Ubuntu users because they know that the vast majority of computer users use Windows. As long as you set up a password and check what kind of stuff you download and install, you should be safe! :)

The NSA however, mostly "spies" on you through internet and cell phones, so there isn't all that much you can do about it on Ubuntu. If you want to be really anonymous on the internet you can use the Tor browser (https://www.torproject.org/) and/or use a vpn (https://askleo.com/is-there-any-reason-to-use-a-vpn-at-home/).

But if I were you, I wouldn't worry too much about all that. As long as you set up a password and maybe encrypt your home folder, you should be safe! Good luck! :)

  • 1
    Encrypting the whole partition and the swap would provide better security without the speed penalty of an encrypted home directory. – Andrea Lazzarotto Aug 3 '16 at 23:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.