Can the Meltdown and Spectre vulnerabilities affect also computers with encrypted home directory and usage of a VPN service? In Other words, would hackers still be able to steal passwords when encrypted transmissions and VPN services are implemented?
Disk encryption protects against access to the disk when it is not in use, for instance if someone steals your computer. VPN protects against anyone sniffing the wire.
Meltdown and Spectre can give attackers local access to the data, before it is encrypted.
For the system to use any kind of information, it more or less has to be available in un-encrypted form. Whenever it is available in un-encrypted form any attacker with superuser access to the computer can copy it at will.
Yes, in fact this is one of the hypothetical situations where these vulnerabilities might be attacked: when using encryption and trying to access the in-memory encryption key normally unavailable to other processes.
Yes. It might allow an attacker, say, by you visiting his website, to read memory of apps you have currently running. The memory content could be cookies to website you're currently logged in, saved passwords in your password manager, configuration of your VPN connection or even an encryption key you use for home directory.
On the other hand if you're 100% sure you're not going to run any 3rd party code (by downloading some untrusted software or running a browser/visiting websites), you're pretty much save. Actually that's the Microsoft's view on that matter: they assumed most Windows Server instances run in an "isolated" environment, where users put only trusted apps, so Meltdown/Spectre fixes aren't needed to be enabled there on default.
Yes. Encrypting your disks and network connections still leaves your entire random access memory readable by a malicious process running on the same computer. Local storage, network traffic, and RAM are 3 completely different things.
The vulnerabilities allow reading data from other programs, so if any other program has the unencrypted data, a malicious program can read it. So if you type your password into another program, your password can be stolen. Moreover, if you access any encrypted data, then it has to be unencrypted for you to see it, so it can be stolen. Depending on how your disk encryption works, data on your disk may be unencrypted even if you don't directly access it. If you're using end-to-end encryption, such as a VPN, well, your computer is an end, so the data is being unencrypted once it gets to your computer, so it's vulnerable.
If you have an encrypted file, and the password is not stored on your computer, and you don't ever access it, then the unencrypted data is not vulnerable (unless the encryption can be otherwise broken). But as soon as you mount an encrypted drive, it's vulnerable.