I'm wondering how secure is the hard disk on the Steam Deck.
It's a portable device one could easily lose... or get stolen, given how on-demand it is.
And you also have to consider that "it's a PC", someone could be using it with Google Chrome and have all their private passwords and accounts synced in there.
Would there be any sort of encryption by default or any other form of protection?
Posted Mar 1, 2022, 11:28 AM UTC
I'm pretty sure it was Phawx who got asked about full disk encryption while he was showing the BIOS during his FAQ so the option is there. How it works for unlocking the disk during boot-up, I have no idea. Bear in mind that even with FDE once it's unlocked, it won't automatically be locked when you suspend the device. As far as UI goes, several reviewers were also surprised when asked by the fact that there wasn't any way to lock the Deck other than logging out each time which would prove cumbersome and counter-productive.
I feel like this should've been already implemented in SteamOS by now but I'm sure Valve is on it as we speak and thus it's easily rectified with future SteamOS updates. I wouldn't mind a global option for locking down applications on the desktop side either, but I believe at least you should be able to set a user password and lock it that way if you wanted.
My partner and I are both going to be using my Deck as a desktop from time to time so will be logged into all kinds of sensitive stuff. At a minimum we'd need an option to select user at boot and require a pin to log in in order to do this safely (cause otherwise if the Deck gets stolen one day then we'd have all our emails and stuff accessible to the thief not to mention the Steam accounts themselves.)
Yeah I didn't even bring up the multi-user angle -- is there a way to switch between Steam accounts quickly and easily now? Are they working on that? Switch has first class multiple user support, I'd love to see the same thing on the Deck.
So far as I know right now it's fairly easy to switch between two accounts but not if you want some sort of sigh in security with it.
[deleted]
The thing is that Linux has a lot of options already available for at least encrypting user data on the filesystem level. I expect it would not be too hard to make use of an encrypted fs for the user's home partition, for example.
I imagine it could be harder to make use of those tools if they are not already part of the base system, since the OS is based on a read-only image.
It would give Valve be a lot of bad rep if something serious happened because of this and it broke the news.
[deleted]
I wasn't invalidating your statement.
My statements are still valid too, you did not address them. It would give the device a bad rep if there are serious leaks, it would be harder to do it on the user-side and Valve is even recommending Google Chrome as non-Steam app, which might make it look like it's safe for people to use to login in different websites.
In the end this just limits what the user can safely do with the device in a way that is not obvious.
[deleted]
usuallly now there is no performance hit with encryption as the encryption algos are built intto at the CPU level
You can also encrypt your /home folder and then simply not store your Steam library in your home folder so there is literally zero performance hit when gaming.
[deleted]
Anti-theft: chain it to yourself.
Encryption: why are you storing anything valuable on a gaming device?
But they put Google Chrome as one of the non-Steam apps they recommend. Anyone logging to Google Chrome with their Google account would be already at risk.
That's actually a good point I didn't think about. Basically every single device you use an Internet browser on is either firmly inside your house, or has a way to lock it with a password or pin or fingerprint or something else. Deck seems like an odd exception.
Maybe this is the reason why the Switch doesn't have a browser?
Switch probably lacking a browser because the 3DS and Wii U both got broken wide open by browser exploits.
Maybe this is the reason why the Switch doesn't have a browser?
I think that was mainly to lock down and control what can run in the device, since browsers are becoming a whole software ecosystem. Consoles like the PS5 also limit a lot the browser even though they aren't portable.
You can even run Retroarch on the browser.
Also, browsers are very complex and it's easy to have a bug there. It wouldn't be the first time there's an exploit that allows hacking the device because of it.
Nah, definitely not considering other Nintendo devices had it as well, just Nintendo being Nintendo...
Yes, but of what? Your Steam login info is not stored in plaintext and there's literally nothing else valuable on that device.
Wieed... Linux users Always talk about liberty and security...
Security: Steam Deck case has storage for accessories so put an apple airtag or equivalent. Encryption: Linux has secure vaults
I know this is a fairly old thread, but I figured I'd throw in another option since all the other replies so far (at least to me) are pretty lackluster.
First thing, you're going to want your encryption to be full disk. You never know how many apps and background processes are generating personal data that exists outside of your home folder, like logs and other temporary data for example. That's why experts always agree, full disk is the only way to go. The other problem is that a lot of important config data is on the home folder, and it's quite easily a possibility that encrypting it can cause any number of glitches. When I first used a distro, I tried encrypting the home folder. It ended up breaking my desktop entirely, and I've never used it again.
What I would suggest is using a distro like Tails, and keep it on either an SD card, or some other external storage. You might be able to get away with not using a keyboard since most desktops have a built in virtual keyboard in their accessibility settings, but you'll likely find it to be a bad experience.
By using a separate distro on external storage you can 1) keep your SteamOS install nice and clean, avoiding possible headaches. 2) Keep your data more secure because you can keep it with you at all times, meaning you might still have it even if your Deck gets stolen or surreptitiously accessed. And 3) if for whatever reason it stops working on the Deck, you can just plug your distro into a different computer and still use it.
Oh thank you for letting me know about Tails! I shall check that out.
About encrypting the full disk... that's a good point, though in the case of the Steam Deck, the root partition is read-only, so (unless you go out of your way to change that) it's not really possible for apps and background processes to write any personal data there since you'd get IO errors when attempting to change anything there.
I'm aware of SteamOS's immutable root system. That would be a complete non-issue for something like Tails, or any other 'live system.' Tails exists as a completely separate OS that's entirely on a different storage device. In other words, Tails leaves your SteamOS completely alone, and SteamOS leaves Tails completely alone too.
All you have to do is get Tails flashed to a separate storage device, and then load up your bootloader to set it to boot up that storage instead of the main storage.
Yes, I know Tails (or any 'live system') can be used with no problems just like in any other computer. You won't be really using your computer's OS (or Steam Deck's in this case). That's not what I was looking for, but I was thanking you for letting me know about Tails. It's an interesting project!
I was referring to what you said here:
First thing, you're going to want your encryption to be full disk. You never know how many apps and background processes are generating personal data that exists outside of your home folder, like logs and other temporary data for example.
Temporary data and logs can't be part of a partition mounted as read-only. Programs literally can't write there so if they tried it would result in errors. Of course, that kind of data should also either be part of the writable encrypted partition (using something like overlayfs to be on top of the read-only one, which seems to be what Steam OS ended up doing... just not encrypted) or at least be in a tmpfs that does not survive a power cycle (what archlinux normally does for /tmp).
encase in concrete, no one will be able to mess with it then.. hmm well.. unless the wifi still works and they can ssh in.. erm.. ok
encase in concreate and a faraday cage, and drive to the middle of the ocean and throw it in.. Now its completely secure!! hmm.. unless aquaman exists..
It's spelled concrete
Thanks
100% security: Run it over with a bulldozer so it's worth nothing to anyone.
[removed]
The security system I will apply is to constantly pay attention and simply not lose it.
A password would not fix the stealing.
And if it were stolen. Just quickly change your steam account password and call it a day.
Well first of all password managers that don't require a password every time are not safe in the first place if the OS is not locked down enough, and PC OSs aren't (they have to store some kind of decryption key somewhere, invalidating the security of it. Chromium on linux for me asks me to unlock the kde wallet, so it might be ok)
Full disk encryption might be an option though
Oh, if the KDE wallet works on Steam OS mode (outside desktop mode) then that would be a good security measure.
Yeah, that or an alternative would be the best. Full disk encryption second, because you probably don't want that on most of the stuff, and the files are still accessible from another program after you have logged in
Oh, I didn't mean "full" disk encryption. It would make no sense to encrypt the read-only partition, since it's public data anyway.
Even the SteamLibrary folder with all the downloaded games could be a mountpoint for its own separate partition, unencrypted. And the SD cards obviously shouldn't be encrypted either.
My concern is the home folder, where configuration, saves and general user data from the applications is stored.
its a linux machine so in theory you can encrypt the drive at boot, im not sure if this is supported on the steam deck
Yes, this is what I would like to know, whether it's possible or not while keeping up with official Steam OS updates.
Since the root system partition (not the user partition) is meant to be kept read-only and changes get overriden on update I'm afraid it would cause trouble if you update the OS after having done such a change.
Well an encrypted machine would 100% work with SteamOS updates. The PC boots > you enter decryption code that unlocks the PC > then it can boot into linux and does whatever. Windows is encrypted, as is macosx and so is linux, and they work fine with updates.
Regardless of whether the root parition is read-only or not. That doest matter. All the Computer sees when it boots is a door, and it needs the key, once you unlock the door, the entire machine is unlocked until it is shutdown.
I think perhaps you dont have a deeper understanding about operating systems.
The main issue, is there is no keyboard, so how do we type in the password at the bootloader or start of the boot level? What kind of password would it accept etc.
I want to encrypt the user home partition (no point encrypting the read-only partition, it has no user data).
That is done using dm-crypt on systemd, right? (asuming they didn't change Manjaro too much).
Normally for that I think you have to write on /etc/crypttab and change some other things like adding hooks in mkinitcpio.conf which I expect would be part of the read-only filesystem.
Wouldn't that be overriden when an update comes?
I think with the bootloader you can decrypt and load the root partition, but I'm not sure what will happen when then the root attempts to mount a home partition without being aware of the encryption. I expect the system will boot but then it'll be unable to mount your user home data.
[deleted]
Two things to keep in mind.
The steamdeck is windows 11 ready, consequently the apu in the deck has an ftpm, like the regular chips do.
linux encryption can use the TPM for storing the keys.
So, it can probably be seamless. But I have very little experience with encrypting drives and/or file systems in linux.
I think you can use PAM facilities so that the same login for the user can unlock the partition. Then you only need to login once.
Also I believe Valve is experimenting with ways to login so you don't even need to enter your login & password: https://www.pcmag.com/news/report-valve-is-working-on-qr-code-logins-for-steam-steam-deck
I used to have my disk encrypted at the bootloader level and the encryption key stored on a USB flash drive that was part of my key chain. So stealing my laptop would be pointless, it wouldn't even boot without the key inserted. Something like that may work on the Deck -- but it would also mean you'd have an occupied USB port at least until the deck is booted up.
[deleted]