Linux workstation security checklist
Not the soundest security advice I've read recently:<p>> We recommend that you use the same passphrase for your root password as you use for your LUKS encryption (unless you share your laptop with other trusted people who should be able to unlock the drives, but shouldn't be able to become root). If you are the sole user of the laptop, then having your root password be different from your LUKS password has no meaningful security advantages.<p>Your root password is much easier to steal than your disk encryption password.  Trick the user into running a program that does 'alias sudo=evil-sudo' >> ~/.bashrc, or sniff it from an unrelated X11 window, or use a microphone.  A microphone is far more likely to pick up your root password than a password typed once at boot.  If the root password is sniffed with a microphone, the attacker might not even have root access to your system over the network.  If stolen with evil-sudo or via X11, you might realize you've been compromised before all of your data is exfiltrated.  Neither scenario should let the attacker then steal your disks and be able to decrypt all of your data.  Unless you follow the advice.