To protect against these threats, should we harden our home computer to protect against these threat?
That depends on the value of the information being processed on the system and who you intend to protect against. There are essentially two physical threats to your home systems:
- Theft. Somebody opportunistically takes your computer system.
- Surveillance, followed by possible theft. When I say surveillance, I mean that in very broad terms - anyone who is able to observe the entry of passphrases for private keys, disk decryption etc can potentially record that entry.
In the case of disk encryption, it is a very good solution for the first case assuming the computer, when stolen, is powered down or the act of stealing it forces it to be powered down (a desktop fits this bill unless the attacker comes prepared with a UPS...).
However, disk encryption cannot protect you from surveillance-based threats. The fundamental assumption of cryptography is that the decryption process is being done in a secure environment; all an adversary needs to do is to see the input of the password in such a way they can record it. There are many techniques to do this (keyloggers, cameras) and a few techniques for avoiding it (multi factor authentication).
Disk encryption also stops protecting your system as soon as the disks are decrypted (power on). The keys are "in memory" and whilst they may not be readable (i.e. in a self encrypting drive where the OS can't reach - it's worth noting the BIOS can because the implementation of self-encrypting drives requires interrupting the boot process of the BIOS) there is absolutely no access control performed by usual whole disk encryption. You can still get a virus and see every file the OS lets you see.
One approach that is harder to break is the approach taken by Encrypted NTFS, namely that the FEK (File Encrypting Key) is encrypted by public keys, thereby implementing a level of access control. However, when you are logged in as the user holding the private key, the same problem occurs.
So in effect, disk encryption does nothing to mitigate the "internet-facing" vulnerability.
Should one use a journalling filesystem?
Yes, purely on the basis you'd have to go to quite a bit of effort to find a file system without journalling. You'd be looking for VFAT (FAT32) or ext2 or some other ancient setup.
Journalling also provides you with significant corruption-avoiding benefits that you want. There's no point in protecting your data only to have the applications you use it with clobber it.
Finally, if the encryption layer you're using can't handle journalling, find a new one. There's no reason that data should reach the disk unencrypted, whether it's in the journal area or actually on storage. That includes the journal meta-data.
Can one password protect all types of memory?
If you are so minded, yes. I'm assuming you mean password protected via encryption here. There's an implementation issue with this level of protection - namely, most crypto services hold keys in memory so that you don't have to re-enter the password every time you want to write to or read from, say, RAM. If you had to do that, you'd find your computer unusable. It would also greatly increase the chance of password observation and is therefore self-defeating.
Applications encrypting their own data, stack and heap variables is not a new idea and will make "scraping ram" harder. However, there are some fundamental problems with this as a defence, namely if another application can read your applications' ram, it has gained access to supervisor mode rings on your cpu (assuming x86/x86_64). If this has happened, it's game set and match to the attacker anyway, so I rarely see the point using encrypted ram. Unless of course you're still using DOS (in DOS, all programs can read the memory of other programs)?
To add icing to the cake on encrypted RAM, the fact is, to encrypt it, your application had to have it unencrypted anyway, also in RAM, which means you're only making it harder, not impossible.
What should I do?
- Use whole disk encryption anyway. This protects your data against theft as in opportunistic thieving and means you can throw the hard disk away and it will be reasonably difficult to extract anything meaningful from it for some time.
Forget about encryption as the ultimate solution and focus on protecting the integrity of your operating system from other forms of attack which are far more likely to steal your data. For example:
- Patch your system. Turn on Windows update, regularly run
yum update or whatever update mechanism you have. When bugs of a security-compromising nature are fixed, make sure you have the patch.
- Only install software you can reasonably trust.
- Reduce things running with Administrator privileges and don't run as an Admin account yourself - i.e. reduce the attack surface.
To be honest, I think a discussion about ensuring secure password entry and physical access to your home computer is probably wandering into the realms of fantasy and is also probably disproportionate to the risk to your data. Most sensitive personal data people hold is also held elsewhere by their doctor, bank, utility company, social networking website etc and your ISP could easily log your internet activity. There is not much you can personally do about the security of that information and it is unlikely all such information is heavily protected, although the more sensitive material (bank account details, etc) usually is.