I'm applying disk encryption to my local machine and I'm storing the key on a usb drive. This means I need the usb drive to be able to boot. This got me wondering, I've heard about different osses providing encryption, Ubuntu, OS X, Windows. From what I understand, people don't need to authenticate pre-boot, they only need to 'log in', everything appears to happen automagically. They don't need to enter an extra passphrase or supply a keyfile.
Doesn't this mean that either: a) the encryption key is stored (unencrypted) on disk, effectively rendering the disk encryption useless or b) the encryption passphrase is the same as the user's password
In the first case, what stops me from pulling the disk, hooking it up to another machine, and using the key to decrypt the disk?
In the second case I don't see how this can be FDE as the os already booted (unless the user's files are on a separate disk). Anyway, what stops me from recovering the user's password (with tools like ophcrack or John)? And will this be enough to decrypt the user's data?
I'm really starting to have some doubts about disk encryption implementations on Ubuntu, OS X, Windows, Android. So, how secure are these actually? And how do these work with such little user interaction?
To be clear; I'm only asking about offline attacks, cold boot attacks or DMA stuff are off the table.