

Suppose you’re in some hypothetical country where torrenting is illegal. The presence of /usr/bin/qbittorrent on your disk could be enough to face charges. Unencrypted /var/log? Maybe they can see you’ve been running a cryptocurrency miner. There could be plenty of data outside of $HOME on your computer which a cop might try to use against you.
In the most paranoid hypothetical scenario, someone could mount your unencrypted /usr/bin and replace openssl with a compromised version.











What I’m getting at is that for people using FDE, any performance hit is worth it compared to worrying that you’ve covered every angle.