Hacker News new | past | comments | ask | show | jobs | submit login

What do Windows/Mac/Linux do?



Key is in memory at all times after boot on all of those.

Full disk encryption is only useful on a laptop if the device is powered down fully.


That sounds like a security issue. Why are disk encryption keys not evicted in sleep mode? Seems like no apps should be running in sleep mode?


On Linux this is adressed by systemd-homed, which encrypts at least your home partition in sleep mode. Attackers could still try to manipulate the rootfs & hope the user doesn't detect it before using the device again.


It is a major security issue, and one of the reasons people running around with production access on laptops is insane.

It is hard to fix this too, because almost no background desktop processes behave well when they are suddenly unable to write to the disk.

Even if you solved that, your password manager has keys in memory, your browser has cookies in memory, etc etc.


Mac seems mote secure in sleep:

"If your Mac has the T2 Security Chip (recent Intel-based Macs) or uses an Apple silicon chip (M1 family and future), security is significantly improved. The Secure Enclave in both systems uses encrypted memory, and has exclusive control over FileVault keys. The Intel CPU or the Application processor (M1) never sees the keys, and they are never stored in regular (unencrypted) RAM. Due to this, an attacker would only be able to extract encrypted keys (which can't be decrypted), and only if the system failed to prevent the DMA attack in the first place. These protections make it a lot safer to leave your Mac asleep."

From https://discussions.apple.com/thread/253568420


The most valuable information for an adversary is typically found in Ram. Like your password manager master password, browser cookies, etc. Ram can be dumped easily with the right equipment.

The only safe encryption is on a powered down device.


Sleep mode could suspend all activity? You could encrypt all memory before sleep?

It doesn't seem unsolvable, as long as sleep (closing lid) suspends all activity.

(lock with background activity is different, lets discuss the sleep case)


If you fully hibernate to disk where it encrypts the memory snapshot to your FDE key, then you are good to go but that is not locking that is turning the computer off.


> Key is in memory at all times after boot on all of those.

I would think it would have to be while the device is mounted and OS locked, but surely if you dismount a secondary disk/container the key is purged?


As long as that secondary disk uses a different FDE key and you manually unmount it. This is easily done with LUKS on Linux but YMMV on other operating systems




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: