Re: Laptop encryption experiences

[Rich Graves <rgraves () CARLETON EDU>]

> And don't forget that "suspend" or "hibernate" is *not* a power-off.  This
> is particularly important for those laptop users who almost always suspend,
> and only actually power off or reboot every few months, if at all.

If your encryption suite synchronizes passwords with login passwords, which
is true of most; and if you effectively enforce a policy of lock-on-sleep;
then I'm not sure how much real difference there is.

I don't consider cold-boot attacks a real-world threat against my class of
users. They require non-trivial preparation, expertise, and luck. Networked
attacks are possible, though it has been a while since there was a classical
remote exploit effective against our default desktop firewall policy. I'm
not sure how possible FireWire memory injection/extraction attacks are
nowadays.

For the thief, booting from an alternate OS is far less work, and usually
more effective, than any of the above attacks. Faced with a logon screen
that makes no reference to FDE, why would they go to the trouble of mounting
an online attack? I'd just pop in a boot CD, say "*&%@*@, it's encrypted,"
and wipe/resell the hardware.

If it's a targeted attack, they might have foreknowledge of the encryption
used. So we tell people to hibernate if they have top-secret data or if
they're going to an airport. Otherwise, I don't think it's worth waiting for
wake-from-hibernate every time they move between conference rooms.

If you balance the risk/benefits differently, why?
-- 
Rich Graves http://claimid.com/rcgraves
Carleton.edu Sr UNIX and Security Admin
CMC135: 507-222-7079 Cell: 952-292-6529