3 ms·

This is what I set on my MBP (equipped with SSD): sudo pmset -a hibernatemode 25 destroyfvkeyonstandby 1 sms 0

by cyann 15y ago

droithomme 15y ago
Thanks, that is very useful, I was wondering why it didn't scrub it from memory when it sleeps. Article discussing this setting and providing links to a free and open forensic library so people can actually test the FW memory search method themselves, yanking passwords straight off of their friends laptops as a fun party trick or what not: http://www.frameloss.org/2011/09/18/firewire-attacks-against-mac-os-lion-filevault-2-encryption/ http://www.frameloss.org/2011/09/18/firewire-attacks-against...
- ryannielsen 15y ago
  It's not scrubbed from memory on short term sleep so the OS can provide a more user friendly experience – rather than dropping you at the EFI login window when you wake from sleep, you'll be presented with the more capable and better looking OS sleep unlock window. If the machine is asleep for "a while" then it will write out a sleep image file and power off RAM (and other hardware) to go into a deep sleep. Since the sleep image file is written to the FDE volume, you must first unlock the volume at EFI's login window to gain access to the sleep image and resume from sleep. That process takes far longer than waking from a warm OS, so it's not done by default. You can change sleep settings using pmset on the command line and force it to always destroy the FV keys on sleep, if security is more important that a quick wake from sleep.
  - droithomme 15y ago
    Yes, I switched the pmset settings after reading the article I linked to that discussed his settings and making the comment. Benchmarking it shows that with all programs quit and hibernatemode at 25, it takes around 2 seconds to enter RAM-off-sleep and 8 seconds to awaken from it, rather than both happening instantly with RAM-on-sleep. It's not really all that slow, I wouldn't say it's all that noticeably longer. It's kind of an impressively fast memory dump and restore.

This is what I set on my MBP (equipped with SSD): sudo pmset -a hibernatemode 25 destroyfvkeyonstandby 1 sms 0

by cyann 15y ago

This is what I set on my MBP (equipped with SSD): sudo pmset -a hibernatemode 25 destroyfvkeyonstandby 1 sms 0

Thanks, that is very useful, I was wondering why it didn't scrub it from memory when it sleeps. Article discussing this setting and providing links to a free and open forensic library so people can actually test the FW memory search method themselves, yanking passwords straight off of their friends laptops as a fun party trick or what not: http://www.frameloss.org/2011/09/18/firewire-attacks-against-mac-os-lion-filevault-2-encryption/ http://www.frameloss.org/2011/09/18/firewire-attacks-against...

ryannielsen 15y ago
It's not scrubbed from memory on short term sleep so the OS can provide a more user friendly experience – rather than dropping you at the EFI login window when you wake from sleep, you'll be presented with the more capable and better looking OS sleep unlock window. If the machine is asleep for "a while" then it will write out a sleep image file and power off RAM (and other hardware) to go into a deep sleep. Since the sleep image file is written to the FDE volume, you must first unlock the volume at EFI's login window to gain access to the sleep image and resume from sleep. That process takes far longer than waking from a warm OS, so it's not done by default. You can change sleep settings using pmset on the command line and force it to always destroy the FV keys on sleep, if security is more important that a quick wake from sleep.
- droithomme 15y ago
  Yes, I switched the pmset settings after reading the article I linked to that discussed his settings and making the comment. Benchmarking it shows that with all programs quit and hibernatemode at 25, it takes around 2 seconds to enter RAM-off-sleep and 8 seconds to awaken from it, rather than both happening instantly with RAM-on-sleep. It's not really all that slow, I wouldn't say it's all that noticeably longer. It's kind of an impressively fast memory dump and restore.