4 ms·

I'm intrigued by the idea that he had to close his laptop and law enforcement had to prevent that. Is there a widely available dead-man's switch that, say, logs

I'm intrigued by the idea that he had to close his laptop and law enforcement had to prevent that. Is there a widely available dead-man's switch that, say, logs the user out when contact is lost? It seems like the privacy-focused would benefit from such a device. I'm envisioning a USB fob, attached to a bracelet, that triggers logout when it's disconnected, so by raising your hands, you've logged out.

ctrl_freak 13y ago
Couldn't that be accomplished with a bluetooth connection from your mobile phone? Maybe not as effective as a bracelet, but it probably could have gotten the job done in this case.
EthanHeilman 13y ago
> I'm envisioning a USB fob, attached to a bracelet, that triggers logout when it's disconnected, so by raising your hands, you've logged out. This exists, it is called pamusb[1] and it allows you to automatically log in and log out using a usb stick. It would be simple to add password as well. The problem is, if your machine is still powered on, they can patch into the PCI bus and dump your RAM using DMA[2]. Most disk encryption stores the master key in RAM, so if they can dump your RAM they can decrypt your harddrive. GAME OVER! You really want something that cuts power to your laptop so all state is lost. It's not hard to build such a thing: 1. Setup your laptop to use full disk encryption, 2. remove the battery from your laptop, 3. pull the power cord to "instantly log out". One could even attach a string from the power cord to the door so that the laptop loses power if the door is opened. Cold-boot attacks[3], where they remove your RAM before it loses state, could be a concern, but they would have to disassemble your laptop very very quickly (within 30 seconds, perhaps longer if they just threw the laptop into a tub of liquid nitrogen). A counter measure would be to epoxy your laptop together to prevent quick disassembly (or use a macbook air those things are impossible to take apart quickly and the RAM is soldered in place). It should be standard operating procedure to randomly overwrite all non-OS data stored RAM when a user logs out. Maybe someone with most experience in disk encryption can tell me which products do this. [1]: http://pamusb.org/ http://pamusb.org/ [2]: http://en.wikipedia.org/wiki/DMA_attack http://en.wikipedia.org/wiki/DMA_attack [3]: http://en.wikipedia.org/wiki/Cold_boot_attack http://en.wikipedia.org/wiki/Cold_boot_attack
- mikeash 13y ago
  A MacBook Air isn't really hard to take apart if you have the magic screwdriver. The RAM being soldered would probably be a serious obstacle, though.
- Everlag 13y ago
  I generally prefer the idea of a thermite charge planted on the ram. Cold boot? Try that when the dram goes from 40 to 300 in two seconds. Then again, encrypting your drive and making sure the encryption key is safe might be slightly more sane than turning your macbook into a puddle of aluminium.
- codys 13y ago
  Linux has functionality to wipe encryption keys from memory (and require their re-entry) without unmounting the encrypted filesystem (see "luksSuspend" in the cryptsetup man page). Unfortunately, I don't know of any screen locks that automatically tie into it.
- dia473 13y ago
  [2] is not really an issue: http://www1.informatik.uni-erlangen.de/tresor http://www1.informatik.uni-erlangen.de/tresor
  - EthanHeilman 13y ago
    Tresor is really cool but most disk encryption stores the master key in RAM. * Even assuming that your master encryption key can't be extracted from RAM, coldbooting is still a threat. For instance they get anything in RAM (files being edited, program state, passwords, emails, web cookies). Maybe you played a RAM intensive video game that overwrote everything or perhaps you just finished writing a quicken books entry for your counterfeiting operation. Do you feel lucky? * You can patch your kernel so that DM-crypt uses Tresor, so it is possible. I don't know how it handles the inode keys. http://www1.informatik.uni-erlangen.de/tresor?q=content/readme http://www1.informatik.uni-erlangen.de/tresor?q=content/read...
midas007 13y ago
So a friend that worked at DIA says .gov and .mil gear often contains acid in glass surrounding drives and circuits. (Thermite is just in the movies.) What a security-conscious user really needs is laptop storage that can be quickly destroyed. An SSD would be the easiest to destroy with a strong acid or base (fuming nitric acid will just decap the epoxy). Perhaps someone here knows which would work best.
- Intermernet 13y ago
  ".gov and .mil gear often contains acid in glass surrounding drives and circuits." Couldn't you just turn the circuit upside down and use a diamond tip drill (Dremel would do) to drain the acid? I think sticking with full disk encryption would be a more reliable choice.
  - beagle3 13y ago
    > Couldn't you just turn the circuit upside down "surround" in my dictionary means all directions. Didn't even Dell sell servers with a small amount of explosives so that the disk and memory go boom on unauthorized open? (amount comparable to the amount in in airbag -- yes, your airbag has explosives) At least one of the brand names did, as I recall.

ctrl_freak 13y ago

Couldn't that be accomplished with a bluetooth connection from your mobile phone? Maybe not as effective as a bracelet, but it probably could have gotten the job done in this case.

EthanHeilman 13y ago

> I'm envisioning a USB fob, attached to a bracelet, that triggers logout when it's disconnected, so by raising your hands, you've logged out. This exists, it is called pamusb[1] and it allows you to automatically log in and log out using a usb stick. It would be simple to add password as well. The problem is, if your machine is still powered on, they can patch into the PCI bus and dump your RAM using DMA[2]. Most disk encryption stores the master key in RAM, so if they can dump your RAM they can decrypt your harddrive. GAME OVER! You really want something that cuts power to your laptop so all state is lost. It's not hard to build such a thing: 1. Setup your laptop to use full disk encryption, 2. remove the battery from your laptop, 3. pull the power cord to "instantly log out". One could even attach a string from the power cord to the door so that the laptop loses power if the door is opened. Cold-boot attacks[3], where they remove your RAM before it loses state, could be a concern, but they would have to disassemble your laptop very very quickly (within 30 seconds, perhaps longer if they just threw the laptop into a tub of liquid nitrogen). A counter measure would be to epoxy your laptop together to prevent quick disassembly (or use a macbook air those things are impossible to take apart quickly and the RAM is soldered in place). It should be standard operating procedure to randomly overwrite all non-OS data stored RAM when a user logs out. Maybe someone with most experience in disk encryption can tell me which products do this. [1]: http://pamusb.org/ http://pamusb.org/ [2]: http://en.wikipedia.org/wiki/DMA_attack http://en.wikipedia.org/wiki/DMA_attack [3]: http://en.wikipedia.org/wiki/Cold_boot_attack http://en.wikipedia.org/wiki/Cold_boot_attack

mikeash 13y ago
A MacBook Air isn't really hard to take apart if you have the magic screwdriver. The RAM being soldered would probably be a serious obstacle, though.
Everlag 13y ago
I generally prefer the idea of a thermite charge planted on the ram. Cold boot? Try that when the dram goes from 40 to 300 in two seconds. Then again, encrypting your drive and making sure the encryption key is safe might be slightly more sane than turning your macbook into a puddle of aluminium.
codys 13y ago
Linux has functionality to wipe encryption keys from memory (and require their re-entry) without unmounting the encrypted filesystem (see "luksSuspend" in the cryptsetup man page). Unfortunately, I don't know of any screen locks that automatically tie into it.
dia473 13y ago
[2] is not really an issue: http://www1.informatik.uni-erlangen.de/tresor http://www1.informatik.uni-erlangen.de/tresor
- EthanHeilman 13y ago
  Tresor is really cool but most disk encryption stores the master key in RAM. * Even assuming that your master encryption key can't be extracted from RAM, coldbooting is still a threat. For instance they get anything in RAM (files being edited, program state, passwords, emails, web cookies). Maybe you played a RAM intensive video game that overwrote everything or perhaps you just finished writing a quicken books entry for your counterfeiting operation. Do you feel lucky? * You can patch your kernel so that DM-crypt uses Tresor, so it is possible. I don't know how it handles the inode keys. http://www1.informatik.uni-erlangen.de/tresor?q=content/readme http://www1.informatik.uni-erlangen.de/tresor?q=content/read...

midas007 13y ago

So a friend that worked at DIA says .gov and .mil gear often contains acid in glass surrounding drives and circuits. (Thermite is just in the movies.) What a security-conscious user really needs is laptop storage that can be quickly destroyed. An SSD would be the easiest to destroy with a strong acid or base (fuming nitric acid will just decap the epoxy). Perhaps someone here knows which would work best.

Intermernet 13y ago
".gov and .mil gear often contains acid in glass surrounding drives and circuits." Couldn't you just turn the circuit upside down and use a diamond tip drill (Dremel would do) to drain the acid? I think sticking with full disk encryption would be a more reliable choice.
- beagle3 13y ago
  > Couldn't you just turn the circuit upside down "surround" in my dictionary means all directions. Didn't even Dell sell servers with a small amount of explosives so that the disk and memory go boom on unauthorized open? (amount comparable to the amount in in airbag -- yes, your airbag has explosives) At least one of the brand names did, as I recall.