Probably not a common scenario right now, but if this threat goes unfixed for a long time and tools become available to automate the attack I could see it becoming a problem.
That's what full disk encryption and (eventually) hardware security chips and the like are for. It's not a threat model that has anything to do with password managers.
>Probably not a common scenario right now
It never can be, that's the point. Physical attacks simply do not scale like purely online attacks do, let alone attacks on centralized single points (ie., a central password database).
>but if this threat goes unfixed for a long time and tools become available to automate the attack I could see it becoming a problem.
What? What tools "automate" stealing your notebook?? And also breaking through whatever physical security it has, like TPM or Apple's T-series chips or even just plain soldered on storage/memory/everything? The latter make repairs more of a PITA but they also make physical attacks significantly more difficult, even stuff like cooling memory and swapping (and encrypted memory based around tamper resistant security chips is a potential thing too).
Not the parent but I assume they meant a tool that traditional laptop thieves with little technical sophistication can use to easily extract valuable data from a machine after they have stolen it.
That only helps if you assume the laptop is fully powered off when it is stolen. If it's on or merely in "sleep" mode, disk encryption doesn't help.
> It never can be
What can never be? Laptops being stolen? A threat doesn't necessarily need to scale to be a problem as long as the gain from individual compromises is sufficient to make it worthwhile.
> What tools "automate" stealing your notebook?
The stealing doesn't need to be automated, just the attack on the password manager itself. A program anyone can download and run on a stolen laptop to extract the password database would be sufficient.
First, I said FDE and hardware security chips like Apple's T2 and mentioned stuff being soldered on and HSM backed encrypted memory. Yes, simple FDE and standard PCs can be subject to physical memory swaps and the like, but that becomes vastly more complicated and difficult with devices that use significant hardware security. This is no different then a modern iPhone, where merely having physical possession, even with the phone not powered off, doesn't mean it's trivial to access the data.
Second, you're engaging in the security fallacy of inventing theoretical attacks without considering economic cost or whether they pass the weakest point test in the threat model. The sort of scenario you've come up with is not that simple and not the sort of thing some random crook is likely to do, which is how this thread was started. But if you're dealing with a targeted physical attack by an actor with significant expertise and resources, there are far more trivial weaker points to go for. For example, they could just stick a pinhole camera looking down at your desk (or anywhere else you frequent with your notebook) and just record your password and avoid the whole mess. None of this has anything to do with password managers.
>What can never be?
Try reading the conversation? I responded to "Probably not a common scenario right now", which implies that it could someday become a common scenario. Ie., an attack that could be scalable. But physical end point attacks are inherently not scalable, just like anything else that requires actual boots on the ground. Resource cost is the framework of all security.
>The stealing doesn't need to be automated, just the attack on the password manager itself. A program anyone can download and run on a stolen laptop to extract the password database would be sufficient.
If the stealing isn't automated then it's not scalable and it's an entirely different scenario. And this makes zero sense anyway. You can't just download and run anything on a stolen quality notebook without breaking it's physical security first, which is increasingly non-trivial. The password manager database has absolutely nothing to do with any of this.
All it takes is for the _exploit_ to be automated (not the actual act of stealing laptops) such that any random person off the street can do it. Then a targeted attack is no longer necessary; crimes of opportunity become the larger threat.
[1]: https://www.digitaltrends.com/computing/microsoft-fixes-cort...
[2]: https://www.theguardian.com/technology/2017/nov/29/macos-hig...
If you have disk encryption you probably also have sleep mode lock the computer. So they still don't have access.
Is this true for Filevault? I know a lot of Mac owners who assume otherwise.
It's not just Mac users, I mentioned this issue in a meeting with an Apple sales engineer last month and he acted like you don't need to turn off a Mac to make it safer (he's not a security engineer so I don't really expect him to know how un/safe a running system with FileVault is). It may well be that the current OS and/or T2 chip makes it very, very hard to access the boot volume of a running Mac without a user's login but there's still a network exploit risk.
DMA access does sound plausible, but how can someone run a remote network traffic attack?
(I personally turned off any "smart wake" type of functionality)