Hacker News Reader

Comment by kevinmchugh | Hacker News Reader

I'm intrigued by the idea that he had to close his laptop and law enforcement had to prevent that. Is there a widely available dead-man's switch that, say, logs the user out when contact is lost? It seems like the privacy-focused would benefit from such a device. I'm envisioning a USB fob, attached to a bracelet, that triggers logout when it's disconnected, so by raising your hands, you've logged out.

View on HN

> I'm envisioning a USB fob, attached to a bracelet, that triggers logout when it's disconnected, so by raising your hands, you've logged out.

This exists, it is called pamusb[1] and it allows you to automatically log in and log out using a usb stick. It would be simple to add password as well. The problem is, if your machine is still powered on, they can patch into the PCI bus and dump your RAM using DMA[2]. Most disk encryption stores the master key in RAM, so if they can dump your RAM they can decrypt your harddrive. GAME OVER!

You really want something that cuts power to your laptop so all state is lost. It's not hard to build such a thing:

1. Setup your laptop to use full disk encryption,

2. remove the battery from your laptop,

3. pull the power cord to "instantly log out".

One could even attach a string from the power cord to the door so that the laptop loses power if the door is opened. Cold-boot attacks[3], where they remove your RAM before it loses state, could be a concern, but they would have to disassemble your laptop very very quickly (within 30 seconds, perhaps longer if they just threw the laptop into a tub of liquid nitrogen). A counter measure would be to epoxy your laptop together to prevent quick disassembly (or use a macbook air those things are impossible to take apart quickly and the RAM is soldered in place).

It should be standard operating procedure to randomly overwrite all non-OS data stored RAM when a user logs out. Maybe someone with most experience in disk encryption can tell me which products do this.

[1]: http://pamusb.org/

[2]: http://en.wikipedia.org/wiki/DMA_attack

[3]: http://en.wikipedia.org/wiki/Cold_boot_attack

A MacBook Air isn't really hard to take apart if you have the magic screwdriver. The RAM being soldered would probably be a serious obstacle, though.

I generally prefer the idea of a thermite charge planted on the ram. Cold boot? Try that when the dram goes from 40 to 300 in two seconds.

Then again, encrypting your drive and making sure the encryption key is safe might be slightly more sane than turning your macbook into a puddle of aluminium.

Linux has functionality to wipe encryption keys from memory (and require their re-entry) without unmounting the encrypted filesystem (see "luksSuspend" in the cryptsetup man page). Unfortunately, I don't know of any screen locks that automatically tie into it.

[2] is not really an issue: http://www1.informatik.uni-erlangen.de/tresor

Tresor is really cool but most disk encryption stores the master key in RAM. * Even assuming that your master encryption key can't be extracted from RAM, coldbooting is still a threat.

For instance they get anything in RAM (files being edited, program state, passwords, emails, web cookies).

Maybe you played a RAM intensive video game that overwrote everything or perhaps you just finished writing a quicken books entry for your counterfeiting operation. Do you feel lucky?

* You can patch your kernel so that DM-crypt uses Tresor, so it is possible. I don't know how it handles the inode keys. http://www1.informatik.uni-erlangen.de/tresor?q=content/read...

Couldn't that be accomplished with a bluetooth connection from your mobile phone? Maybe not as effective as a bracelet, but it probably could have gotten the job done in this case.

So a friend that worked at DIA says .gov and .mil gear often contains acid in glass surrounding drives and circuits. (Thermite is just in the movies.)

What a security-conscious user really needs is laptop storage that can be quickly destroyed. An SSD would be the easiest to destroy with a strong acid or base (fuming nitric acid will just decap the epoxy). Perhaps someone here knows which would work best.

".gov and .mil gear often contains acid in glass surrounding drives and circuits."

Couldn't you just turn the circuit upside down and use a diamond tip drill (Dremel would do) to drain the acid?

I think sticking with full disk encryption would be a more reliable choice.

> Couldn't you just turn the circuit upside down

"surround" in my dictionary means all directions.

Didn't even Dell sell servers with a small amount of explosives so that the disk and memory go boom on unauthorized open? (amount comparable to the amount in in airbag -- yes, your airbag has explosives) At least one of the brand names did, as I recall.

Reply on news.ycombinator.com