Hacker News Reader

Comment by timedude | Hacker News Reader

That's kinda stupid. The passwords could get swapped to disk in the swap file in plaintext when memory is low by the OS.

View on HN

You say this as if accessing that file was any easier than accessing memory.

If I have a disk image or access to the physical drive, it's trivial. This means they can no longer be considered encrypted at rest.

If you're on prem or able to manipulate the machine into an OS of your choosing, yes. But with purely remote access to a device the disk is pretty decently secured (even if Window's ACLs are nightmareishly convoluted).

If your computer storage is not fully encrypted you have bigger worries than the swap file.

It is when the computer is off.

And if you whack someone with a wrench until they tell you the password, it's even easier!

Seriously, if someone is getting physical access to the machine to the extent where they can remove the hard drive... I doubt that it makes a difference whether the browser's password manager keeps its passwords encrypted in-memory.

There's a huge difference in physical and criminal liability for stealing a laptop vs kidnapping someone. If tools become widespread for criminals to recover user accounts from an unpowered laptop, there's going to be an uptick in identity theft. When many cities would't even prosecute for the theft of a laptop, almost no one that's willing to steal a laptop is willing to hold someone up, which not only puts the criminal at physical risk of the victim attacking but also could result in decades of incarceration, if caught.

Reply on news.ycombinator.com