Re: password-store /dev/shm mfs

On Wed, Aug 12, 2026 at 07:59:40AM -0600, Andy Bradford wrote:
> Thus said Janne Johansson on Wed, 12 Aug 2026 14:39:59 +0200:
> 
> > That is correct, and if ever mfs contents get swapped out, the swap on
> > openbsd is always  encrypted by a per-boot random key,  so noone could
> > dig it out  of the swapdevice on  the next boot even if  you don't use
> > FDE.
> 
> Are you sure?  It seems the default is:
> 
> #vm.swapencrypt.enable=0        # 0=Do not encrypt pages that go to swap

This is just a line from /etc/examples/sysctl.conf, not a default.

And it's commented out anyway, so even if somebody naively copied the example
file to /etc/, that line would not disable it.

And there are other, (commented out), lines in that example file that don't
match default behaviour.