Re: Securing your Laptop on the go

From [email protected]:
> Ctrl-alt-f2
>
> cat << EOF >> /etc/X11/xorg.conf
>     Section "ServerFlags"
>             Option "DontZap"      "True"
>             Option "DontVTSwitch" "True"
>     EndSection
> EOF

After reading xorg.conf(5), I do not see how DontZap will really help,
unless I am using startx(1) to start X (after logging in from the TTY).

DontVTSwitch, makes it so that after the laptop is awake, you are unable
to switch to another TTY, then again I'm not sure how that would help
either. I have come across some situations in use, when I had to resort
to using ctrl+alt+f2 to resque something in my system. I don't think
I should really disable VTSwitch. But I will wait for your response on
this before deciding.

---

From Kevin Chadwick:
> Usually the way such as on Windows is to use hibernate but Linux has
> issues here such as kernel modules and initrd and enabling secure boot
> has disabled hibernate on Debian for a number of years now when it was
> supposed to be for a short while. I'm not sure about the situation on
> OpenBSDs hibernate. There are also firmware attacks to consider too.

I mentioned "faster access" and I think that is quite important. For me
booting up takes a long time, and I honestly consider the stress on the
SSD too.

About firmware attacks, I know about someone re-writting the bios after
stealing it, with the possibility of doing a remote attack of some kind
but, because I already know about this, the first thing after receiving
a stolen device I will definitely use a burner SSD, and update the bios
to the stock one immediately or a Rpi pico, with flashrom, and write the
original stock bios that I have saved. I'm not sure if this is enough,
but I think it is.

---

From Stuart Henderson:
> Importantly for this situation, with FDE you need to unlock the disk
> again before you can reach the hibernated kernel and saved memory,
> whereas with sleep the memory is kept alive, so if someone does come
> up with a way to access it, it's unencrypted.

Yes the "memory is kept alive" but I certainly want to know "a way to
access it" so I can prevent it.

Hibernation is not really helpful for me for how slow my booting times
are considerably, and I want to keep it to sleep when I am on the go.
However if the cons win over the pros, then I will consider using
hibernation from now on.

Thanks for all the replies!