On Wed, Aug 12, 2026 at 07:59:40AM -0600, Andy Bradford wrote: > Thus said Janne Johansson on Wed, 12 Aug 2026 14:39:59 +0200: > > > That is correct, and if ever mfs contents get swapped out, the swap on > > openbsd is always encrypted by a per-boot random key, so noone could > > dig it out of the swapdevice on the next boot even if you don't use > > FDE. > > Are you sure? It seems the default is: > > #vm.swapencrypt.enable=0 # 0=Do not encrypt pages that go to swap
This is just a line from /etc/examples/sysctl.conf, not a default. And it's commented out anyway, so even if somebody naively copied the example file to /etc/, that line would not disable it. And there are other, (commented out), lines in that example file that don't match default behaviour.
