On 2026-08-18, Kevin Chadwick <[email protected]> wrote: > > > -------- Original Message -------- > >> I have a OpenBSD 7.9 with FDE setup on my laptop. In userspace I have >> on /etc/apm/resume, xlock to lock the screen on resume. When I am on >> the go, I keep my laptop in sleep mode for faster access. And I was >> wondering if there any security holes with this setup? If an attacker >> got my laptop, and wake it from sleep, will they be able get the >> decrypted information from my storage or memory some way I do not >> know of? >> >> Both my FDE and user/root passwords have high entropy. >> >> How would you secure your laptop on the go? If your threat model is >> is just theft and brute-forcing? > > Usually the way such as on Windows is to use hibernate but Linux has issues > here > such as kernel modules and initrd and enabling secure boot has disabled > hibernate on Debian for a number of years now when it was supposed to be for a > short while. I'm not sure about the situation on OpenBSDs hibernate. There are > also firmware attacks to consider too.
Hibernate is not too bad on OpenBSD, it works on quite a few machines. There are some performance improvements on the horizon too. Importantly for this situation, with FDE you need to unlock the disk again before you can reach the hibernated kernel and saved memory, whereas with sleep the memory is kept alive, so if someone does come up with a way to access it, it's unencrypted. -- Please keep replies on the mailing list.
