Re: Prosecution based on memory forensics

2011-01-16 Thread Werner Koch
On Sat, 15 Jan 2011 00:25, gn...@oneiroi.net said: Discussion, yes - tough one I think. If you mean by that pushing syscall modification to mainstream - it's not mmap already has a lot of flags. Adding another flag value should be an easy task - assuming that one wants to use another bit

Re: Prosecution based on memory forensics

2011-01-16 Thread Sascha Silbe
Excerpts from Werner Koch's message of Fri Jan 14 21:01:45 +0100 2011: It would definitely be helpful because it makes a safe installation much easier. It will be used automagically and thus one does not need to fiddle with suspend scripts. All the password managers would benefit form that

Re: Prosecution based on memory forensics

2011-01-14 Thread Werner Koch
On Thu, 13 Jan 2011 11:50, nils.faer...@kernelconcepts.de said: I could write a very simple driver which provides a mmap()able memory area which the application can use, protected by the kernel, and which will be automatically cleared upon suspend. Would that solve the problem? Yes. How

Re: Prosecution based on memory forensics

2011-01-14 Thread Werner Koch
On Thu, 13 Jan 2011 17:55, ved...@nym.hush.com said: Usually, the screen saver will be activated by the OS well before hibernation begins. Sure, there are a lot of ways to hook into the suspend process. I was talking about a standard signal (SIGABOUTTOSUSPEND) so that gpg-agent could install

Re: Prosecution based on memory forensics

2011-01-14 Thread Nils Faerber
Hi! Am 14.01.2011 09:34, schrieb Werner Koch: On Thu, 13 Jan 2011 11:50, nils.faer...@kernelconcepts.de said: I could write a very simple driver which provides a mmap()able memory area which the application can use, protected by the kernel, and which will be automatically cleared upon

Re: Prosecution based on memory forensics

2011-01-14 Thread Werner Koch
On Fri, 14 Jan 2011 10:06, nils.faer...@kernelconcepts.de said: So, what do you think, would it be worth the effort? If it would help GnuPG and if you would like to use it I would offer to implement it and try to push it upstream. It would definitely be helpful because it makes a safe

Re: Prosecution based on memory forensics

2011-01-14 Thread Milo
Hello. On Fri, Jan 14, 2011 at 09:01:45PM +0100, Werner Koch wrote: On Fri, 14 Jan 2011 10:06, nils.faer...@kernelconcepts.de said: So, what do you think, would it be worth the effort? If it would help GnuPG and if you would like to use it I would offer to implement it and try to push it

Re: Prosecution based on memory forensics

2011-01-13 Thread Werner Koch
On Thu, 13 Jan 2011 05:29, ds...@jabberwocky.com said: So GnuPG can't do this alone, but there are ways to configure GnuPG alongside other packages and/or the OS to be safe(r) here. For example, if you can arrange to run some commands as you are hibernating, you could get gpg-agent to

Re: Prosecution based on memory forensics

2011-01-13 Thread Nils Faerber
Am 13.01.2011 11:39, schrieb Werner Koch: On Thu, 13 Jan 2011 05:29, ds...@jabberwocky.com said: So GnuPG can't do this alone, but there are ways to configure GnuPG alongside other packages and/or the OS to be safe(r) here. For example, if you can arrange to run some commands as you are

Re: Prosecution based on memory forensics

2011-01-13 Thread freejack
When you close a laptop, Windows (or Mac OS X, or Linux, or what-have-you) takes a snapshot of memory contents and writes it to disk. This can be a really big problem, since encryption keys, passphrases, and so forth are written out in the process. For instance, if you have gpg-agent set up

Re: Prosecution based on memory forensics

2011-01-13 Thread Johan Wevers
On 13-01-2011 11:22, freej...@is-not-my.name wrote: This is an OS feature, not a hardware feature. Turn off hibernation. Encrypt your swap file(s) or for Windows, go to system options and turn off swap and reboot in safe mode, defrag your disk and delete any remaining swap file. For Windows,

Re: Prosecution based on memory forensics

2011-01-13 Thread Martin Gollowitzer
* freej...@is-not-my.name freej...@is-not-my.name [110113 11:35]: P.S. Robert, how about trimming your line lengths! Apple Mail sucks at this ;) Martin smime.p7s Description: S/MIME cryptographic signature ___ Gnupg-users mailing list

Re: Prosecution based on memory forensics

2011-01-13 Thread Werner Koch
On Thu, 13 Jan 2011 12:23, joh...@vulcan.xs4all.nl said: For Windows, TrueCrypt has a free open source solution to this in the form of system encryption. Does not help. Despite that we talked about hibernation, most users don't use S4 (Suspend-to-Disk) but the system goes into S3

Re: Prosecution based on memory forensics

2011-01-13 Thread David Tomaschik
On Thu, Jan 13, 2011 at 9:00 AM, Werner Koch w...@gnupg.org wrote: On Thu, 13 Jan 2011 12:23, joh...@vulcan.xs4all.nl said: For Windows, TrueCrypt has a free open source solution to this in the form of system encryption. Does not help. Despite that we talked about hibernation, most users

Re: Prosecution based on memory forensics

2011-01-13 Thread vedaal
Werner Koch wk at gnupg.org wrote on Thu Jan 13 11:39:34 CET 2011 : Things would be easier to handle if the OS would send a special signal to all processes before hibernating. Usually, the screen saver will be activated by the OS well before hibernation begins. Maybe an option could be to

Prosecution based on memory forensics

2011-01-12 Thread Robert J. Hansen
When you close a laptop, Windows (or Mac OS X, or Linux, or what-have-you) takes a snapshot of memory contents and writes it to disk. This can be a really big problem, since encryption keys, passphrases, and so forth are written out in the process. For instance, if you have gpg-agent set up

Re: Prosecution based on memory forensics

2011-01-12 Thread David Shaw
On Jan 12, 2011, at 10:54 PM, Robert J. Hansen wrote: When you close a laptop, Windows (or Mac OS X, or Linux, or what-have-you) takes a snapshot of memory contents and writes it to disk. This can be a really big problem, since encryption keys, passphrases, and so forth are written out in