Background: I’m a mobile app developer, and I’m using my notebook (a MacBook Air) for writing apps.

For some reasons I have to put my notebook at a location that is not completely secure (i.e. I can’t fully trust those who have physical access to it). Let’s assume that they can do almost anything to it, although some attacks are unlikely, especially for those which require large costs (see below).

I usually pay attention to keyboard smudges (oil residue on keys after I enter passwords) and remove them before anyone can have access to the keyboard. However, today I suddenly remembered that I forgot to do so.

Several conditions are met:

  1. Indeed I entered the password during my last use. I’m not sure whether the smudges on the keys are obvious enough for others to retrieve the password.

  2. Before/After entering the password, I typed other stuffs (e.g. brew update, brew upgrade libreoffice etc). I’m also not sure whether these obfuscations are enough to, say, “hide” my password.

  3. The password is not very long (sufficiently long, like more than 8 characters with both alphabets and digits). It is a passphrase that is composed from several (I can’t tell how many) dictionary words. I’m not sure whether attackers can guess my password from the smudges.

  4. I’ve logged out the system, and the data on the SSD are encrypted (with FileVault 2).

  5. After all, I’m not going to make the system against attacks that can’t be avoided (e.g. the notebook was replaced with a fake one and attackers wait for me to enter the password on their system).

Note that, if there is a reasonable (no matter how small) chance the system is tempered, I’m going to take further actions (e.g. wipe and reinstall the system). I’m assuming that doing so is troublesome (which takes a lot of time and efforts, like 5 hours to reinstall the system, download software etc) but feasible (e.g. I backup my data frequently, like on GitHub). As a programmer, I treat information security seriously.

Are there any attack vectors that I’m not aware with, and for those I’m aware with, do they make my system insecure/do I need to worry about them?

  • 2
    I don't have time to write out a full answer, but you should very much be worried about evil maid attacks: schneier.com/blog/archives/2009/10/evil_maid_attac.html Replacing your computer with a fake to get your password is the last thing I'd be worried about: there are much easier and more effective attacks you can do if you have sufficient time with the computer in your possession. In fact, I would almost venture to say that if an attacker has physical access to your computer for any amount of time, it's not really your computer anymore – Conor Mancone Jun 4 '18 at 13:33
  • Hey! Can I suggest using Yubikey or a similar access mechanism instead of a password? Conor's reference and comments are a great starting point, I'd suggest researching session recording as well, plus profile encryption. – Milen Jun 4 '18 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.