Background: I’m a mobile app developer, and I’m using my notebook (a MacBook Air) for writing apps.
For some reasons I have to put my notebook at a location that is not completely secure (i.e. I can’t fully trust those who have physical access to it). Let’s assume that they can do almost anything to it, although some attacks are unlikely, especially for those which require large costs (see below).
I usually pay attention to keyboard smudges (oil residue on keys after I enter passwords) and remove them before anyone can have access to the keyboard. However, today I suddenly remembered that I forgot to do so.
Several conditions are met:
Indeed I entered the password during my last use. I’m not sure whether the smudges on the keys are obvious enough for others to retrieve the password.
Before/After entering the password, I typed other stuffs (e.g. brew update, brew upgrade libreoffice etc). I’m also not sure whether these obfuscations are enough to, say, “hide” my password.
The password is not very long (sufficiently long, like more than 8 characters with both alphabets and digits). It is a passphrase that is composed from several (I can’t tell how many) dictionary words. I’m not sure whether attackers can guess my password from the smudges.
I’ve logged out the system, and the data on the SSD are encrypted (with FileVault 2).
After all, I’m not going to make the system against attacks that can’t be avoided (e.g. the notebook was replaced with a fake one and attackers wait for me to enter the password on their system).
Note that, if there is a reasonable (no matter how small) chance the system is tempered, I’m going to take further actions (e.g. wipe and reinstall the system). I’m assuming that doing so is troublesome (which takes a lot of time and efforts, like 5 hours to reinstall the system, download software etc) but feasible (e.g. I backup my data frequently, like on GitHub). As a programmer, I treat information security seriously.
Are there any attack vectors that I’m not aware with, and for those I’m aware with, do they make my system insecure/do I need to worry about them?