I'm in the process of figuring out an encryption strategy for a personal Linux system.

My laptop is almost always on, or in sleep mode, except for longer travels.

My main threats are theft of my laptop while powered on, and evil maid.

It is my understanding that full-disk encryption (using LUKS) will not protect me from my main threats, unless the system is powered off.

Therefore, in addition to full-disk encryption, I should also set up file-based encryption (using VeraCrypt) for areas of sensitive data.

I have no problem with this, but there is one thing I'm at a loss with.

My browser and text editor are always open, and in continuous use. Coincidentally, these are the two domains of my most sensitive data. Even with full-disk encryption and file-based encryption set up, these two domains would almost always be in a decrypted state on a system powered on. Therefore, if someone were to snatch my laptop, with enough sophistication they would be able to access the very domains of my personal data I wish to protect the most.

What is a solution to this problem, or is there one at all?


1 Answer 1


Your first step is to ensure that the system reliably locks when not in use (sleep mode or session lock).

The laptop may be powered on, but at that point the only ways to access the data are network vulnerabilities, very advanced Van Eck phreaking, and hardware exploits (bad USB, HDMI, Thunderbolt, SDXC); all outside of the average thief's or snooper's province. If you're not okay with this, then your evil maid has probably a Shabak badge somewhere in her room, and I'd start researching stand-alone self-destruct deadman devices.

To clarify: when I say, 'hardware exploits', I refer to the knowledge and back-end technology required to deploy and use the necessary hardware devices, not the considerably more difficult task of developing and building said devices. To successfully exploit your Linux PC through a malicious USB MIDI device or similar, your evil maid must not simply be able to purchase a BadMIDI dongle on the dark web, they must know what they're doing and have already gathered intelligence on the target system -- otherwise, the overwhelming majority of hardware exploits will result in a plugged-in thingamajig that does nothing at all, or freezes/damages the laptop not too differently from a way cheaper spilled glass of Coke, or maybe fills the dongle with a capture file full of useless kernel cruft.

We should also assume that the login environment is reasonably secure. A possible way in (I've seen it done) could be high-resolution, high frame rate scan of someone typing their password. There are battery-powered, movement-activated stealth cameras that could do just that, from the chandelier above.

I would also consider a sequestered system somewhere, and accessing it remotely through a VPN. Then the laptop will actually contain nothing of import. That may be awkward and inconvenient, depending on your average work day (there are some places with really poor connectivity, or intermittent connectivity, such as commuter trains), but if you work a lot with your browser then I'd assume your network layer is usually pretty solid.

However, once you trust the powered-on system lock, your next step is how to have it engage automatically. This can be done in several ways, from NFC receivers that recognize your ring (or chain, bracelet, even implanted device - but those are unreliable) to BLE devices - or physical tokens such as Yubikeys and more.

In this case, you would get up and go get a coffee, and the maid would come out from behind the curtains to find the laptop locked, its data unaccessible. Rebooting would fall afoul of the full disk encryption. Crashing out of the X server can also be thwarted (and usually is) by having it fall down to a system prompt, that also requires a login. Stealing the whole laptop won't change things.

At this point you're still vulnerable to, I don't know, memory freeze to recover the crypto keys, but... again, if your attack surface involves people that fiddle with trichloroethane or liquid nitrogen Dewar bottles and the associated memory-raping equipment, you're way more likely to be defeated by rubberhose cryptanalysis.

idle unmount

There are several ways, depending on your window manager, to run a script after some inactivity (or at screen lock).

Let that script run veracrypt --text --dismount, and Bob's your uncle... in theory.

Before that, actually, in practice you should also use fuser or similar methods to determine whether or not there are files open on that volume. And if there are, then you may need to save and close them. For several applications (e.g. LibreOffice) you might make it do with,

xdotool search --name ${WindowTitle} key ctrl+s
sleep 2
xdotool search --name ${WindowTitle} key ctrl+q

(You still need to calculate WindowTitle from your document's name and LO localization).

After that, kill any applications with open files just to be sure, and run the unmount.

  • Thank you for a detailed answer. I suppose my main concern out of these is hardware exploits. I'm under the impression that it wouldn't be that unlikely for someone more sophisticated than the average burglar to carry out such a procedure once the laptop is in their possession. Are you saying that if I consider this a threat then there is no solution other than some form of timed or remote self-destruction? I actually thought about auto-dismounting VeraCrypt volumes after n minutes of idling, but this option is unavailable in VeraCrypt for Linux.
    – CryptGuest
    Mar 21, 2023 at 13:10
  • @CryptGuest it might be unavailable per se, but I believe something can be done. Adding to answer.
    – LSerni
    Mar 21, 2023 at 16:14
  • Thanks, I may look into this, though I'm not sure about this approach on second thought, as this way my browser would have to auto-close after an idle period likely several times a day. I wonder if there is perhaps a way to force shut down a laptop if it is under session lock and new hardware is inserted. Is it, however, safe to say then that there is no way to encrypt data in use, as opposed to data at rest?
    – CryptGuest
    Mar 21, 2023 at 19:49
  • @CryptGuest: What's probably more desirable is to have a sysfs entry that globally freezes all hardware detection, that's set when the screen is locked and unset after providing unlock credentials. As far as encrypting data in use, recent CPUs have features that move the bar so that only data inside the CPU is "in use" and external memory subsystems are considered "at rest", with encryption taking place when the data leaves the CPU. For example see "Intel® Hardware Shield – Intel® Total Memory Encryption" and AMD "Secure Memory Encryption "
    – Ben Voigt
    Mar 21, 2023 at 22:34
  • 1
    As long as the kernel's loadable module loading code respected it, you'd have reasonable protection even in case of non-compliant vendor-specific drivers... an attacker would need to trigger the vendor-specific docking logic AND exploit a vulnerability in that logic, rather than triggering load of a new driver.
    – Ben Voigt
    Mar 22, 2023 at 14:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .