Encryption of "Safe Sleep" file?

Question

Encryption of "Safe Sleep" file?

I note that under Lion swap files are encrypted by default.

My question is - are the memory images stored on disk when a machine enters "Safe Sleep" also encrypted?

Since these files are in fact the contents of the entire memory of the machine at the time that the system goes to sleep, they would pose the same security risks as are posed by the swap files, correct?

To me, encrypting swap files without encrypting the sleep image solves only half of the problem.

Are the sleep fiiles somehow encrypted also?

MacBook Air, Mac OS X (10.7.2)

Posted on Dec 2, 2011 6:46 PM

Reply

Answer 1

Linc Davis

Level 10

209,547 points

Dec 2, 2011 7:23 PM in response to Bambootelegraph

The sleepimage file is not encrypted. However, it's readable only by root. Anyone who has root can capture your password and anything else he wants by other means. An attacker with physical possession of your storage device could extract your password from the sleepimage file, and use it to unlock your keychains. He could read all your other files even without knowing the password, of course. If you're concerned about this threat, disable hibernation and enable FileVault.

Reply