Uhh, you do not strictly need physical access. Simple scenarios: Remote administrative access, does a memory dump. Laptop or desktop system that supports suspend mode, when in suspend the contents of memory are written to the harddrive. When brought out of suspend this data is "deleted" (i.e. the space is marked as free), an attacker could potentially find the password somewhere on the HD. System crash in WIndows NT/2000/XP where the person has configured it to write a memory dump, the attacker could trigger this system crash (and the resulting memory dump). How many people actually bother to delete emory dumps after a crash? I thought so. Data deletion/wiping/protection is a LOT harder then most people think. A powerpoint of the talk I gave at Hivercon is available at: http://www.hivercon.com/hc02/talk-seifried.htm Quite a few technical remote attack scenarios. To say nothing of Legal based local attacks. My advice: use a product with a good security track record like PGP and not these "no-name/generic" apps that 9 times out of 10 are broken beyond belief. Kurt Seifried, kurt@seifried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://seifried.org/security/
