Losing a laptop computer is one of the hazards of the mobile age. But laptops and the data they contain do not have to be lost for snoopers to get hold of their secrets.

Walk away from an operating laptop for a few moments and interlopers can help themselves, even if the computer has a cryptographic file system to keep sensitive information secure. That is because once the owner has supplied the initial decryption key, typically when logging in, anyone using the laptop has access to data stored on the disk.

To limit vulnerability to intrusions, some systems ask users to prove who they are by regularly resupplying their password each time the laptop awakens from its "sleep" mode. The password is then used to derive a decryption key.

But many people dislike features of this sort and disable them or reset the prompts for longer intervals.

"There's a tension," says Brian Noble, an assistant professor of electrical engineering and computer science at the University of Michigan. "For a security system to be effective, the laptop must constantly ask you to prove who you are. But the user wants that to happen as infrequently as possible."

[ Read more ]