Den ons 12 aug. 2026 kl 15:59 skrev Andy Bradford < [email protected]>:
> Thus said Janne Johansson on Wed, 12 Aug 2026 14:39:59 +0200: > > > That is correct, and if ever mfs contents get swapped out, the swap on > > openbsd is always encrypted by a per-boot random key, so noone could > > dig it out of the swapdevice on the next boot even if you don't use > > FDE. > > Are you sure? It seems the default is: > #vm.swapencrypt.enable=0 # 0=Do not encrypt pages that go to swap > That is not the default, it is the example file telling you what you could change it to if you like. # sysctl vm.swapencrypt.enable vm.swapencrypt.enable=1 Read the actual setting, not the text file. -- May the most significant bit of your life be positive.
