[mowfask]

Those possibilities are especially embarrassing since doing it a lot better takes little effort:

TrueCrypt container which contains sensible project-data;

.ssh somewhere on that container with ~/.ssh linking to it;

Keepass for passwords, it's quite convinient.

Maybe Pray or something similar, haven't set it up myself yet...

[baby]

Prey really takes seconds to setup. No excuses ;) Don't forget to set it up so that a guest account is created as well.

[thibaut_barrere]

I know that creating a guest account as a honeypot is the recommended technique, but I wonder if there are (Mac OS X) vulnerabilities to get access to your main account from the guest account (in which case full disk encryption would not protect the data).

I guess in the end it boils down to: do you prefer to leak the data, or lose your laptop ? :-)

[dunham]

The built-in guest account runs on a separate copy of the OS, booted from the recovery partition. It is a limited OS image that only runs Safari.

A normal account would require unlocking the disk, which would expose everything.

Last time I looked at Prey (over a year ago) it didn't support installation to the recovery partition. But they may have added support since then.

[paxswill]

If you're already relying on OS X's FDE, it's not a huge step to link your laptop with iCloud. You can then do basically all the things you can do with a lost iOS device: beep, send messages, or wipe it (instantaneously if FDE is on, it just clears the keys).

[CoachRufus87]

Out of curiosity, could you explain why creating a guest account as a honeypot is the recommended technique? My first guess would be to help identify who has the machine.

[bschwarz]

If there's no way to use the computer the thief will instead wipe the disk making it impossible to track.

[baby]

if you don't need a login to use your laptop, then a guest account is not needed.

[gte910h]

Isn't prey possibly illegal in some states due to wiretapping issues?

I don't want to escalate a lost laptop to a felony charge.

[gohrt]

That is an extraordinary claim that requires some evidence.

[gte910h]

http://blog.internetcases.com/2011/08/29/using-lojack-to-fin...

Apparently, it's federal, not state based.

[gohrt]

Thanks for the link. That is sad news.

The key point seems to be:

> the court was saying that Absolute went too far in collecting the contents of the communications being made on the stolen computer.

So location tracking and snapping photos of the user is acceptable, but intercepting the users communication content is not. Unfortunate, and poorly decided, but not complete failure.

As usual, the government reserves rights for itself to perform specific acts that it considers criminal when private citizens engage. (And of course, the government offers no replacement for citizens who are prohibited for taking defensive actions on their own behalf.)

[gte910h]

I think snooping on sexual episodes was quite rightly decided to be an invasion of privacy. I think a tort would have likely been more appropriate than criminal charges for it.

[gohrt]

Thanks for the link. That is sad news.

The key point seems to be:

> the court was saying that Absolute went too far in collecting the contents of the communications being made on the stolen computer.

So location tracking and snapping photos of the user is acceptable, but intercepting the users communication content is not. Unfortunate, and poorly decided, but not complete failure.

As usual, the government reserves rights for itself to perform specific acts that it considers criminal when private citizens engage.