Motivation

In some conversation recently, I learned that in some train stations thieves walk through the train, while it is stopping. They then grab devices and run. This lead me to think of the consequence if that happened to me. Since I use a password manager, it is sometimes unlocked. If a thief would grab the laptop and not close the lid, they could discover my still unlocked password manager.

Lock password manager after some inactivity

So a first measure would be to configure my password manager to automatically lock the store after some inactivity. In KeePassXC this was not set by default in the past. Though this changed after an security assessment by the BSI (see here). I usually set this to 240 seconds = 4 minutes. When I travel, manually change it to 60 seconds. But since I have to do this manually everytime, it is prone to forgetting. Furthermore, there are still 60 seconds that a thief has to to see the unlocked password manager.

Automatic lock when unplugging charger

Yesterday I thought of a much more effective measure for the cases where you can charge your laptop. In KDE (and probably other desktop environments too) you can configure to execute a command when your laptop exits the state "On AC Power". Setting the command to loginctl lock-session makes the laptop lock automatically when it is unplugged. Of course this also happens when you unplug your laptop by intention. Though I'm personally not bothered by this (so far). Of course you also need to think of plugging in your laptop. If you forget this, the measure won't work.

This means that if a thief grabs your laptop and runs, the laptop automatically locks. When you don't sit somewhere where you have mains power to plugin your charger, you can plug your laptop in a power bank. A thief will probably not also steal your powerbank. Unless it is a targeted attack, where they have knowledge of this measure. But then you have other worries. Mostly, why are you targeted in the first place?