I was really happy when Apple added the "Secure Virtual Memory" option to the Security pane System Preferences (I think this was with the release of Tiger). I'm a big fan of encrypting swap files/partitions. Encrypting sensitive files on disk is great and all, but it doesn't do you much good if the data in those files sits in memory that gets swapped out to disk in the clear. If someone steals your hard drive, she can find all kinds of handy info in your swap files. So, I use Secure Virtual Memory to encrypt those swap files on my Macs. I've also used dm-crypt to do it easily in Linux, I believe GBDE can do it in FreeBSD, and OpenBSD I'm fairly sure just encrypts swap by default. I don't know what you do in Windows; in the past I've just turned off the page file, or whatever Windows calls it, completely.
Anyway, I discovered today that recent Apple laptops can do what Apple calls "Safe Sleep." This is known in the Linux world as suspend to disk, or hibernating for Windows folks. During Safe Sleep, the contents of your computer's memory are written to /var/vm/sleepimage, so your computer can completely power down, and still be able to boot quickly to the state you previously had it in when you open it up again (in normal sleeping, most of the computer is powered down but memory is kept on to preserve its contents). It seems that any time you put your Safe Sleep enabled Mac to (normal) sleep, memory gets dumped to this file so it can later go into Safe Sleep mode if the battery is removed or runs out.
Kind of cool, but not a feature I want. Safe Sleep, like I imagine other suspend-to-disk systems, just writes all your memory to disk in the clear. This is even worse than cleartext swap files, because it's all of your memory. Try running strings on /var/vm/sleepimage, or maybe grepping for passwords from it. According to where I was reading about Safe Sleep (here), there is an option to encrypt the memory when it is dumped into /var/vm/sleepimage, but this option might not work (it didn't at the time that article was written). I didn't test it myself. I just turned Safe Sleep off completely with this command:
sudo pmset -a hibernatemode 0
Then, you might want to blow away the sleepimage file created when you last put your mac to sleep as follows:
sudo rm -P /var/vm/sleepimage
The -P option to rm overwrites a file completely with ones, zeros, then ones again before unlinking it. Note that this will take a little while to run, especially if you have a lot of RAM (and thus a big sleepimage file). I haven't seen this option with the GNU rm typically used in Linux, but if you have Linux you probably have a GNU utility that comes with coreutils called shred, which can do the same thing (and by default will much more thoroughly overwrite files).
http://www.andrewescobar.com/archive/2005/11/11/how-to-safe-sleep-your-mac/ has a lot more useful info about Safe Sleep.
