When I mount a LUKS volume, I get these options:
I assume the first is the safest, and I can work on the files until I unmount. However, what are other two are good for? And where and how is the remembered password stored?
I have mounted it in Ubuntu 14.04, with dm-crypt.
I mount the volume with sudo losetup $(sudo losetup -f)
and then I click on the mounted volume in Nautilus. Then the dialog above appears.
Under the default configuration in Ubuntu, passwords are stored in the GNOME keyring. This applies to all passwords stored by Nautilus, as well as most other applications including web browsers.
(Let me reiterate: default configuration, most. This can be changed and there are applications that don't support the Gnome keyring.)
You can use the Seahorse GUI program or the secret-tool command line utility to view and modify the contents of the keyring.
There is some official documentation about Gnome Keyring, including a “security philosophy” and a more concrete security architecture.
Data in memory (“Remember password until you logout”) is present in the memory of the gnome-keyring-daemon process, which allows any process running as your user to query it. Gnome-keyring avoids swapping if possible; however, if you have any encrypted storage, you should have encrypted swap, because the programs that manipulate the confidential data could themselves be swapped out.
Data on disk (“Remember forever”) is stored in the file ~/.gnome2/keyrings/login.keyring. It is encrypted with a key that's derived from a password; normally, that's your login password, and Ubuntu is set up to unlock the keyring with your login password. The key is derived from the password with a salted, slow hash but I don't know exactly what the derivation function is.
