I'm assuming if you know either common byte patterns or string patterns you might be able to figure out where the password string is being allocated and watch that area of memory for changes.

Not sure if Meltdown is the same, but I read that Spectre can recover memory at about 10kb/sec. So it wouldn't be very efficient to scan the entire memory for a known pattern.

I suppose if there was an exploit targeted at a specific program, it would be possible to work out what location the secrets are stored in?

I leave my machine on for weeks at a time. If something was scanning the memory even if it failed to find the location of my password 99.9% before it is erased eventually it will be lucky and get it.

Good point. I was only thinking about a single run but that makes sense.

According to the paper, Meltdown can recover memory at about 500 kb/s

It's still "only" 1.7gb/hour. If programs follow reasonable security practices, it shouldn't be possible to stumble upon secrets in the memory. This underlines the importance of things such as ASLR and not holding your key in memory longer than needed and rotating them as well.

Once you know the location, if the process is not randomized, you can extract from that location. You may assume some things about implementation (e.g. libstdc++ or libc++, glibc memory allocator, general compiler version)

Additionally some hardening methods like stack protector make stack allocated objects stand out a lot from register values.

Meltdown is fast enough to learn everything about layout of data structures in kernel or other programs and then use it to extract information from particular areas holding the keys.

It appears to be known to the exploit. I feel that this is being so overblown and that the exploits we are seeing require more info that something in the wild would have.

Code in the wild would have access to all memory (slowly) so could eventually find the correct location.

Given that whoever writes is would also have access to the other program, they would have a lot more information on where to look in memory.