|
Lots of people refuse to believe me when I tell them that super-cryptic login password on your home PC is a poor joke if your computer is stolen (or seized by some authorities, if that is what you fear). I have had to open their PC and pick out the disk, then install it as the D: drive on my own PC (with my own login), and show them: Look here, I can read your files that you thought were secret because I couldn't log in with your password! I see their open mouths and the horror in their faces...
You can take some measures, such as using Windows' built in encryption of your private files. Once you log in, giving your password, Windows inspects it: Yes, that's what I expected, then I will decrypt your files for you. ... But Windows knew in advance all it needs to decrypt the files. If some FBI agent puts the disk with the encrypted files into his special-edition Windows, telling it: Now pretend that Joe Smuggler just has specified his login password, and go ahead: Decrypt his files for me, as you would for him! - then Windows has all the info it needs to do the job. My version of Windows won't accept an order to simulate a Joe Smuggler login, but I am sure that such versions exist.
In the IDE days, I had a hardware encryption device on the IDE cable, with a physical key (looking like a USB stick) that had to be plugged in when the machine was rebooted, then it could be unplugged and hidden away. In those days, the electronics were not fast enough to handle more than a 40 bit key, yet I consider that far more safe than today's BitLocker where Windows doesn't need you to supply a single bit of secret key: It will decrypt without that. It has all the information it needs to open up the disk. I never saw such encryption devices for SATA; maybe the FBI has made them illegal in the USA. They could be marketed in other countries, though!
Unless I have to supply a key that Windows doesn't know, doesn't save, the files are not protected against eavesdropping, period. In theory, Windows could have a keylogger and an analysis program that knows which applications are encryption programs, and save the password typed along with the file name in a secret database, but I am not that paranoid; I don't think Windows does.
|
|
|
|
|
Marc Clifton wrote: how encryption protects your data when the computer is off is beyond me
When the power goes off, the decryption key field that is generated by the processor fan stops, and the HDD then loses the ability to decrypt it's magnetically stored data.
(With SSD drives, it's all down to little tiny Leprechauns who live in the SATA cable)
Sent from my Amstrad PC 1640
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
OriginalGriff wrote: the decryption key field that is generated by the processor fan stops
Ah, that explains why I can never move a hard drive to another computer. The decryption key is specific to the unique quantum fluctuations of every computer's fan! 
As to Leprechauns, I always new there was magic in this world!!!
|
|
|
|
|
Remind me to integrate this stuff into the drivers my 82C55 DIY IDE controller.
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
OriginalGriff wrote: (With SSD drives, it's all down to little tiny Leprechauns who live in the SATA cable)
What did they do to the homunculus that used to have that job? You didn't cheap out and get the Leprechaun version, did you?
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
The manufacturers outsourced the work to Ireland years ago.
Sent from my Amstrad PC 1640
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
|
The attack relies on the data remanence property of DRAM and SRAM to retrieve memory contents that remain readable in the seconds to minutes after power has been removed.
I was working with a video capture card (B&W) in the 80's. I had turned the machine off, pulled the card out of the slot and moved it to another computer, then booted that computer. Crazily, even after a couple minutes of no power, a good 80% of the image that had been in memory was still there and recognizable. We're talking minutes, not seconds, and not SRAM either.
|
|
|
|
|
That's one reason why memory was so much slower back then. They used actual capacitors to retain the charge in the memory bit and apparently they had rather low leakage current so they could hold it for a while.
|
|
|
|
|
Leakage current has always been minuscule but the surface of the CMOS, which is the source of the "parasite capacity" used to actually store data in DRAM dropped by a huge factor, so it became relevant.
GCS d-- s-/++ a- C++++ U+++ P- L+@ E-- W++ N+ o+ K- w+++ O? M-- V? PS+ PE- Y+ PGP t+ 5? X R+++ tv-- b+(+++) DI+++ D++ G e++ h--- ++>+++ y+++* Weapons extension: ma- k++ F+2 X
|
|
|
|
|
How did you make sure the new boot didn't overwrote memory space? Also how did you access that specific part of memory?
|
|
|
|
|
Hype!!
I found the only true guarantee for security here: OneSafe Software – Official Website – Utility software for PC & Mac
It makes your PC safe! But! I can see in the photos that it also makes Mac's safe! (Even if the ⌘-key is black.)
 What really bugs me is that frauds like this appear on big sites, in this case Yahoo!
They should really be able to maintain a minimum degree of advertising hygiene.
... such stuff as dreams are made on
|
|
|
|
|
megaadam wrote: What really bugs me is that frauds like this appear on big sites, in this case Yahoo!
Anything that appears on Yahoo! is suspect, IMO. In fact, Yahoo! itself is a big fraud!
|
|
|
|
|
Grrrrrrrrrrrr[^]
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
While that may be true, I was spewing anger over the general phenomenon of malware ads on very big sites.
... such stuff as dreams are made on
|
|
|
|
|
It's not necessarily the size of the site that matters.
Just wait until your bank does it.
|
|
|
|
|
megaadam wrote: What really bugs me is that frauds like this appear on big sites, in this case Yahoo!
They should really be able to maintain a minimum degree of advertising hygiene.
These days Yahoo will take anyone's advertising money.
|
|
|
|
|
security author wrote: Simply locking your computer is not sufficient for encryption.
That's a terrible sentence leading to much confusion.
Almost positive author meant:
Quote: Locking your computer is not an effective security method (since files are not automatically encrypted).
Bad technical writing wastes so much time.
|
|
|
|
|
I don't know what it is specific to the topic of cyber-security, but all of the training that's been foisted upon me has contained similar nonsense. This in itself would be bad, but that same training usually contains at least one dangerous bit of technically inaccurate information.
Anyhow, the "currently offline" site that is "Always Online" made me burst out laughing...seriously, spittle was involved 
As I'm in the midst of some drudge work right now, the laugh was much appreciated.
|
|
|
|
|
Marc Clifton wrote:
The information on your computer is only fully protected by encryption when it is powered off or in hibernate mode. Simply locking your computer is not sufficient for encryption.
 Yeah, information is definitely "protected" when the computer is off. But how encryption protects your data when the computer is off is beyond me. Maybe I'm not as smart as I thought.
You don't necessarily need a password to get a locked running OS to do stuff for you as the current logged in user (e.g. via a USB attack), and since it can read the encrypted files...
If they've enabled the full-drive encryption, and especially the encryption build into the hardware of 2.5" drives, then even if you have physical access, you're going to need the password before you can read the data on the drive if the computer is off when you get there.
|
|
|
|
|
Marc Clifton wrote: Nonpublic information should only be saved to your network drive
So "private" information then? If it's private to me, I'm not sure it should be made "publicly" available.
Marc Clifton wrote:
Dude. You really don't want to use "currently offline" and "Always Online" in the same sentence.
I understand what you are saying, but perhaps since the latter is a proper noun (i.e., capitalized), it's not really referring to a state, thus those terms can co-mingle.
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
|
|
|
|
|
David Crow wrote: but perhaps since the latter is a proper noun (i.e., capitalized), it's not really referring to a state, thus those terms can co-mingle.
Quite so, but the proper noun is a product that "guarantees" delivery of a cached static page when your server is down. Which (the cached static page) wasn't working. 
|
|
|
|
|
Maybe that page falls outside of the "limited copy" range, or it's perhaps not considered "popular."
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
|
|
|
|
|
Some people have a mouth that is Always Online™ even when their brain is currently offline 
|
|
|
|
|
I think it was HP that had a laptop that was insanely secure, but may have been slightly less so if you were already logged in.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
