How to secure your data for free

martinoc

The best way to ensure your data is secure is to encrypt it. The best solution for encrypting data on the fly is TrueCrypt. TrueCrypt is open source software that lets you mount a TrueCrypt volume on a drive letter (windows) or where ever you like to mount filesystems (linux). It offers a variety of encryption algorithms, such as AES, Twofish, Blowfish, Serpent etc.

The TrueCrypt website includes documentation and a beginners tutourial.

Spipov

Hi, sounds like a nice piece of software. im looking for something to do this:

i have an external hdd. is it possible to encrypt so that i have to enter a password whenever its connected to a pc?

my gf's apartment just got broken into and her laptop and pocket pc and jewelry got nicked. its bloody awful.

ive got sensitive info on my laptop and hdd. is it possible to password them up? (i dont really want to bios password my laptop - and windows password is not very safe anyway)...

Thanks!

martinoc

Spipov wrote:

Hi, sounds like a nice piece of software. im looking for something to do this:

i have an external hdd. is it possible to encrypt so that i have to enter a password whenever its connected to a pc?

Yes, TrueCrypt would be the perfect tool for the job.

Spipov wrote:

my gf's apartment just got broken into and her laptop and pocket pc and jewelry got nicked. its bloody awful.

ive got sensitive info on my laptop and hdd. is it possible to password them up? (i dont really want to bios password my laptop - and windows password is not very safe anyway)...

Thanks!

Yeah, Windows passwords are easily cracked with tools easily available online. Encryption is the only way to go. Essentially, with an external hdd you can make it "look" like an unformatted drive. Only those in the know (a.k.a you) would know that there is encrypted data there and could use TrueCrypt to access that data.

martinoc

bedlam wrote:

It will look like a drive that was securly wiped assuming a csprng was used for the wiping pattern. An unformatted drive will be all 0's. Telling someone that your drive is unformatted when it really is an encrypted container is going to raise some suscpicion.

You are right, although I was referring to the superficial impression given by the Windows interface, and assuming that the HDD would only gain interest from the common thief. But plausible deniability is preserved as you point out, as one could claim they used a prng utility to securly wipe the disk.

Kazap

i can recommend the use of TrueCrypt for privacy, I use it myself. Top class encryption and great flexibility too, it integrates perfectly with windows (and other OSs) so its real easy to use - even I can! Very flexible and very secure, its also been well documented and tested so you know you can trust it. :cool:

Martyr

nobody developed a cracker for this kind of thing?
obviously it wouldn't be wise to use just a PC..but perhaps with access to lots of machines in a small network, highly optimized code, is it feasible? or not worth talking about?

usually most people choose weak passwords, could this be the weak link?
so what if it offers 256-bit symmetric encryption when the password is only 4 characters long & consists of only A-Z or 0-9 on the keyboard...right enough, serpent pads out to 256-bits?

martinoc

In fact there are many projects trying to accomplish this task already.

Check out distributed.net.

martinoc

Breaking TC would involve breaking the algorithms.
Lets face it. Most people who would have someting serious to hide is not going to choose a weak password. It wouldn't make sense to choose a 4 character password .

Martyr

Breaking TC would involve breaking the algorithms.
Lets face it. Most people who would have someting serious to hide is not going to choose a weak password. It wouldn't make sense to choose a 4 character password .

agreed, but how many would choose a 20 character password? like is recommended..that includes upper/lowercase characters with numbers & symbols!

could you remember it easily?
ok, maybe you can..but can say, Spipov choose a good password? or somebody else for that matter?

not everyone is going to choose a good password.
usually, most people choose one which is easy to remember, sometimes people will keep them written down or stored electronically somewhere else.

i must admit, i even do this myself, don't really have anything to hide.

i guess the best way to get the password would be to use violence..like TrueCrypt says. :rolleyes:

Yeah, Windows passwords are easily cracked with tools easily available online. Encryption is the only way to go. Essentially, with an external hdd you can make it "look" like an unformatted drive. Only those in the know (a.k.a you) would know that there is encrypted data there and could use TrueCrypt to access that data.

i was thinking of ways to identify TC containers.
for example, TrueCrypt does not recognise extensions.

but if someone were to name a container with .MP3 or .ISO extensions..etc, then you could check if the headers are valid for MP3 or ISO...etc

if not, flag as "possible container" for closer inspection.

for devices, i don't know..maybe some analysis of the data could determine if its encrypted or not.

usually compressing encrypted data makes it bigger or has no effect at all..i'm not sure, but i would expect some government organisations have all sorts of tools available for this kind of thing.

TrueCrypt can be used for all the wrong reasons too, good for securing data alright.

martinoc

This is why we are seeing a shift in the terminoligy from password to passphrase. This highlights the need for a strong group of chatracters that may span more than one word, even as far as a sentance or catchphrase.

mada999

yep used it before tis decent!