Comments on: Protect Your Data At All Times http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/ Piano Geek Rock Thu, 09 Feb 2012 00:44:00 -0500 hourly 1 http://wordpress.org/?v=3.1.3 By: Dad http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-477 Dad Sat, 17 May 2008 16:23:20 +0000 http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-477 Huh? Huh?

]]> By: Zimmie http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-476 Zimmie Fri, 16 May 2008 19:03:59 +0000 http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-476 I should have specified a universe-sized traditional computer. Quantum computing is a whole different beast, but it will probably break all current crypto pretty equally. I should have specified a universe-sized traditional computer. Quantum computing is a whole different beast, but it will probably break all current crypto pretty equally.

]]> By: Zimmie http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-475 Zimmie Fri, 16 May 2008 17:23:20 +0000 http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-475 Strictly speaking, AES-256 is the kind of encryption that would take a universe-sized computer billions of years to crack. The fastest crypto-cracking computer known can crack a DES key in 22 hours, 15 minutes. It was purpose-built to do just that and cost $250,000. If we could build a general-purpose machine that would crack a DES key in one second and that could crack AES just as efficiently, that machine still wouldn't be able to crack AES-128 before the heat-death of the universe. It would take the majority of the estimated energy in the universe to power the machine, and you still wouldn't get anywhere. AES as a whole is stupefyingly secure. FileVault actually uses an AES-128 sparse volume to store your home directory. When you log in, the volume's key is decrypted using your login password, and the volume is mounted. It operates in exactly the same way as a separately-created sparse disk image. The problem with FileVault and with encrypted images on Macs in general is that modern Macs do something called SafeSleep. It's a cross between suspend and what Windows calls Hibernation. Essentially, the contents of RAM are written to the disk and the system is put to sleep. If power is maintained, the system resumes from RAM. If it loses power at some point (like, say, you change the battery on a laptop), it resumes from the sleepimage on the disk. Do you see the problem here? If you use FileVault or an encrypted disk image, the encryption keys are stored in your RAM. If you put your computer to sleep, the keys in RAM are written to your disk in plaintext. Not only that, your login password is stored in RAM and it is also written to disk in plaintext. Yes, encrypted images may be enough to prevent casual snooping, but you really need more to protect against someone who wants to get at the data. Plus, that's a fantastic way to get on the no-fly lists. Strictly speaking, AES-256 is the kind of encryption that would take a universe-sized computer billions of years to crack.

The fastest crypto-cracking computer known can crack a DES key in 22 hours, 15 minutes. It was purpose-built to do just that and cost $250,000. If we could build a general-purpose machine that would crack a DES key in one second and that could crack AES just as efficiently, that machine still wouldn’t be able to crack AES-128 before the heat-death of the universe. It would take the majority of the estimated energy in the universe to power the machine, and you still wouldn’t get anywhere. AES as a whole is stupefyingly secure.

FileVault actually uses an AES-128 sparse volume to store your home directory. When you log in, the volume’s key is decrypted using your login password, and the volume is mounted. It operates in exactly the same way as a separately-created sparse disk image.

The problem with FileVault and with encrypted images on Macs in general is that modern Macs do something called SafeSleep. It’s a cross between suspend and what Windows calls Hibernation. Essentially, the contents of RAM are written to the disk and the system is put to sleep. If power is maintained, the system resumes from RAM. If it loses power at some point (like, say, you change the battery on a laptop), it resumes from the sleepimage on the disk.

Do you see the problem here?

If you use FileVault or an encrypted disk image, the encryption keys are stored in your RAM. If you put your computer to sleep, the keys in RAM are written to your disk in plaintext. Not only that, your login password is stored in RAM and it is also written to disk in plaintext.

Yes, encrypted images may be enough to prevent casual snooping, but you really need more to protect against someone who wants to get at the data. Plus, that’s a fantastic way to get on the no-fly lists.

]]> By: Bryan Page / Jesta http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-474 Bryan Page / Jesta Fri, 16 May 2008 17:21:03 +0000 http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-474 Good advice - I've been meaning to do this for a while, but this post pushed me to get it done. I am just wondering though what would happen if you had multiple accounts on your laptop. Would they even think to ask you to log into them all? For example, if you had a second account on the computer that you never used and logged into that one when asked, would they even realize that they weren't seeing all your files? Maybe you could even log them in to the disposable "Guest Account" on Mac OS X and see if they notice! Good advice – I’ve been meaning to do this for a while, but this post pushed me to get it done. I am just wondering though what would happen if you had multiple accounts on your laptop. Would they even think to ask you to log into them all? For example, if you had a second account on the computer that you never used and logged into that one when asked, would they even realize that they weren’t seeing all your files? Maybe you could even log them in to the disposable “Guest Account” on Mac OS X and see if they notice!

]]> By: Jeff Glasson http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-473 Jeff Glasson Fri, 16 May 2008 14:47:30 +0000 http://matthewebel.com/2008/05/16/protect-your-data-at-all-times/#comment-473 Definitely some valuable advice! One alternative to the Disk Utility solution is an Open Source product called TrueCrypt (http://www.truecrypt.org/). It supports AES-256, Serpent, and Twofish encryption algorithms and offers versions for Windows, Mac and Linux platforms. Its a great solution for encrypting your USB sticks as well! Cheers, Jeff Definitely some valuable advice! One alternative to the Disk Utility solution is an Open Source product called TrueCrypt (http://www.truecrypt.org/). It supports AES-256, Serpent, and Twofish encryption algorithms and offers versions for Windows, Mac and Linux platforms. Its a great solution for encrypting your USB sticks as well!

Cheers, Jeff

]]>