Impressed With TrueCrypt

Well, I’ve been playing again ;-)

After what had happened to TallBloke, and given that the TSA et. al. think they can just take any old laptop and copy it any time you want to travel, I thought maybe it was time to get around to encrypting stuff. (Well, more stuff… For a while now I’ve had a PGP encryption utility for individual documents and the various unix utilities that let you whomp up modest levels of encryption)

What I’m talking about here is the ability to encrypt a file system so that anything you stuff onto it is automagically encrypted. You enter a password once when you mount the file system, then any file save / open is automatically encrypted / decrypted.

A brief survey led me to think TrueCrypt would serve my (admittedly very modest) needs. (And a h/t to whoever it was that posted the suggestion) I don’t really have any “secrets”. Life is a bit too boring for that now (thank God…) Mostly I just don’t like snoops. Especially officious snoops. Especially officious snoops who think a government paycheck give them power over others.

In a prior life I’d had particular fun running security operations at a couple of companies. (Mostly keeping bad guys out. Occasionally catching bad guys. Occasionally working with police of various flavors; and occasionally with TLAs* – but at arms length from the outside). So it’s not like I have “issues” with security. I just think the balance of “power” has tilted too far away from protecting personal liberties.

* TLA – Three Letter Agency. FBI, CIA, TSA, NSA, you know, LEO’s… (LEO being Law Enforcement Officer…)

A Story: Once, long ago, we set up a “honey pot” for hackers attempting to break in. An attractive and not-too-hard target. Lets you watch them (as they set off the hidden intruder alarms) so you can see what tools they have, what techniques they use, and if they do something ‘novel’, learn about it before they discover the main / real site… So, just for grins, I’d leave little “Easter eggs” for them to find. Have to keep things interesting so they hang around on the Honey Pot, after all… One of my favorites was to make a modestly large encrypted file that contained…. the encryption key to the file ;-)

It must be emotional hell to whack on a file named “Account Passwords” for Lord only knows how long, to discover it has a “modestly hard to crack, but crackable, short password” only to find that what is inside ia brief text saying: “Is this what you are looking for: passwordfoo2″ Yes, psy-ops are part of defending a site too ;-)

At any rate, I now have several encrypted file systems mounted on my computer. What’s in them? Why, all sorts of important secret things, not one of them has anything pointless like it’s own password… (well, maybe one or two ;-)

Basic Testing

In early testing, I’m impressed with TrueCrypt.

It is very easy to use, and has a simple interface. Here’s a screen shot:

TrueCrypt Sample Screenshot

TrueCrypt Sample Screenshot

The algorithms it uses are strong. (Yes, you get to choose if you like). AES in 14 rounds, or a couple of others of similar strength (or better!). You can even choose to chain them in a few combinations. There are 3 Algorithms available: AES, Serpent, and Twofish. As near as I can tell, when you chain them, you only get one round of AES (but that’s OK…) and not all combinations are available. (For example, you can do AES or Twofish or AES-Twofish or Serpent-AES… but not AES-Serpent nor Twofish-AES. I think they are reasonable in putting the stronger encryption on the the outside, but it would be more “fun” to have a honey pot Easter Egg with increasing levels of difficulty ;-)

One a bit more digging, I found that this wasn’t really much of a limitation after all. You see, ANY file can be made into an encrypted file system. So far I’ve done it with plain text .txt and with bitmap .bmp files. It just doesn’t care. You can treat the file like any other. Back it up. Move it to another disk drive. Whatever. (just don’t overwrite the contents!) TrueCrypt lets you mount the encrypted file system inside of it and “voila” you have a “drive” that looks like any other. Say, the J drive…

Now the fun bit. On, say, J:\JunkFolder you can make a file J:\JunkFolder\Oldcrap.bmp (with an initial 0 bytes). Now inside the TrueCrypt applications, you can make THAT file another encrypted filesystem (of up-to the size of freespace in the first one…) You can use different encryption algorithms, hash functions; heck, even different file system types. ( I made an NTFS file system inside an encrypted FAT32 filesystem file…) Just for fun, I made a Serpent-Twofish-AES SHA-512 hash file system on an SD card (in a bitmap type file in with a bunch of pictures in a photos folder). Then, inside of it, made an AES (14 rounds) RIPEMD-160 file system using a .txt type file.

Turns out that even with all that nested encryption, speed was limited only by the SD card read/write speed.

For the test cases / Easter Eggs made on the computer directly, speed was quite good. It has a built in ‘benchmark’ feature available and depending on which method was chosen, speeds (for this laptop) were from about 49 MB/second for Serpent-Twofish-AES to 192 MB/sec for AES 14 rounds. Plenty fast, for sure.

Hidden File Systems – Steganography

But wait! There’s more!

You can make a limited kind of steganographic encrypted file system. In steganography, the data is scattered into a form that is conceptually a bit like a hologram. As you look at the data in different ‘angles’ you can find different views. One common method is to put a secret message in the last bit of the color of pixels in a picture. The human eye typically can’t see a ‘jitter’ of one pixel in, for example, hue, so that’s where you encode the secret email or plans or recipe for grandma’s soup. ( To counter this, some companies have a bit of software that automatically scrambles the last bit of image files… don’t want the kiddy porn getting past the image scanners hidden in a picture of Paris, after all… That’s Paris the city, not Paris the Hilton ;-)

In some of the Linux / Unix steganographic file systems you can have several (last I looked it was about 9 ) levels of password. Each one gives a view into a different “file system” all in the same block of bits.

Why do this?

Pretty simple, really. “Bad Guys” know that if they threaten you, you will give them the password. Even folks who think they are good guys (such as the US Government) may, by Force Of Law, compel you to give them the password. A steganographic file system lets you do that while NOT letting them get “the good stuff”. (The one with 9 levels is so that if they figure out it’s steganographic you have 8 bogus levels you can give them, one level of torture at a time… with the thought being that if they go for level 9, you likely didn’t “make it” some time back…)

For TrueCrypt there is only ONE level of steganography. That’s why I said it was a bit limited. HOWEVER: It has a ‘nice touch’. The hidden level is not protected from overwriting by the outer layer unless you chose to do so at the time you mounted the file system. IF the bad guy extorts the outer password, they don’t even know that the inner file system exists. THE ONLY thing that gives any indication it is there is if you give the hidden password at ‘mount time’, then it mounts the hidden file system.

So make a 100 GB file system, and have 50 GB in the hidden part, you can have what looks like a 1/2 full file system (decorate with what looks like important stuff, please!) that has another nearly 50 GB hidden. If the outer password is extorted, the file system is mounted as “normal” and looks like any other TrueCrypt filesystem. IFF anyone then writes data to it, the hidden stuff will be overwritten and destroyed. (In theory, one could be forced to mount it, and then say “Look, this is what’s here, I’ll show you it’s all a regular file system” and then drag some large folder into it. That would then overwrite the hidden bits…)

Plenty good enough for the Average Guy (especially as you could have the Stego file system inside some other file inside an encrypted volume…

Some More Features

The manual is over 118 pages. It’s not TOO hard (then again, I have some crypto background already) for the bits I read. But I’m no where near able to list all the features. Heck, I didn’t even read any of it prior to making the first file system; just the online notes of the Beginners Guide inside the FAQ

Mostly I just did the ‘novice install’ of a file system, then hit the tech specs part and a bit on what options were available.

What I liked the most was that these folks have thought about things in depth, have added the features that make it valuable, have left out he stuff that makes it hard to use, and have made sure the usual “stupid stuff” that breaks security are gone. So passwords and decrypted files only live in computer memory. Pull the cord, it’s gone.

You can chose to encrypt the whole disk, or given partitions, or flash disk, or files as filesystems. You can even put the entire operating system on an encrypted disk and be prompted for the password (or key files or key files on a fob) at boot time. Nice. Very nice. (I’ve not read that whole part of the manual as I’m unlikely to do it, but did note that the feature is there on a quick skim). You can even build encrypted file systems on CD or DVD for offline storage. Biggest issue I see is remembering the passwords. (Not a great idea to write them down where they can be easily found / extorted…)

It even allows for a hidden operating system on an encrypted partition.

As near as I can tell, the features ‘mix and match’, so in theory one could have a hidden OS on a hidden file system so that anything done (including all the various cookies, log files, history files, etc.) would be hidden and encrypted. Especially nice if you live in a country that punishes free speech and / or limits what you can look at. ( Or even just likes to put people in jail for ‘thought crimes’ like ‘hate speech’ or ‘being a skeptic’… As the rabid-Greens have said they would like to do via a requested “Climate Court”…)

Oh, and you can have the encrypted file systems automatically dismount (so require a new entry of the password) on any of: shutdown, logout, or screensaver activation. Yes, you could set your screensaver to 2 minutes, and if someone rings your doorbell in the dead of night, all it takes is asking them 120 seconds of questions until your open file system unmounts and goes back to requiring the password to decrypt and / or hidden… Don’t even need to touch the computer…

I Like It

All in all, I like the product.

It is open source freeware. It has thousands of very smart folks looking at it and contributing to it to assure it is not broken (and that no TLA has induced the corporate owner to put a back door into it …)

The interface is nearly trivial to use and the defaults are well thought out. IF you can create a new text file, click on 2 or three “yes do the default” choices, select your file in the selection window, click on ‘format’ and provide the same password twice, you can use it.

All the advanced features I’d want are there and then some (modulo that it would be fun to have more levels of Stego… but it’s easy to get confused with that many levels and damage or lose the hidden levels…). Heck, it may even solve one of the problems I’ve got with the HP Laptop. (HP did a particularly dumb kind of disk layout. It makes their automagic recovery feature work more easily, but it makes it a PITA to do a linux install on the box (no logical partitions, all physical and used). I plan to try installing a bootable Linux into one of the TruCrypt “disks” to see if that “fixes it” ;-) Though that will still leave the problem of needing a new ‘funny’ display driver 8-(

Again, I caution that it is EASY to forget or lose a password and there is no backdoor. It’s not like Microsoft Windows where if you forget things after a long vacation you can just get a Geek to break back in for you. Forget the password (say, after a car wreck and month in the hospital) and you have lost ALL the data on the encrypted partition. If that’s an unacceptable risk, then do something like using the VIN number from your car or your street address typed backwards. (And tell the method, though not the key itself, to a friend who can remind you after therapy ;-)

If you are sure you can accept that degree of ‘potential loss through security’, then consider putting some of your more sensitive things inside an encrypted file system. Especially if it is on an external device, a hacker breaking into the system can only get what you have open at the moment. (Assuming they don’t install monitoring code and you fail to notice it being active). Using a USB device with an activity light will further show if unexpected activity is happening (and you can just unmount the disk). I like “blinky lights” and more than once they have let me say “WHY is that disk / network / whatever active? I’m not doing anything…”

If nothing else, it at least means that if your laptop “goes walkies” (or is taken by a walk by TSA) you have ‘no worries’ about who saw what.

Links

The TrueCrypt top level page where you can choose documentation, discussion, etc.

TrueCrypt Download (You have to choose Windows, Mac or Linux – yes it works on all three and filesystems can be moved between them ;-)

Why might you want to do this? Well, it doesn’t matter if it is your medical records (oh, wait, the Government is already demanding those…) or your financial data or love letters or just business proprietary information. IF you cross the US Border, it can be taken from you. Heck, if you are sitting at home drinking tea the Constable might bust in and demand your laptop. But, just to put a focus on it, this “black swan” story (someone deserves a h/t here) makes it clear what the New Normal is:

http://www.tec-venture.com/e/rss3html.php?postid=1211353320

The United States Customs and Border Protection agency (CBP) asserts the unrestricted right to search laptop hard disks at the border. The Fourth and Ninth Circuit Courts of Appeal in the federal judicial system have recently given the CBP a green light to continue such searches. As the law now stands the CBP does not need a court order, a search warrant, a finding of probable cause or even a reasonable suspicion in order search your laptop hard disk. The CBP may pick travelers out for laptop searches entirely at random.

A bit further down it has a further warning:

Furthermore, if you think the CBP is unlikely to search your laptop because you are a respectable, well-dressed traveler, then consider this answer from the CBP website to the question, “How do officers decide which passengers to examine or search?”

Please be aware, some of CBP’s biggest seizures have come from inspections of “respectable looking” people, such as grandmothers, corporate executives, college professors, etc. Everyone is subject to a CBP inspection when they arrive in the U.S.

If even grandmothers are potentially suspect, then German venture capitalists and lawyers must be even more so.

So you have been warned.

Sitting at home with tea in hand, or crossing a border. Either one is sufficient for your disk to be archived by The Government and strangers to be wandering through all the files; rummaging around at will looking for some law to fit you.

It's trivial to encrypt the stuff on it, and even if all you use is the name of your spouses perfume, darned hard to decrypt. Oh, and for those SERIOUSLY at risk of TLA actions. Ponder the utility of a hidden Stego file system where the password is "I really DO NOT know!" that even if extracted via drugs is unlikely to be tried, and if it IS tried, is unlikely to have the capitalization and punctuation correct! (Security is often a mind game ;-)

If nothing else, think of the joy of having a 100 MB file named "Secret Formula" or "Chinese Plot", or even “FOIA To Be Released 2014″, visibly encrypted, and containing your shopping records ;-) Just knowing that someone, somewhere, is either wasting there time, or emotionally frustrated by it all, would be worth it…

In some small way, letting you say “I Am Spartacus!” too.

Subscribe to feed

About these ads

About E.M.Smith

A technical managerial sort interested in things from Stonehenge to computer science. My present "hot buttons' are the mythology of Climate Change and ancient metrology; but things change...
This entry was posted in Tech Bits and tagged , , . Bookmark the permalink.

35 Responses to Impressed With TrueCrypt

  1. Gareth says:

    I lost a USB stick last month. Fortunately a friend found it again, but in the mean-time I realized that I had personal data on it (addresses, pay and tax data, etc). I’ve now made all my USB sticks encrypted, with a plain-text note saying the finder is welcome to keep the device, but I’d love it if they send it back to me (not my home address), and I’ll pay them double the cost of the stick, plus the price of a beer by way of thanks.
    Nice thing about Truecrypt is you can have the .exe and .sys file on the stick and mount the encrypted file system on any windows machine even without Truecrypt installed, and you can also get a linux and mac version.
    PS: great blog.

  2. PhilJourdan says:

    I grabbed a copy after reading about Tallbloke as well, but have not played with it as much. Thanks for the review!

    As far as stegonogrpahy, It very well might be Hilton and not the city. ;)

  3. adolfogiurfa says:

    The best encryption is having nothing to hide. If we are to encrypt something it we suppose there is someone out there trying to meddle into other peoples lives, which may be true but it is naive, and it shows the astounding intelligence limitations of those who, in way one or other, “Conspire”. Any conspiracy supposes a childish behavior, a replication of children´s game of hiding and find.
    An example of such idiocies is the sub-game”global warming”, and as such all equally silly endeavors having in common to present a supposed problem, as “child obesity”,etc. and to propose its solution by government intervention. Anybody who is against it will be a candidate for “inspection” and also a possible client for an encryption software, of course already and previously and conveniently “fixed” as to be easily accessed if eventually really needed.
    However the child game obviously it is not that simple, it has another level: For example, “Global Warming” and its remediation it is not a goal in itself, neither is selling those ugly “wind mills”. Nobody conspires for the sake of the Earth or worse for your child´s health or yours when forbidding smoking. Not at all! The name of the game is POWER…..but it is still CHILDISH. A lot of those “games” have repeatedly failed in history and have ended in not so nice outcomes. The recent history events confirm this rule.
    Serious and grown up people do not play games, we work, live, love our families, learn, to comprehend the world we live in, evolve; we know this the real and serious game, the law of the universe.
    So let´s wait and see.

  4. Pascvaks says:

    @adolfo –
    It is important to know as much or more than your enemies (even those we do not know to be our enemies). Treat all “systems” like people; trust them only as far as you can throw them. The more open we are to being hurt, the more likely we are of being hurt. Never assume anything regarding your safety or the safety of those you love or those you and yours rely upon in your day-to-day livelihood.

    Tell me the people you trust the most and I’ll tell you who your most dangerous enemies could possibly be one day. Tell me the people you trust the least and I’ll tell you who your least likely enemies may possibly be one day. I can then add list one and two and make another list of those you did not name in either case. The third list can tell where you are most vulnerable to being completely surprised, one day.

    Never trust anyone who has power over you completely. You were born helpless, you may die helpless, but everything in between is our fault.

  5. Richard Ilfeld says:

    For critical stuff I use a computer never connected to any net anywhere.
    It is subject to the same risks as any physical information source, but no
    worse. It is not difficult to create secure product chain for customers that demand it…secure in the sense of being safe from network intrusion.

    One may still encrypt to prevent the goods leaving the premises on the thumb drive of a disgruntled employee; but an “inside job” is not really a computer problem.

    Nonvolatile memory sticks than go express mail get a lot uf my customers past the network security barrier.

    Many security holes are trade offs for convenience, & not thought through.

    But I like your Trojan Horse….that’s an old concept too.

  6. E.M.Smith says:

    @Richard Ilfeld:

    For many years at Apple I “took heat” for our “air gap security” between the internet and a secret internal project. BUT it never failed us…

    We did have email exchange (over a 9600 baud hard line!) and that almost cost us. When the infamous “Internet Worm” brought down substantially everyone on the internet, we caught it at our “honey pot” and my network guy was bright enough to see it starting to take over email to propagate and shut down the link.

    I can say that I NEVER had a break-in at Apple on my watch (other than the planned ones to the Honey Pot) thanks to such careful design and bright folks.

    We eventually did full internet connectivity when the routers, firewalls et. al. caught up to the job. Today, with all the “built in by design” security holes in Microsoft and other vendor products, I would never take a job that required me to guarantee corporate network security again. Things have gotten worse, not better. And “The air gap is your friend”… I have a half dozen machines that never see the internet… Heck, even moving thumb drives between them is ‘to be discouraged’…

    WHY we have things like dam controls and power stations connected to the internet at all is just beyond me. A leased line is not expensive if you really need connectivity to the site. They ought to be able to run stand alone anyway. If it were up to me, ALL critical facilities would have ZERO internet connections and highly restricted private lines. (even them with Air Gap and fingers on keyboards needed for the actual control inputs…)

    Basically, if a computer in Ohio wants to control a dam in Colorado, it ought to be a dedicated machine, isolated from internet and corporate networks, with a leased line to Colorado… “Butts In Seats” to change the dam release rates…

    Anything else is just false economy and lazy risk taking. (As many companies are finding out… one at a time…)

  7. E.M.Smith says:

    More or less on the “security” thread.

    I’m posting this comment from Ubuntu bootable CD. Next step is to try to create an encrypted thumb drive with the TrueCrypt linux executable on it (in an open unecrypted sector) and then see if the two “play well together”….

    Then I’ve got a non-corruptible OS and a secure set of data. Bring the two together, you have a “system”. On any powerdown, you have two completely benign and immutable objects.

    So far It’s doing everything I like rather well.

    Oh, and with bookmark export / import to the thumb drive you can keep your favorites around without anyone needed to know them…

    @Pascvaks:

    From the front of our refrigerator:

    “Love all, trust a few, do wrong to none”. W. Shakespeare …
    http://www.quotationspage.com/quote/2241.html

    @Gareth:

    I typically keep a duplicate of all thumb drives anyway, but adding the encryption will now be standard for me. One of my bigger issues, though, is that I regularly have “variety file systems” on things… So sometimes I need to figure out if that ‘old” thumb drive was really a linux or Mac file system… That’s going to become a bit harder in some ways with consistent encryption. OTOH, if I get comfortable with it, the “portable between OS” feature means that (after some conversions) things will be good. (That some of the file systems are on SD cards that go into digital cameras that have their OWN three formats is, er, “interesting” at times… I won’t go into how I found out that you can’t share an SD card between a Nikon and a USB adapter / PC … “slow corruption” as the contents of a file ended up mapped into a different ‘picture’…)

    @PhilJourdan:

    Well…. there was (is?) a very popular stego app for sharing such pictures that was gaining some wide use by kids and ‘others’…

    @Adolfo:

    Yes, I try to have “nothing to hide”, but at the same time, they have no valid reason to see; since I have “nothing to prove” either…

    So yes, public images downloaded, quake maps, published pages on Chiefio, even recipes for roast turkey and the occasional “what tire sizes fit old mercedes with prices, mileage and optimal purchase speadsheet” will all now be encrypted for me. Why? Because I have something to hide?

    No, because THEY have no reason to see…

    (Frankly, I wish I had something to hide… Being old and semi-retired is kind of boring at times. Look at all the stuff I do to avoid going stir crazy ;-)

  8. Pascvaks says:

    Doesn’t all this make it really hard on archiologists in several thousand years? Think about it, we still treat the great pyramid as just a pile of rocks and not data because we haven’t found the key to that yet. How are our descendents ever going to learn who we were and what we really thought about things if we keep hiding like this behind a bunch of hirogliphs? There just must be a better way? (-;SarcOff;-)

    PS: Anyone who thinks that the kids 10,000 generations from now are going to be smarter than we are doesn’t know squat about lids. ;-))-;

  9. P.G. Sharrow says:

    @EMSmith; This idea of having the OS and files on a stick or disk and using the computer as a dumb piece of equipment is one I have mentally explored for many years. I think in the long term this is the only way to go, and the present USB stick with Gigs of space may be the key to that outcome. I will watch your efforts with great anticipation. pg

  10. E.M.Smith says:

    @Pascvaks:

    The magnetic field of the hard disks will have faded to gone in far less than 10,000 years. Last I looked even CDs where only expected to last about 100 years. Mag Tape was supposed to be re-written about once every 5 years ( 10 was pushing it and some tapes would fail) due to loss of flux density.

    Archeology is the least of our worries.

    @P.G.Sharrow:

    The issue with ‘system on a stick’ is that the flash disks are a bit slow. Also, some of them have limited ‘cycles’ then the individual memory cells start to fail. At ‘about 10,000′ it is fine for manual read / write of files. (rewrite the whole thing every day and it is still good for about 30 years).

    Take that same device and put “swap space” on it, you can burn through 10,000 read/write cycles in a few days. I know this because I’ve done it ;-)

    (On one occasion I put a couple of Linux file systems on a flash drive just to see how well it worked…)

    One of the ‘gizmos’ I’ve accumulated over the years is an 8 GB real disk drive in a “flash” form factor that goes into a PCMIA or USB adapter. Lets you put your highly active file system on a more “durable” media. It’s still a bit slow, though.

    The ‘easy’ way out of this is to put your more stable, personal, and hand managed data on ‘memory sticks’ and have the system more dynamic. There are several variations.

    Knoppix has a nice feature where you can have a swap partition on the local disk and choose to use it, or not. So you can have a Knoppix CD with 90% of everything highly static and never used (have you REALLY used the manual page for egrep – not regular grep – or fgrep lately?) For a security sensitive operation, at boot time you tell it “do not use local disk for swap” and everything runs in memory. For more casual uses, you let it use the swap partition.

    Now, the fun bit: Some file systems can be mounted by hand after boot. You can put your home directory and archives ( that don’t change much ) on such a file system on some form of removable media. If you have 2 CD drives, one of them can live on a CD / DVD. A very useful thing for desktop machines. It is also possible to have a network mounted disk (though that just moves the “issue” to another machine…) More importantly, you can have the change prone partitions on a USB drive (that come in many speeds).

    At this point you get to ‘put it together’. Have most of the OS live on a CD which you boot. At boot time, you give a few options for things like where swap is to reside. Some “variable” file systems may, if you desire, be mounted from some other source. Your personal file system may also be mounted from another source and that lets you do things like save downloaded files.

    Any or all of the file systems can be on encrypting volumes.

    what do you want?

    In many cases it comes down to ‘what do you want to do?’ and you have choices. For most convenience, it is most likely just a simple fully encrypted USB hard disk drive (up to a TB !) where you can boot from it and all is done. That is what I would eventually do for a low use home system. For a high use desktop, you might as well just fully encrypt the internal hard disk system and all (TrueCrypt lets you do that now).

    For “portable sporadic use” just having a bootable business card with Knoppix on it lets you boot and run a simple Linux. Just limited on what you can do to save data unless you hand mount some writable device.

    BTW, mounting writable media is commonly done. I expect this to be trivial to do even with an encrypted USB drive. This isn’t so much about exploring brave new worlds as it is about ‘refreshing my memory’ of the steps to do it….

    In between the CD System and the fully encrypted local system disk, you can have a variety of ‘mix and match’ things. (Many of them require that you custom build your own CD … not hard, but a bit of a PITA still).

    Some decade or two ago the move to being able to use read only media was started when a lot of “stuff” was moved from places like /etc to /etc/var and from /usr to /usr/var where “var” meant “variable” and it was expected to be on read/write enabled disk (but all the rest could be on read-only disk for security). Knoppix and the Ubuntu BBC (bootable business card) simply create a ramdisk at boot time and put all the ../var filesystems on it. Mounting a USB disk file partition instead is pretty much all that is required.

    So the ‘steps’ needed are pretty trivial. Make a CD that can mount a removable USB disk (that is itself encrypted – i.e. TrueCrypt on that disk is run at mount time) and then mount those dynamic file systems over or instead of the ones in RAMdisk. I’d also look at putting a swap partition up too as long as the USB disk was ‘durable’ enough…

    All of this is doable, has been done for years, isn’t particularly hard (but is still a bit of a PITA) and mostly just has some minor performance issues.

    Like I said before, it’s more about me relearning what I knew a decade ago…

    So WHY did I do the Ubuntu disk now? Mostly just to look at Ubuntu and see what I thought of it (ie how easily it does things like automount USB drives) and secondarily because I didn’t want to overwrite the OS on my desktop box.

    I’d intended to do this when I first bought the HP laptop, but “discovered’ that it takes a funky new video driver (so the lazy way is just wait a year for it to end up in the base releases ;-) and has a disk layout that is a PITA as there are no logical partitions. Yeah, all ‘fixable’ and I found a write up that lists step by step what to do. About 4 to 8 hours all told. OK, I’m lazy so just put up with Windoz…

    In summary:

    Want a simple secure dedicated system: Just do a whole system disk encrypt as supported in TrueCrypt.

    Want a simple secure volatile system (such as for web browsing from a random desktop) with limited ability: Use a BBC of your choice.

    Want a simple secure portable copy of some personal files: Use an encrypted UBS device ( or encrypted CD for static data), though you will need to manually mount it on things like BBC systems.

    Want a ‘virtual system’ with no footprint left behind on the “box” and with more features than a BBC and more storage than a little thumb drive: You will likely need to custom build the works. From a larger bootable DVD based system to a larger USB disk drive where you can put swap. Details would depend on particular needs (and could even include making a VPN connect to a remote site where you could have everything from NFS mounted data to boot images). Pretty much the sky is the limit.

    FWIW, there is also a somewhat ‘self assembling’ cluster where you just deal a deck of CDs into a bunch of idle desktops at night (helpful if you get job as janitor ;-) and boot. They identify each other and form a cluster. Instant supercomputer ;-)

    http://www.mosix.org/

    Not that anyone might want to assemble large amounts of compute power clandestinely….

    When done, just spit out the CDs and reboot. The ‘compute nodes’ go back to Windoz and all is as it was ;-)

    For me “what I want to do” is mostly just “use a browser, save some files”. The biggest issue I have is does Ubuntu BBC automount a USB and how to make encryption work with same. So far it doesn’t seem to automount, so I’m going to try Knoppix later. (It’s been a few years so I don’t know what the current feature set is…)

    Original German:

    http://www.knoppix.org/

    English version:

    http://www.knopper.net/knoppix/index-en.html

    “Helpers”:

    http://www.knoppix.net/

    I expect a Knoppix CD and a USB thumb drive is the ‘minimal kit’ that does what I want and lives in a small pocket. I expect that a USB Disk fully encrypted will be the eventual ‘suitcase travel’ version and that a dedicated external disk on the home box will complete the set.

    The biggest “issue” is just that MS Windoz is a real “Chatty Cathy” and leaves all sorts of what ought to be private data all over the place. IFF you run it, you are pretty much are screwed in terms of security and privacy unless you encrypt the entire system partition.

    Thus the preference for using a small Linux and just bypassing the thing.

    At any rate, it’s not hard to have a volatile portable system. It is only a little harder to have one with a persistent data store on removable media. To have one that is consistently customized to your needs with full performance takes a dedicated USB drive or network based computing. To have an ersatz supercomputer takes knowing the janitor ;-)

    Wonder if I ought to make a ‘volatile computing’ posting….

    FWIW, I usually travel with a Knoppix CD, but now have added an Ubuntu BBC CD as well. Useful if you are stuck with the public crap machine that is undoubtedly infected with viruses et all and don’t want to be typing your account information into THAT web browser ;-)

    On most hardware it is just stick in CD hit reboot, and then click on FireFox…

  11. Hugo M says:

    I’m by no means a cryptanalyst. Therefore, my old-fashioned, almost Amish take on this problem is simplistic: if I really would feel the need to demoralize not only the usual criminals, but also the professional manifestations of the uninvited, I’d try not to use any electronic device, especially not computers and cell phones.

    Any file system has a well known structure. To the cryptanalyst, an encrypted file system represents a cipher text – clear text problem , which is obviously easier to solve. Hence, within an encrypted file system, the really sensitive information should better reside in unstructured plain text files which are additionally encrypted by some other means, *then* compressed and again encrypted using a different system.

    Besides that, one should consider the loyalty conflict of computer manufacturers. While it is at least thinkable that prefabricated backdoors are built into *every* operating system (I’m still wondering about the true nature of the innocent looking typing error which caused the key generation weakness of the open source SSH server “dropbear”, which was present for years and discovered only some time ago) one should also think about the hardware itself. Say you open a pdf document, receive an image or even some harmlessly looking IP packets around midnight, et voilà, the processor forgets about privilege separation, much like a firewall when receiving knock-demon packets in the right sequence.

    There might be also communication channels besides the TR-069 standard, such as special Ethernet frames recognized and transmitted by router firmware to predefined addresses, HF signals which may bypass router hardware entirely and couple into the phone line, or emanate directly from built-in RF devices — engineered facilitations of side channel attacks. Can you selectively pick up weak, WLAN-type signals from satellite orbits? I really do not know. But I also do not think that the Chancellor Kohl method is still regarded safe today within critical environments. Lastly, if I had to set up a cryptographic environment, I’d start with with constructing and properly testing a dedicated, hardware based random number generator.

  12. Pascvaks says:

    Just curious – an ‘out of the blue’ thought –

    Can a scanner be used to insert a “data key” or “code word” to unlock encrypted programming? For example: page so-and-so of book/magazine such-and-such, lets’s say turned up-side-down? (Or maybe even a scan of a 3D object, like an old coin, key, or keybob, or my left hand?)

    PS: Still can’t imagine that any data, even something I just have in my mind is safe today.

  13. Jerry says:

    Headline on Drudge says they are being monitored by the Feds – can’t tell is Drudge is bitching or braging (guessing the latter :) ). I am downloading TrueCrypt. (and wondering how famous that will make me) Nobody needs to know that I am ordering Giant Inca White even if it is only corn seeds. This is the link and most of the story:
    http://www.theatlanticwire.com/technology/2012/01/homeland-security-monitoring-drudge-report-new-york-times/47300/

    It’s unclear exactly why, but the Department of Homeland has been operating a “Social Networking/Media Capability” program to monitor the top blogs, forums and social networks online for at least the past 18 months. Based on a privacy compliance review from last November recently obtained by Reuters, the purpose of the project is to “collect information used in providing situational awareness and establishing a common operating picture.” Whatever that means. Either way, the list of sites reported by Reuters reveals in a Wednesday afternoon exclusive is pretty intriguing:

  14. Pascvaks says:

    @Jerry –
    Ahhh.. that’s nottin’… they’ve been reading all our email, and bank statements, now for 10 years. Didn’t you read the book? Orwell, “1984”, aka “Everything You Ever Wanted To Know About: National Security in the 21st Century or Why I Stopped Fearing Osama And Learned To Love Obama”, it’s very expensive and there are not many in print in the U.S.. The State Department bought up the last 6 printings. They give them away free to all visitors at U.S. Embassies and Consulates, understand they’re all autographed by the Prez, the Attorney General, and the Secretary of State, and include 2 CD’s; one on Building Tunnels into the U.S. via Mexico and a second on How to Vote in U.S. General Elections as Many Times as You Want.

  15. adolfogiurfa says:

    @E.M: As for the archeological side of it: Words are to be lost only principles and laws are permanent, as they are written in every natural phenomena. :-)

  16. E.M.Smith says:

    @Pascvaks:

    It could be but you have the problem of repeatability. You are one pimple or one dirt speck away from having the image change and thus the key change and being unable to decrypt.

    But yes, with some software to do the error preening, you can do that. Biometrics work that way. For finger prints you look for ridges and intersections, so color or dirt don’t break the key. For faces you look for persistent structural relationships so a pimple doesn’t break the key.

    @Jerry:

    We have become a police state. (No, not complaining. It’s just a definitional thing. Keeping a tidy mind means not letting folks warp the definition of words just because it’s PC…) We have constant monitoring, even of innocent people, and we have police intrusion into what ought to be free speech.

    This isn’t all that new. We’ve had undercover officers in nutter groups like the KKK and Neo Nazis for decades. It’s just going more ‘big time’ and electronic. I suspect that the recent spat of system cracks, wikileaks, and ClimateGate have rattled the Politicos cages and they have issued orders to their police to be able to catch things like this or be BBQ’d. So the police are doing “situational awareness” enhancement (which means watching and recording things BEFORE any illegal act so you can go back later and have clues / evidence).

    FWIW, about 30? years ago I went to a gun show. They were selling Chinese Surplus SKS carbines and their ammo dirt cheap. I bought a ‘box’ ( 1440? Rounds) about the size of a briefcase for something incredibly cheap like $20. There is a ‘junk range’ near here were you can shoot tin cans and I thought it would be a whole lot more fun than the old .22 LR. On the way out the door an guy who was just a bit TOO “wannabe” country and with a slightly too ‘high’ baseball cap and dark glasses on engaged me in conversation. It was pretty clear to me (being aware as I am) that he was undercover police (not FBI or CIA, they have a different ‘feel’ – more likely local police on loan to BATF or working with them) with a camera in his hat looking to record “suspicious folks” for a later video review and / or cataloging… So I proceeded to put on my best “happy geek who’s politically naive and likes playing with hardware” persona and proceeded to tell him in great depth how to get to the “junk range” and how I’d way overbought but was going to share with a half dozen friends and we were going to go shoot up a bunch of coke cans”.. until he was clearly bored and very much wanted to disengage and would skip my bit of tape during the replay…

    So none of this is new. It is just moving from physical to electronic and being much more pervasive.

    If a topic is contrary to the interests of the current government(s) of the world, it WILL be subject to: Monitoring, observation, recording, contact tracing, infiltration, etc.

    BTW, one of the techniques is the undercover guy trying to earn his chops via provocation. Part of why I suppress attempts to ‘incite’ and tell trolls it isn’t going to work. (In some cases, just allowing the “incitement to illegal act” – that an ordinary person might think is just letting someone else have freedom of speech – can expose you to legal problems…) So if you are at a ‘politically incorrect’ meeting or rally and see some guy who’s a bit ‘over the top’ about it, there are decent odds he’s an agent provocateur of the other side or a police agent trying to get in good with the group.

    So is Drudge being monitored? Even knowing nothing about it I’d say “most likely”. He gets ‘tips’ of a significant sort from time to time, so I’d expect a police state to monitor that activity. IIRC there are also some ‘strong statements’ in comments, so adding such folks to ‘watch lists’ would be ‘productive’… What, you say? “Chilling effect” on free speech? Oh, how cute /sarcoff>

    @Hugo M:

    To know what is possible, look at what the “doers” do to defend.

    In Mountain View is a Very Sensitive Site. It has a bunch of large dish antennas pointed skyward. It is called “The Blue Cube”, as that is what it is. A large pastel blue cube of a building.

    Not a single window visible. Heck, I don’t even remember a door… (Backside or perhaps via tunnel?)

    “Sig-Int” methods let you read what is on a screen remotely. You can pick up key strokes remotely. Etc.

    It has NO internet connectivity. ( MIL spec nets only, and while I’ve not been inside, I’d speculate that ‘the good stuff’ is air-gap from the rest…)

    To know what is likely, look at what is known to have been done.

    EVERY modern printer puts encoded information on the paper. It has ‘features’ designed to make photocopied US $ defective (some will refuse the copy process). At The Request Of The Government… Recently it was found that “digital picture frames” from China had a ‘backdoor virus’ installed at the factory. Plug one into your computer and while you download your fishing picture, it uploads a backdoor for the Chinese Government…

    EVERY cell phone for the last many years has a GPS locater built in. WHY? Because once, one hacker, used a mobile phone to avoid being located. The government doesn’t like it when they don’t know where you are… so by government mandate your cell phone tells them where you are. Oh, and they can turn on the camera and microphone remotely (you can too, if you learn the hack that does it…). And folks wonder why I leave my cell phone turned off unless I want to use it… and why I take the battery out if I really care.

    Expect that you are tagged, located, and monitored any time you become ‘interesting’.

    There is a pattern that I’ve observed. It might be ‘accidental’ or it might be deliberate. I lean toward deliberate due to ‘existence proof’ of some instances that are deliberate and the shear number being unlikely by accident.

    Over time, as software becomes popular, it becomes less fundamentally secure. MS WIndoz is horrible at this. It leaves WAY too much information in places that are hard to find and remove (when any programmer with half a brain cleans up after themselves). It is a forensic treasure trove. It is a nightmare for someone wishing privacy. It is a tragedy for the companies currently being hacked all over the place…

    At present I am in a battle with Java. I’ve reinstalled it twice and finally gotten the control panel to give me the “shut off auto updates” tab. Except that despite all my best efforts, it still auto-updates….

    IMHO, the major popular (nearly mandatory) bits of software are most likely all “buggered” with “features” that were ‘requested’ by some TLAs. (Thus my fondness for Linux / Unix – among other reasons – and my fondness for ‘air gap security).

    That is also why anything I really want to be secret lives on a laptop without any network connectivity at all, built in about 1990 something, running a version of LInux built from source code. “stuff” is moved to it on CD (no ‘write back’ possible).

    Per “hidden communications” channels: That is why I like “blinky lights” on my network equipment. If things start talking, and I’m not “doing something”, well, “that’s a problem”… (And why I shut off ALL auto-update-anything…)

    Look up “stunnel”. It lets you build hidden Virtual Private Networks tunneled through other protocols. You can even make such channels through other, seemingly innocent, protocols.

    Per filesystems vs file encryption:

    Yes, strongest is to have locked boxes put inside a locked vault… Preferably with different methods. Always with different keys and passphrases. One of the MAJOR problems with an encrypted file system is that when it is “open” it is ALL open. A ‘cracker’ on your box can wander around in all of it. Soo…. have a nice encrypting file system, but get a backdoor virus, and the “bad guy” can read all your stuff any time you are using that file system… ( So I have the ‘container’ set to ‘read-only’ when not in use and ONLY mount / decrypt the filesystem when I need something that is on it. I’m also laying out the ‘storage plan’ so that there will be multiple containers with different classes of stuff in them. That way only PART is ‘open’ at any one time. The rest are ‘read only’ encrypted blobs…).

    Clearly, inside that, having the individual files of sensitive stuff further encrypted is ‘better’… except that you end up with an ever expanding number of passphrases to keep straight…

    FWIW, I’ve had the ‘habit’ of having most of my ‘stuff’ on external disks that are primarily left turned off or unplugged for a couple of decades now. The power switch is a hard thing to change remotely ;-)

    The basic pattern here is: Fractionate, isolate, and only have powered on and decrypted AS NEEDED.

    Truecrypt does make a point that only the file you are using is decrypted in memory (or in SWAP where MS Windoz scribbles it unencrypted… I once exploited this in a hack to capture account passwords… It is very nice that TrueCrypt has a ‘whole system disk’ encryption option to defeat this weakness in MS Windoz.) but what they do not mention is that some OTHER person or code on the computer could also initiate disk accesses and see other files that it would dutifully decrypt on the fly….

    Consequently, I often keep a ‘task manager’ window open ( or ‘top’ on linux) so that any process launching shows up… Not perfect as a good hack will hide the process name… and I preferentially buy disks with ‘blinky lights’… See something I don’t like: and the network wire gets pulled (or the wireless disconnect button gets pushed).

    Oh, and one other point: The amount of cryptext you have to work with, and any known blocks inside of it, are helpful in a decryption attack. A file system is a VERY large block of cryptext and if you watch a file edit happen, you can see what blocks changed… (and perhaps even captured the clear text of the edit) Another reason for encrypting bits inside the encrypted file system…

    OK, does any of this matter to the “average Joe”? Probably not. They are not subject to industrial espionage levels of attack most of the time and the corporate IT guys have to deal with that. Few of us really have any need to worry about TLA attack either.

    So why my ‘involvement’ and what at least ‘looks like paranoia’? Well, pretty simple. Old habits die hard. For a couple of decades I ran data centers that were under constant attack. (Some of the worst being from engineers inside the company ‘playing’…) When you are under daily attack and have the monitor logs to show it, it isn’t paranoia. Even now I know that the level of crap on the internet is very high.

    At a friend’s house we set up a default linux box. Didn’t turn on the internal firewall, just a minimal default level of it. It was late, we were tired. He just wanted a box to ‘play with’ anyway (i.e. an old ‘white box toy’). We decided to ‘pick it up’ the next day. One sleep period later… we returned to see the network box having LOTS of ‘blinkey lights’. Overnight the box had been completely cracked and turned into a drone doing automated attacks on other boxes… (Since then AT&T seems to have instituted some degree of protection against that on their networks… only about a decade late…) What this means is that a completely NEW box and new IP number was detected, attacked and compromised inside hours of being attached to the cable modem…

    So “THEY” are out there and are very active.

    Oh, and that Microsoft leaves the “remotely control this box” feature on by default is also highly suspicious…

    So yes, “air gap” security is not paranoia, it is ‘prudence born of experience’…

    Given all that, I can’t just turn off 30 years of experience of defending against it all just because I’m not “interesting” anymore.

    BTW, there’s a Whole Lot More to both topics (police monitoring and system cracking) but as I have a several hundred page book just on cryptanalysis… most of it will have to be left unsaid.

  17. E.M.Smith says:

    BTW, just for all you Windoz users out there… You might want to look at what Microsoft thinks is perfectly appropriate information to collect about you and your computer (and why you ought not ever use one for anything that requires some degree of privacy). From the wiki:

    http://en.wikipedia.org/wiki/Windows_Genuine_Advantage

    (Which Microsoft wanted to put onto this old computer I use for some things as an “update”… )

    Data collected

    Windows Genuine Advantage checks the following components:

    * Computer make and model
    * BIOS checksum.
    * MAC address.
    * A unique number assigned to the user’s computer by the tools (Globally Unique Identifier or GUID)
    * Hard drive serial number.
    * Region and language settings of the operating system.
    * Operating system version.
    * PC BIOS information (make, version, date).
    * PC manufacturer.
    * User locale setting.
    * Validation and installation results.
    * Windows or Office product key.
    * Windows product ID.

    So lets say you change your Network Card (and the MAC address that goes with it), will THAT cause your machine to quit working? Or update the BIOS? Swap a mother board? Change / upgrade your hard disk? Decide to try running in a foreign language for a while as you learn one? Move to a new “locale?” (or perhaps travel).

    At what point do you get enough ‘points’ on your ‘license’ that they decide to automatically and remotely suspend it? (Yes, it does that… at least some of the time.)

    Time bomb

    Even if WGA does not really make the program unusable, no updates except critical ones can be downloaded from Microsoft. Rather than just disallowing updating, Windows Vista originally ran in reduced-functionality mode if found by WGA to be compromised if a product has not been considered genuine which has made some people compare WGA to time bomb software. Windows Vista SP1 has removed this behavior and reverted to the nag-only methods of Windows XP.

    Spyware accusations

    The notification tool has been accused of spyware-like behavior, “phoning home” on a daily basis. Microsoft subsequently admitted the behaviour, but denied that it amounted to spyware. Following pressure, Microsoft announced that in future the tool would only phone home once every two weeks, instead of every day. Microsoft has also provided removal instructions for the pilot version of WGA.

    Despite this, Microsoft was sued under anti-spyware statutes over WGA’s non-disclosed “phone home” behaviour. The lawsuit has since been dismissed.

    False positive rate

    The WGA program can produce false positives (incorrectly identifying a genuine copy of Windows as “not genuine”). This can happen for any number of reasons such as failed updates, etc. Microsoft has established a forum to help users encountering problems. In February 2007, a “Not Sure” section was added to the program, in case of an incorrect reading.

    According to an editorial on the arstechnica.com technology website, WGA reported around 22% of 500 million Windows computers as failing the test; of these less than 0.5% were due to pirate software, with the balance (over 20%, or 90% of all positives) related to non piracy issues. Microsoft “refused to comment on the rate of pure false positives” beyond saying it was “under 1%” (or as stated, at most around 5 million users affected).

    No, I don’t have “auto update” turned on for MicroSnot and yes, I am always choosy about what they get to shove down my throat…

    As of now the functionality in Linux and OpenOffice has eliminated most of my need for Windows (mostly just the occasional bit of software that does not yet run on MS Windowz or the newest file format from MS Office for Yet Another Annoying Mutation Designed To Force Upgrade Purchases… So folks who use such a format will be asked to save as an old format and resend…)

    I still have it on a couple of machines, but mostly like using non-MS products.

    I don’t need a “chatty Cathy / tattle tale / gossip” on my machines that can suddenly and capriciously decide to break my computer when their authentication computer is down (as it has been twice…) so even though my copies are licensed, I see lots of risk in depending on them and little loss in just saying NO! to intrusive vendor behaviour.

    There’s a whole lot more in terms of reasons not to use Microsoft products, but I’ll leave it at that… well, almost that… Say you buy a copy. It is licensed for use on one machine at one time. This legally lets you have two or three machines with the software installed, you just can’t use both at the same time. This software enforces a DIFFERENT license. It enforces “one and only one unique instance of hardware ever”. IMHO, that is theft of my license rights AFTER I bought the license…

  18. R. de Haan says:

    Nice to find out I’m not the only one who takes the battery from his cell phone.
    Same habits with auto update. It’s off.
    I use both MS and Apple operating systems but prefer MAC OSX.

    I don’t like the concept of cloud but with future hardware upgrades and the new software it will probably become impossible to get around it.

    I just read over 6.5 trillion people have a cell phone and a contract.

    The combination of internet, social media and the cell phone have created
    a world that would trigger wet dreams with all the Apparatchiks in the former DDR.

    Most people are totally unaware about the spy opportunities that come with our magic boxes.

    And those who should just declared their networks are…. indefensible.
    http://www.wired.com/dangerroom/2012/01/nsa-cant-defend/

    That at least is a small comfort to me

  19. E.M.Smith says:

    @R. de Haan:

    Yeah, small comfort…

    A couple of decades ago I had the “privledge” of dealing with a “secure” site in Hawaii to tell them that a probable Russian Agent / Hacker was inside their boundry router. (We called them using the phone number WE got out of said router as we followed the ‘bad guy” in… he was bouncing off our boundry router after he figured out he could not get through our firewall…)

    All the guy at the other end wanted to know was how we found out they were on the internet (as they were supposed to be disconnected…)

    That was when I knew we were in real trouble.

    A secret base / operation that had a backdoor to the internet that was officially forbidden and all they cared about was that we not let anyone know… and didn’t really care that a hacker was breaking in to their site as we were talking to them and telling them.

    And yes, the number of ways every single person is tagged, tracked, and monitored is just horrific. Yet nobody seems to know or care.

    SIDEBAR:

    This message is from Firefox under MEPIS Linux on a fairly good box. While the look and feel is Very Nice, the install was a bit nerve wracking…

    Everything was FINE, except that when I went to reboot Windows XP (that the partition manager had slid to the side) XP freaked a bit and decided to audit it’s disk and then said that the space marked as free wasn’t and promptly shutdown. MEPIS then booted and refused to mount the windows partition complaining that it was marked as ‘uncleanly unmounted’ and needing TLC. Rebooting XP (again) eventually fixed it… and everything is fine now…

    The “look and feel” is very nice, and it is very usable, but MEPIS seems to be a bit of a resource Hog… Just typing this into the message box has the user percent of CPU running at 40%. It ought to be near zero… Oh, and booting the OS with the browser open has used 740 MB of memory. Those are numbers you expect to see for Windoz, not Linux (where I’ve run it, often and fast, on 128 MB memory sized boxes and not run over into swap space… This one is 2 GB and not using swap either…

    So while I was hoping that it would improve if installed to a disk instead of as a ‘live CD’, it’s just a big ‘doggy’ on the performace side… But at least the partitions are now built so installing other releases to try will ‘go faster’…

  20. adolfogiurfa says:

    @E.M.: I think that Windows has exaggerated so much in meddling in every computer than many have changed to other OS´s because of the obvious slower processing.
    I still insist that, if those intrusions are real (and it seems so), they, whoever they are, are being childish: God, Nature, The Force or the “Big Electron”(as George Carlin said), is the ultimate “conspirer”: Just remember how many years lasted Hitler´s “Thousand years Reich”….a few and pathetic four years!

  21. E.M.Smith says:

    @Adolfo:

    At one time I ran a $40 Million supercomputer. The desktop of today has more capacity, yet is crappy. It all comes down to ‘code bloat’ and bad programming. (Everyone has embraced the notion that efficiency doesn’t matter… so, for example, a browser that used to fit in 64 MEG of memory is now needing 1/2 GIG and doesn’t do much different.)

    This is being typed from Ubuntu that I’ve just installed over Mepis. It is using 674,814 MB of memory to run the OS and Firefox browser. (It doesn’t have the lag time on key strokes that Mepis had, but does have the code bloat and large memory waste).

    At ‘install time’ (despite my refusing to check the box to ‘check for updates’ over the internet) it was a ‘Chatty Cathy’ and ran off to the internet every so often anyway. (Including a gratuitous download of “language packs” in the middle for 5 minutes… that could have been an hour on my old network, or several hours on a dial-up… and no, there was no choice and no bypass offered.) Further, it informed me that all new Ubuntu users have a free account on some Ubuntu One or some such so I could send all my files off to (wherever) to stay synchronized across all my machines…

    On the good side, it has an option to have your home directory encrypted.

    It also offered to import all the files from under the MS Windows account.

    On the downside (despite claiming to have imported them) the files are nowhere to be seen on the Linux side… Oh, and I can’t “SU to Root”, so somewhere along the line the passwd got munged OR it is “protecting me too much”.

    Look and feel is nice, and online support looks great (if way excessive).

    But for an efficiency oriented security oriented guy, not for me… Guess it’s on to the NEXT package… ( IF I get desperate, I’ll just dig out my old RedHat CDs and install the release that is fast, small, secure, etc… )

    It just amazes me that the same Linux core that can run in 32 Meg with room to spare and be fast and agile can be turned into a bloated insecure Windoz Wanna Be with just a few options set. ( At compile time you can set the memory for each part to ‘expect’ and cause code to suck up memory with a single switch…) Sigh…

    Maybe I need to just roll my own from the source code. I’ve done it before…

    Or maybe I just need to do a web search for “Sysadmins Dream Secure Linux” ;-)

    Well, a sudden urge to run that search returned:

    http://www.linuxjournal.com/magazine/billix-sysadmins-swiss-army-knife

    A BBC with a tool kit, Damn Small Linux, and autoinstallers for several other Linux releases ;-)

    Also a link that claims to be “blogs for sysadmins by sysadmins”:

    http://sysadminblogs.com/planet/

    I think I’ll do Yet Another Install Of Something Else and then see what they say about Linux for Sysadmins releases. 8-)

    (Yes, I know, I’m a sick puppy… what other kind of person would do one full system install per comment ;-)

  22. P.G. Sharrow says:

    @EMSmith; I will watch with anticipation! I started with DOS3 and WORKS and Acad in a 8088 machine. I have disliked MSoft from the start and attempted Linux from before version 1.0 but as I needed a box that did all the work needed I have been stuck in windoz machines. It always seemed that there was a work around in Linux if you had a better machine and knew how to find all the work arounds and installed and correctly addressed them. A bridge further then I wanted to go. And as to dual installations for learning while I used microsoft and the needed programs and then practiced on the Linux side, Microsoft hates linux and always trashed all the hard drive, sooner or later a full on crash and I would have to rebuild everything from floppies. My latest Ubuntu attempt lasted about 10 days before XP went nuts and trashed everything. XP is so full of errors that it needs restart every 2 or 3 days> What a piece of crap and MS want us to upgrade to vista or 7. I run a Dell Dimension 2400, celeron now. Way more then I need for horse power, still It’s nearly obsolete. Grrrrrr. pg

  23. E.M.Smith says:

    @P.G.Sharrow:

    Well, so far the answer looks to be a variation on Mepis named “antiX” that comes in a x486-32 variation. That’s what I’m using right now and it’s running at 27% of CPU (so about 2x to 3x better) and as low as 10% if I type slowly ;-) while memory is at 106 MB with 883 MB total allocated (the other 1.x GB being RAMdisk at the moment as I’m running the “live CD” right now.

    Has an odd browser named ICEape… but I’m expecting FireFox to be in the installed version. At any rate, I’m going to do the install now.

    Per Windowz blowing up and taking out your Linux Partition: That ought not to be possible! ( Assuming you do the install into different physical partitions…) In the past I always did them to two different hard disks internally anyway, but since disks got gigantic (i.e. over 10 GB) I’ve just done different partitions and not had an issue….

    Also, whereas a decade back it was nearly impossible to use MS Word and Excel docs under linux, it’s now pretty seamless. OpenOffice seems fine to me (then again, I rarely do ‘fancy stuff’ in excel…)

    At any rate, what looks like the “magic bit’ is that the 64 Bit distributions are built “fat and slow” and the 32 bit distributions are built “light and fast”. So I’m going to install this ‘lighter faster 32 bit’ variation and see if it decides to be piggish when not running from CD…

    OH, and I’m downloading a 32 bit distribtion that is just a bit under 1 GB in total size named “Pear Linux” that claims to look like the Mac O/S and has decent reviews…. If it really is, and works at all fast, I does have the Mac EyeCandy look to the screen shots …

  24. E.M.Smith says:

    OK, a bit of looking shows that “IceApe” is a rebranded “FireFox SeaMonkey” due to Mozilla corp wanting to call the tune on a non-free lucense…

    The dictionary that comes with it is very limited so my spell checking is all wrong… but it looks to be workable.

    Oh, and I’m now running from an installed to disk version… CPU at about 14% to 50% depending on what all I’m doing and memory running 78 MB as I type… Nice… ( I know, why worry about staying under 128 MB when I’ve got over 2 GB of memory… It’s just a question of being efficient, that’s all…)

    In general, I like it. I’ll likely leave this one up for a while, at least until I get a chance to try the “Apple like” version named Pear ;-)

  25. E.M.Smith says:

    Well…. This has been, er, interesting…

    The “antiX” version of the GRUB installer seems to have munged the Windows partition in some way such that it doesn’t boot any more.

    (It gives a “NTDetect Failed” message just after the chainloader kicks in).

    OK, normally one just uses the XP CD to ‘repair’… except I don’t have an XP CD…

    Besides, I can SEE all the Windows files just sitting there….

    I reinstalled the MEPIS version (that didn’t munge the XP boot) in the hope it would ‘fix’ whatever the other version munged, but no joy….

    With it, though, I’ve got the NTFS partition mounted and I can see all the boot.ini et. al. files. The contents look normal and the datestamps don’t show a current date (they are mostly back about 2009…)

    I am presently backing up everything (that is already backed up – as of a month ago – onto a Seagate USB drive stored elsewhere) via a “tar cfv – . | gzip > NT.gz” that will be moved onto ANOTHER USB drive before I do anything more.

    My only guess is that putting GRUB in the Master Boot Record managed to mark that disk partition as non-bootable…. so I’m going to look at it with a partition tool after the backup is done.

    But I would have expected the MEPIS install to have repaired that (as it installed a GRUB that expects Windows to be there and bootable too…)

    As almost everything I care about on the box is in OpenOffice, I can simply restore them onto the laptop and keep on going… but still… To have all the Windows stuff looking like it’s all Just Fine, but still won’t boot is just a PITA.

    Oh Well… I’d really rather not have to scrounge up an XP CD and do that whole Windows “redo everything thing” just to twiddle some bit somewhere…

    So, for anyone else thinking about trying “antiX” be advised that the present version has a boot load install that is broken in a way that will cause it (at least some times) to blow your ability to boot Windows.

    Really annoying, when you think about it, as the MEPIS version works just fine and they are both from the same folks. In theory the “antiX” version is just MEPIS with different compile flags set and a slightly different package mix of applications. The whole GRUB/bootloader part ought to be the same code and process.

    If any of you’all happens to be a Windows Expert and knows what bit to twiddle to make it happy again, please speak up. I can read and edit ALL the Windows files (such as boot.ini). I just don’t know for certain what ought to be in them and what is missing that makes this a ‘no joy’ situation.

    Windows is on hda1 and the boot.ini says to boot 0,0,0 and GRUB clearly hits the chainloader that I’m pretty sure is launching that boot.ini so it all ought to go, near I can tell from a first look. (Linux is on hda3, swap on hda2, and /home on hda4 and all work fine; GRUB loads Linux fine too)

    (Isn’t this entertaining to watch … as long as it’s not YOUR box? ;-)

    Sidebar on Urgency: For anyone wondering, this box is mostly used just to run OpenOffice and the occasional MS Office application. It also has StormPredator on it, but I’ve got that CD so can just install it on the laptop. IF I can’t recover the XP partition easily, it’s not a big deal. I can have 99% of everything I use it for moved to the laptop or to Linux on the same box inside a couple of hours. It is more just a matter of “It ought not to be like that” and wishing to ‘set things right’… My general ‘style’ of operation is to keep data files on removable media so loss of a ‘box’ just means a copy onto the new box. I also avoid using any purchased software if at all possible so that’s typically not much of a practical impact. Still, this box DOES have some software on it that I’d rather keep running (that came with it) as it’s a nice suite to have ‘available’ if needed. So this is “not urgent, just wrong” ;-0

  26. Hugo says:

    E.M., this is why I stay away from grub: I ‘ve been through this about three times. Anyway, there is a XP utility named fixmbr, and also fixboot. But you do need a XP CD … another possibility: Even grub should have created a backup copy of the boot sector before installing itself there. Try to locate it and copy it back using dd -if /path/to/bootsec.backup -of /dev/[s|h]da bs=446 count=1.

  27. E.M.Smith says:

    @Hugo:

    Thanks for the ideas.

    FWIW, the update:

    As of now, I think that something is wrong with the first partition and / or the ntfs file system code under LInux. In theory the partition was mounted read / write (and I’ve used such under other Linuxes so I suspect the file system is a bit dodgy and that the thing that did the re-write of the MBR blew it…)

    Why do I think this? I tried to “touch” a file and got an error message about writing to that file system. An attempt to open boot.ini worked several times, then it was empty. So catting it was fine, as was my backup copy. But open it in a r/w editor and it went to empty. Attempting to copy it back from the saved version returned the ‘write fail error message’ again (but did change the date stamp).

    Mostly I think this particular release of the Linux / Grub / whatever is broken in a way that has mildly corrupted the boot partition and I’m going to need to rescue it with XP tools. Sigh.

    As I’ve not used that OS / system for a few months, I’ll likely just leave it turned off for a few more ;-) I can use the data from it on the laptop just fine…

    For now, it’s going to just sit. Maybe I can find someone dumping XP and get their CDs cheap ;-)

    I’m also going to overwrite the linux that is on it with an old RedHat from about 8.0 that was stable, fast, and worked well… At least until I can show what’s causal and what isn’t…

  28. tckev says:

    Good luck with the project.
    I use Windows for most of the work but NEVER online stuff. It proved itself too open to malware attacks. I use PClinuxOS or Ubuntu when online.
    You’ve probably heard of Tor network as a more secure way to communicate with unknown sources but if the US Government has it’s way that will be illegal too. Its site is –
    https://www.torproject.org

    Good luck!

  29. E.M.Smith says:

    @Tckev:

    I would not use Windows for general ‘surfing’. I basically visit all of 3 sites on a regular basis (maybe 4 if you stretch it) from the desktop.

    But I do have to admit to being spoiled by the Mac and Linux. Unfortunately, “page weight” has become so heavy lately that using the Mac for browsing is now painfully slow. (Hey, it’s only a bit over a decade and somemore old and I’m sure it has at least 64 MB of memory ;-)

    Frankly, I’d be running the new HP laptop dual boot w/ linux were it not for their stupid partition layout and the video / wireless drivers being ‘new’. I figure to give things about a year and they it will be ‘easy’…

    Mostly I used the desktop / windows for doing some temperature data downloading and making all those dT/dt temperature graphs… and occasionally reading email from a trusted site.

    It’s not exactly a priority for me.

    I’d actually left it turned off for 4 months when in Florida and another 2 after returning. Figured it would be better to use it for ‘something’ so was testing various Linux installs on it. If it sits for another 6 months, well, I doubt if I’ll notice…

  30. adolfogiurfa says:

    About SOPA (soup in spanish):We should need a new kind of internet if control measures are enforced: Like the “whales´internet”: Whales communicate among them using VLF, all what it would be needed is private transmitters (made after Nikola Tesla design) and an USB VLF receiver, and, of course, computers running under Linux from a CD drive.

  31. PhilJourdan says:

    Adolfogiurfa – SOPA – I was struck by that name as well and its meaning in Spanish (my wife is Mexican). I would say that the MPAA and RIAA have finally over stepped their bounds and found themselves in a very nasty soup.

  32. John Slayton says:

    You and your commenters clearly have considerable expertise in encryption and I, alas, have none at all. However, mere ignorance never yet kept an American quiet, and I have this idea that’s been bugging me for weeks. So let me trot it out and you guys can tell me why it’s not practical.

    The problem is how to get into the encrypted file containing CRUtape Letters v.3. Just about everything I’ve read focuses on breaking the encryption itself. But I wonder if our local safecracker might provide a useful analogy. No, I don’t mean the klutz who blows the hinges off with C3. I refer to the talented pro who puts on his headphones and uses an amplified mircrophone to hear the tumblers fall as he turns the dial. This man is not concerned with decoding the combination. He may not even be looking at the numbers. Rather, he gets in by exploiting a vulnerability in the _machine_ that incorporates the combination.

    An encryption program runs on a machine. There are no tumblers to listen to, but it is possible to vary the input and observe one aspect of the machine’s operation: its response time. Zip7 asks me to input a password; it then analyzes my input and makes some sort of response. The elapsed CPU time can be measured with the (gnu/linux) clock() function. (At least I think it can. This function is found in the Gnu C Library, but the Zip7 source code is written in C++.) And it is possible that inferences can be made based on that elapsed time.

    Simplifying (and quite possibly incorrect) assumption for illustrative purposes: The Zip7 analysis processes the input from left to right, one character at a time.

    Suppose I make 512 successive attempts with purported passwords that are identical except for the first character, which systematically varies through all possible ASCII codes. One of those codes will be correct; 511 will be incorrect. The program branching will be the same for 511 inputs, and different for just one. Unless the writers of the program anticipated this vulnerability and took the obvious counter measures (a real possibility), it is overwhelmingly likely that the number of CPU cycles reported by the above mentioned time function will be distinct for the correct character. The process can then be repeated using the known first character to search for the second, and so forth until the entire sequence is known.

    Of course this would not be done by hand. It should be easy enough to write a Bash script to do it. Yes, there are all kinds of complications that would frustrate this approach. Simple example: the Zip7 analysis might begin by examining password length and rejecting anything the wrong size. In this case all 512 possibilities would return identical response times (unless you got lucky as to password length). But even in this case, an analysis of response times to passwords of different length could first determine the correct length, and hacking could procede from there.

    So why haven’t I tried it myself? Because I haven’t yet been able to find in the source code where it inputs my password submission. But I’m open to suggestion….

  33. jakubwz says:

    Epic article .. and absolutely true with the TLA. Being paranoid these days pays off in many instances and I was putting the TrueCrypt installation away for way too long. Thanks for the article, I like it and will be doing fresh install of my laptop this weekend. The fact you implemented the reading speeds is great, that was my biggest worry ..

  34. al says:

    One thing that really annoys me about truecrypt is if you are forced to type in the password for the outer volume while the “bad guy” is looking over your shoulder, you must risk either checking the hidden volume protection option and hope to god he doesn’t notice and doesn’t catch a glimpse of the type indicator “outer” from which he will certainly deduce there has to be an “inner/hidden” unless he is a complete idiot, or allow him access to your dummy files in the outer volume without protection, which he might mess with, which might in turn mess up your hidden secret data due to a possible overwrite.

Comments are closed.