I've been using PortableApps on a thumb drive for a couple of years. I really like the ability to use public, or a friend's, computers as a back up. All the applications I need, except taxes and Streets and Trips, are portable. I have dial-up at home, so Firefox on a stick WAS particularly helpful.
My local library's wifi doesn't allow email to be sent through lavabit.com so last week I plugged my thumb drive into one of their computers to email. I got a message saying I couldn't run my applications from a portable drive.
I inquired and a worker called whoever takes care of the computers. The computer guy said someone tried to hack into the library computer using PortableApps so he "turned them off" throughout the system. This has been done within the last 2 weeks.
I guess this is just a heads up for others who think they'll be able to use public computers with PortableApps until they can replace a personal computer. If this type of thing becomes commonplace, it could be a real pain.
Bob
Visit the Community page
Join our forums
Subscribe to our email newsletter
Subscribe with RSS
Follow us on BlueSky
Follow us on Facebook
Follow us on LinkedIn
Follow us on Mastodon
Follow us on Twitter
That seems to already be commonplace. My library, for example, is locked down like a bank - everything is blacklisted except a very small, very select list of apps. Even Windows Explorer is locked, and I had to use a bug in IE to get to Windows Calculator. Trying to load anything from a flash drive was absolutely impossible.
From what I've seen, especially since viruses like Conficker spread via removable drives, many businesses/libraries/other public places lock their computers to prevent anything running from a removable drive.
"The question I would like to know, is the Ultimate Question of Life, the Universe and Everything. All we know about it is that the Answer is Forty-two, which is a little aggravating."
I guess I'm one of the lucky ones. My library got new computers and installed time tracking, but on the flip side they enabled keyboard shortcuts, the Start Menu, and even right clicking.
Tell the computer guy that it'd be a better idea to clean the computers instead using stuff like Windows Steadystate. It gives you greater freedom while maintaining security (as long as you log out).
Insert original signature here with Greasemonkey Script.
It was nice while it lasted.
PortableApps are run in countless libraries. If you tell me which library, I can talk to them about it.
lvccld.org
prendergasta@lvccld.org (IT director, from website)
Just started using the libraries free internet to save myself money while looking for jobs and we're locked down from running the installer from the portable drive, from the desktop, or anywhere.
I'm not sure if the portable firefox will work or not yet.
If your offer still stands to contact them about unlocking them it would be great.
The pc's here have no drawing programs available, and I'm trying to run portable firefox or chrome to use google doc's drawing program -- making some flyers and door hangers for a small business detailing cars until I find a real job.
Well anyway, thanks again if you're still up for discussing it with them.
-Frank
Is the problem that you can't install portable apps, or that you can't run them even after they are installed?
Just to be clear, after the app is installed, then the executable that runs it portably is referred to as the Launcher.
I made this half-pony, half-monkey monster to please you.
If you'd like to discuss this with their IT department, I'm sure others would appreciate it too. Thanks!
Somebody tried to "hack" the system with PortableApps.com?
Let's hunt him down and beat him with a stick.
I don't even see how that's possible with the Open Source Apps we use on our Platform.
I'm thinking you should talk to the library manager. I can see why he did what he did, but I don't think it's PortableApps he should be disabling.
From the OP, it looks like running anything from a removable drive has been forbidden.
I'm pretty much with you, though, how is that even possible? (Or did the library guy mean Portable Freeware? They have some tools there that could possibly be used maliciously...)
"The question I would like to know, is the Ultimate Question of Life, the Universe and Everything. All we know about it is that the Answer is Forty-two, which is a little aggravating."
Depending on how big this library is, but I'm assuming that it's not the library of congress or anything, then it's probably run mostly by volunteers and the "computer guy" just happens to be the person who knows the most about computers but still comparatively little. Consequently the easiest course of action is just to forbid everything, dust yourself down, job well done.
I spoke only to a library worker. She told me no programs could be run from "those" (pointing at my USB drive). And my mistake, I should have used "portable applications" rather than "PortableApps".
Now, I CAN come with a stick for beating the hacker...
Actually prosecution would really be nice. I'm not only paying for the library but a perfectly good jail as well.
The library has about six branches and a significant paid staff. Its not tiny but certainly not a major metropolitan library system. Since it is publicly funded, I don't see a problem posting a link.
http://www.medina.lib.oh.us/index.asp
Perhaps, if a knowledgeable person could provide a calm, well reasoned, and workable alternative to the current ban, it might be considered. But the 7 member library board is appointed to 7 year terms. They have no incentive to be helpful. Still, a friendly suggestion couldn't hurt. It undoubtedly was easier to forbid portable applications completely rather than plug the holes in their security system. There are likely too few using portable applications to be considered significant.
I think the computer person is full time or an independent contractor. There is a sign in procedure for using the provided computers (not the wifi) but it is only your library card number and last name for a password.
Thanks for commiserating. Losing Firefox on their high speed computers, with my own bookmarks, is a pain but it still works on wifi... as long as my laptop lasts.
Bob
Information on this is in the "Running From a CD" section on each Portable App page.
For instance, Thunderbird:
https://portableapps.com/support/thunderbird_portable#cd
For e-mailing, I've also used the site mail2web for years, and I've never seen a place that blocks it.
I made this half-pony, half-monkey monster to please you.
Using mail2web, or any other similar product/feature/website is a grave security risk. Basically, you are giving your email and password to a third party, from which they can (and do for the most part) later on download all your emails, see all your personal information you entered while registering for that email (full name, sex, birth date and/or place, full address or just the postal code, and optionally even work address, telephone number, mobile number.....). It would take only (1) a mentally impaired person, (2) a person who has encrypted all his communication and is very, very confident about it, or (3) a very gullible and naive person to "trust" such a service provider. Have you ever considered what you were giving them actually?! And they, as far as I can see from their website, offer NO new feature (at least not for free) which you haven't got in ThunderbirdPortable. And if you want to have email on your phone (for that you need to pay them), it's better to use your own cell phone to access the Internet and download your mail. It's definitely cheaper, and far more secure than this option.
As far as the part about running from a CD, that may be a good solution. Autorun (on CDs/DVDs) is disabled on most public computers (at least in Serbia), but one can still open it with Windows Explorer and run a program manually.
Note: I don't think that YOU are (1), and definitely not (2). Most users of mail2web service are just plain old naive and gullible (3) from my first paragraph. Just consider what information have you given to them, and how much do you trust them. If they SAY they don't sell your information, does that mean anything? Even most ISPs sell their "statistical data" to anyone who's offering them some $$
My posts are old and likely no longer relevant.
The one feature that mail2web offers is access to your e-mail if the computer you are using completely prevents you from running your Thunderbird Portable app!
It is of course preferable to use your Portable Thunderbird if at all possible.
I don't recommend using just any old online e-mail access service; however, mail2web is a highly rated (including by RatePoint and bbb) and reputable site that has generally gotten excellent reviews.
You don't have to register to use mail2web's basic services, and they don't store your login or password. I'd be more concerned with storing password in your browser (which most modern browsers do).
That being said, it is true that all online services are not equal; users should take into account the risks, and research the reputations of all the companies that they use on the net. So there also is (4) a person that understands the inherent risks of the internet and informs himself when using it.
I made this half-pony, half-monkey monster to please you.
Your points are valid, but I still prefer and would recommend making a wide circle around any such service/software. Well, the (4) kinda translates to (2), because only those that are informed can be concerned with privacy (when they realize how relative that term is on the Internet).
Well, me too. I understand how fragile ones protection is if storing confidential information (passwords, email) into a web browser and/or an email client. I'm a user of a (commercial, but cheap) program named Multi Password Recovery, which "hacks" or rather extracts the passwords from such programs in less than a second! Also works on extracting it from the most popular IM clients, FTP programs, and a whole bunch of other software! I've used it, it works. If you start it with a command line argument /export, it runs for a fraction of a second, gets ALL the passwords from all those programs, and closes with saving that data into a file. You can also get a SAM file and a corresponding system file to try a brute-force attack to get all the software's inner saved passwords. And, if that's not all, it even gets all the information on the OS, installed software, drivers, running programs, password used to install that version of your OS (the license key), your ASP.net account password (which every Windoze OS has, and it can't be removed)........ And the list goes on... Yes, it's possible, it does all that in just a fraction of a second, and most AV programs don't flag it as a virus or malware! Some do, though... And maybe that's a good thing.
I have it, and used it both on my computer, as well as when a friend of mine forgot his email password and wanted to ditch using it and make a new one. He had it in his email clients, but it was "encrypted" or password protected access to the program, I don't remember, but he couldn't have done it on his own, so I helped him.
Well, this got a little off-topic (from online safety to offline safety), but it's still very useful to know. Hey, maybe that "hacker" in the Public library actually used this program, and they thought it was a "hacking" attempt?!
Quite possible, since the program does come in a portable form, and acts like such a software... Did I make you think about anything? Did this post get through to anybody? One's safety/privacy is easy to break. All it takes is one malicious person...
____________________________________________________________
EDIT: After reading this post again, it sounded a bit like I was promoting this app - so I removed some of the words to make it a little less so. I'm not promoting this app and am not affiliated with it, although I did translate it in order to get a free license key which I use. I dislike commercial-ware, and would only donate to free software if it deserves. I dislike buying software (yes, I know, I'm running Windows...). I'm only pointing out that software like this exists. This is only 1 variant of such software, there are many others and all are paid-ware.
My posts are old and likely no longer relevant.
How far do you want to take it? Google spies on your every move, and if you sign up for GMail or some other service they typically require you to enter a mailing address.
The only way to be truly secure is to not use the Internet or public computers at all.
I agree with that, you should block all cookies and javascript from Google, if feasible. Do the same for other search engines you use. Ultimately, if privacy is a concern, you should use NoScript's way of dealing with the web - WHITELISTING! Use security add-ons like NoScript, CookieSafe or CSLite, BetterPrivacy (Ghostery and AdBlockPlus with EasyPrivacy subscription are optional, but preferable), and don't allow anything, until really necessary. And preferable, use "Temporarily allow" option on websites you visit if it's necessary. Over time, those you use more often can be marked as "Allowed", and after a while you are no longer prompted to "Allow" or "Block".
That doesn't save you from leaving data behind in the hands of the Internet spying companies (yea, I do sound like paranoid here
), but it certainly substantially minimizes their acquired data.
Well, maybe that's a new option they are asking of you, but they never asked it before! They asked me for: First name, Last name, Birth date, Country, Postal (zip) code (which is the same for me as for another 2 million people living in Belgrade), Username and Password
I'm OK with them having that data - for services they are providing me with, but I don't want them to associate it to my web browsing, nor the other way around.
Well, that truly is true (pleonasm here
), and people without the Internet are blessed with not having to worry about their online privacy. But they are also missing out on a lot of things. If you want me to name them, I can, but it would only make this post a lot longer... 
Btw, I'm OK with using Public computers, just not using them for really personal stuff.
My posts are old and likely no longer relevant.
You can't be personally identified from your first and last names, birth date and zip/postal code? I bet you could get pretty close though.
We trust that companies like Google that hold this information aren't going to abuse it but do we really know what goes on behind closed doors?
I probably sound like a conspiracy theorist or something. Honestly, I don't much care, I'm not a criminal I have nothing to hide. Still, it's interesting the social dilemmas we face in this digital age.
Stay as far away from Ghostery as you can: http://forums.informaction.com/viewtopic.php?f=19&t=3724
That addon had a lot of functionality problems to begin with, and now it's worse: it tracks you. STAY AWAY.
I definitely agree with NoScript and CS Lite, though. Just make sure you prune back the NoScript whitelist (it has a lot of unnecessary stuff), and set CS Lite to default-deny.
I also have one more recommendation to make: RefControl. A lot of sites track visitors' referrers; by turning on RefControl and setting the default to Block, sites don't get that from you either.
Even with NoScript, CS Lite, and RefControl, sites can still reap a lot of information from you; however, it's not nearly as much as they otherwise could.
You might also want to look into PortableTor or a Tor LiveCD, since then sites don't even get your IP.
"The question I would like to know, is the Ultimate Question of Life, the Universe and Everything. All we know about it is that the Answer is Forty-two, which is a little aggravating."
except you start routing your traffic through other peoples computers. Basically setting yourself for man in the middle based attacks.
Too many lonely hearts in the real world
Too many bridges you can burn
Too many tables you can't turn
Don't wanna live my life in the real world
Yea, I forgot about that one... I use it all the time. Too bad it's not implemented directly in Firefox, as it is in Opera, but the extension form works for me as well. Also, my approach everywhere is "blacklisted until proven trusted" (the form of "guilty until proven innocent", imagine me saying it
if you knew what I mean by that, it would be funny - btw, I'm not a criminal and it's not in that connotation). As for Darkbee, no, I said I
And it's not that easy to pinpoint, as I had friends in my High School, exactly the same name and year, and even the same narrow living area
The similar thing is with my father... And I have a pretty common name. Birth day is the only giveaway, but then I should quote myself again (read the quote).
@computerfreaker: I use security add-ons all the time! And although it isn't as the PortableTor or setting a Tor relay, this IP address is shared with usually 3 different computers (none of them store Cookies and or LSO's or similar), and it's a Dynamic IP, so the information is always kinda disguised and there is no way to keep track when I change the IP (although, for a certain reason, I'm not changing it too many times). And there's no fear of the "man-in-the-middle-attack" either!
Well, I know about that, and EasyPrivacy ABP list takes care of it's work entirely, but for the privacy enthusiasts it's a big head start to see who is tracking analytic data of their use and from which provider. Later on it's removable. That's why I said "optionally", and mentioned ABP and EasyPrivacy also in that part.
What do you think about the scary MPR software I mentioned a few posts up? Could it have been the cause of the OP! (Yey, finaly back to being on-topic
)
Cheers
My posts are old and likely no longer relevant.
So I think we have a solution to Internet privacy... All change our name to Petar Petrović and move to Belgrade. Problem solved.
You're too much!
Seriously, the real answer is to hide as much as possible, and FOSS helps us do this.
Also, dboki, it's possible the guy used a password-recovery tool like the one you describe. There are definitely other things he could have done, though, and there's a tool for pretty much anything. I can think of one particular thing he could have done (not going to say, sorry) which would cause any sysadmin to throw this guy out of the library, then promptly lock everything down.
"The question I would like to know, is the Ultimate Question of Life, the Universe and Everything. All we know about it is that the Answer is Forty-two, which is a little aggravating."
I'm hiding right now! I even have my eyes closed so that nobody can see me!
Does that make me (1) or (3)?
I made this half-pony, half-monkey monster to please you.
Ah, but did you change your name to Petar?
Well, no point in changing the name, that IS TOO MUCH! LOL
I think you (computerfreaker) are talking about the xxxxxxxx of the xxxxxxxxxxxxxxx xxxxx xxxxxxxx? That's the first thing that popped to my mind, but xxx xxxxx xxxx a xxxxxxxx xxxxxxxxxxx xx xxxxx to do that }:) So I don't think that was it... And they would lock down the library computers completely if that happened...
(note: I don't want to name it either, but I think we are thinking about the same thing here. Just change x with correct letters, and you should be able to "decrypt" this easily if we are. Apostrophes are also marked with x).
@others again: I am/was not talking about changing your names or anything like that. That's absurd! I see there's no point in explaining it any further...
8)
My posts are old and likely no longer relevant.
Not sure what you're talking about; there's too many x's in there.
I was thinking about using the ###### of ######### to #### ### #######. (Probably too many x's in there, too)
Come into IRC (join #fcofix or #kidsafe on Freenode) and we can discuss it via PM.
"The question I would like to know, is the Ultimate Question of Life, the Universe and Everything. All we know about it is that the Answer is Forty-two, which is a little aggravating."
PortableTor does not come with Torbutton.
I've seen quite a few posts that mention third-party portablized Tor distributions. The Tor Project makes one called the Tor Browser Bundle. It is totally portable, no setup necessary, and comes with Tor (anonymizing software), Vidalia (GUI control panel), Polipo (caching proxy that addresses a Firefox bug), Firefox Portable (John T. Haller's), Torbutton (Firefox plugin to fix a few browsing risks), and alternatively Pidgin Portable (PortbleApps) with OTR (end-to-end encryption Pidgin plugin). They tweak a few things to maintain privacy and anonymity. http://www.torproject.org/torbrowser/
Orange Public Libraries in the City of Orange, CA state in their Internet Use Policy that "Library users should not attempt to change program settings on a workstation, boot from external storage media (such as a floppy disk or CD), or try to run their own software." I assume they are referring to an act of trying to install something onto the computer's hard drive. If they are also referring to running PortableApps, including copies of fre:ac downloaded directly from the project website rather than through PortableApps.com, their policy is DRACONIAN!
If that's the entirety of their policy, then yes, that includes portable software.