Hi All,
I am an avid listener of the Podcast Security Now! with Steve Gibson and Leo Laporte. In episode SN-130 at 01:01:53 (about two thirds through at www.twit.tv/sn ), Steve suggests using AxCrypt, however, that must be installed in windows.
But in the same discussion, Steve also suggests Omziff as a freestanding executeable standalone encryption application. It can be run from any thumbdrive and is currently hosted at www.xtort.net/xtort-software .
The neat thing about AxCrypt is its ability to create a self-extracting encrypted file!
Please consider encryption software for your site.
Visit the Community page
Join our forums
Subscribe to our email newsletter
Subscribe with RSS
Follow us on Facebook
Follow us on LinkedIn
Follow us on Twitter
Follow us on Mastodon
Follow us on BlueSky
Check out Toucan and 7-Zip. They both support AES encryption, and are both available in Portable editions from this web site. With a sufficiently long password they should be fairly good.
MC
Steve Gibson is one of the biggest jokes in the computer industry and "real" security specialists laugh at him. I suggest you get a more credible source of info.
http://en.wikipedia.org/wiki/Steve_Gibson_%28computer_programmer%29#Cont...
http://www.engadget.com/2004/08/13/guaranteed-security-pathlocks-e100-ne...
Cancer Survivors -- Remember the fight, celebrate the victory!
Help control the rugrat population -- have yourself spayed or neutered!
Perhaps you can suggest a source of more credible info then BuddhaChu...because your previous links are not that credible either.
Your first link is to a Wikipedia page. The great thing about wikipedia is that it is community maintained and edited. The crappy thing about Wikipedia is that is is community maintained and edited. IMO, this means that wikipedia cannot be taken as gospel and cannot be taken as purely objectionable, even though the article may have a very objectionable tone to it.
Your second link is even worse. It is an opinion piece. It offers no proof that Mr. Gibson is "one of the biggest jokes in the computer industry" (your words, not mine) other than he endorsed a product that the author saw no value in.
Maybe Mr. Gibson has not been totally correct in some of his statements in the past or has mis-represented them, but I seriously doubt that you could say you have never done that in your whole life either...it is human nature.
I believe that Mr. Gibson's presence through things like the SN podcast and his site is important as he has the ability to reach the masses, so to speak. He may not be the most brilliant security minds in the field, but he efectively communicates the basics of security to the masses, which will hopefully help the whole situation, if only by making people aware that security needs to be addressed.
I never had any respect for Leo LaPorte before either...but now I see that he possesses some of the same qualities that the IT industry needs. He is able to talk about technology in terms the masses understand.
Do I care to listen or watch Leo on TV or podcast? Not so much. But that is now mostly because I am so far beyond his understandings that I get very little from his shows. Would I recommend that my Mother or Grandmother listen to him? Sure...he can explain things in terms they understand...something that I have not been able to master.
Until late (iPod go all asplody) I listened to security now. And while I may not put Mr Gibson in charge of my network security, I find it useful for refreshing my memory on topics that I don't touch very often or bringing up topics that I may have overlooked. Even more useful though is the metaphors and 'Joe Sixpack' translations that I get of security concepts so that I may better help less technically inclined friends and family. Sure Mr Gibson can get overly eager/dramatic sometimes, and sometimes how he presents information can be misconstrued. And sure SN! sometimes is just one big commercial for spinrite. (side note, which drinking game gets you drunker faster? everytime Mr Gibson mentions spinrite or every time Mr. Dvorak mentions dvorak.org/blog ?)
/ramble
More info is better, never trust single source info.
www.pauldotcom.com
ZDnet - ThreatCast
Hak.5
others?
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
WinPT Portable with GnuPG Portable backend.
And I thought John C Dvorak was the biggest joke in IT.
Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F
As well, there is a fork of the PAM called geek.menu that has integrated support with true crypt. It is available at http://geek-menu.sourceforge.net/.
I am not sure exactly what you want to use encryption for, but things like 7Z and Toucan ma not cut it because they can not crypt "on-the-fly" That is they need temporary storage (on a disk) to decrypt the file to and then give (the decrypted version of) it to the viewer program. Since the intermediate, decrypted data is stored (at least temporarily) on disk, there is the possibility to recover this information after it has been viewed and the intermediate files erased.
True Crypt, OTOH, uses on-the-fly crypto, so it only ever stores the encrypted data in RAM (although if that RAM gets swapped to disk, there is the potential to get at the unencrypted data even after the RAM is swapped back to disk). It emulates a separate drive and uses the Windows kernel to present the decrypted information, so all programs that can work with files, work with a Truecrypt mounted volume.
The only issue I have ever found with TrueCrypt is that is requires admin privileges to run (if it has never been installed, which I never do as it is completely portable), as it needs to load a kernel driver to perform the on-the-fly crypto. This, as I understand it is a quirk with the Windows security model or kernel design. Linux has attempted to solve these types of issues with the advent of Userspace filesystems and userspace driver loading. I don't believe that there is a similar concept in Windows.
"I am not sure exactly what you want to use encryption for"
I assume keep private data like login accounts etc private when you lose your Flash drive...
Well, since the two programs cited by the OP do not do "on the fly" encryption, 7-zip and Toucan are probably as good or possibly better than those examples.
Requiring admin privileges is a show stopper for anyone who might need to use a USB drive on a public computer, since they are so frequently "locked down". Given that caveat, I agree that something like TrueCrypt can solve the problem quite nicely, and eliminate several (but not all) of the problems that might give headaches to the end-user.
MC