- Full Disk Encryption Survey
- Posted by Saqib Ali on July 9th, 2007
Please vote for you favorite Full Disk Encryption FDE solution at the
following URL:
http://security-basics.blogspot.com/...on-survey.html
or
http://tinyurl.com/2oy7k4
Please consider the following when voting:
1. Easy of use
2. Transparency to the user
3. Directory integration (e.g. integration with Active Directory or
LDAP)
4. Key Management (Backup, recovery, archiving)
5. Password recovery
6. Cost
7. User Interface
8. Reliability
9. Performance
10. Overall Functionality
- Posted by Vanguard on July 9th, 2007
"Saqib Ali" wrote in message
news:1183960591.485338.97740@r34g2000hsd.googlegro ups.com...
In order for any product to be favorite requires that user also report
what OTHER similar products they trialed or used. A user that has only
used one FDE product doesn't have a favorite. I have one sister, so the
joke goes "you're my favorite sister". You do not let the user report
what other FDE products they have used or how many total FDE products
they have used (which must be greater than one). The survey is
worthless without this info.
- Posted by benb on July 12th, 2007
"Vanguard" <no@mail.invalid> wrote in message
news:xLidnQKKLosTTwzbnZ2dnUVZ_oKhnZ2d@comcast.com. ..
I'll be keeping an eye on this survey, as I'm currently researching an FDE
solutions for about 20 of our users laptops. So far I've downloaded and
tested PGP WDE, next is CompuSec, I have a trial of SafeGuard Easy on order
(hopefully arrive in the post next week), and I'm arranging a conference
call with someone from PointSec to setup a trial of that product.
If anyone has any experience with any of the or other products, I'd be
interested in your views. Our requirements are:
Full Disk Encryption
Pre Boot Authentication
Activate Directory Integration
Easy Deployment (MSI/group policy)
Automated Encryption (no user intervention)
Cheers
Ben
- Posted by Sebastian G. on July 13th, 2007
benb wrote:
Trivial: CompuSec is insecure by design. Just create a password reset floppy
on a second machine, start the recovery at the first, insert it, and there
you go. A trivial proof that they must have stored the key on the encrypted
disk as well.
SafeGuard Easy... well, has this shit become working now? On two test
machines I saw the boot loader completely crashing, totally ignoring any
keyboard response, or not accepting any of the correct passwords.
Hm... what about actual security? In terms of encryption this means to only
Open Source software, due to a matter of trust and verification of the
implementation. CompuSec has already been mentioned. SafeGuard Easy has been
proven to be horrible insecure, f.e. not properly locking memory regions
and then letting the keys being swapped out.
- Posted by Arthur T. on July 13th, 2007
In Message-ID:<-rOdnZqXnMlJGAvbnZ2dnUVZ8vednZ2d@bt.com>,
"benb" <benb@nospam.postalias.com> wrote:
Before you try out CompuSec, you might want to look at some
previous posts about it in this newsgroup. Here's part of one of
mine:
Message-ID: <gvk4l2d7uu39rotc8v6gl9o0quk3o4oi1e@4ax.com>
Of course, even 128-bit encryption is overkill since the
password is a maximum of 16 alpha-numeric characters. I work that
out to be just over 95 bits worth.
Also, there's something akin to a back-door in Compusec. In
their Yahoo support group, one message said:
--
Arthur T. - ar23hur "at" intergate "dot" com
Looking for a z/OS (IBM mainframe) systems programmer position
- Posted by benb on July 13th, 2007
"Sebastian G." <seppi@seppig.de> wrote in message
news:5fo1jiF328qaaU1@mid.dfncis.de...
Yeah I tested it at home last night and didn't like it at all. There are a
number of other failings as well. Such as only allowing 1 user login, if a
consultant sends a machine in for repair, it would be useful to be able to
login without them having to expose their password. Another is only allowing
alphanumerical charactors in the login name, our users logon to the domain
as joe.bloggs, but they couldn't use this to login to CompuSec as it
contains a period, so its another username for them to remember. There is no
windows/directory service synchronisation, so it means another password for
users to remember, increasing the likihood of users writing down passwords
somewhere.
Thanks for the warning, I was going to install it on my laptop to test, but
I think I'll use a spare now, until I know it works! I've heard from other
people that it is stable, and offers all of the requirements listed below.
I assumed that most of the products mentioned used at least AES 128, and so
were fairly equal in that respect. Certainly all the datasheets for PGP WDE,
SafeGuard Easy, PointSec & CompuSec state that they are capable of AES 256,
and PointSec & SafeGuard say they are FIPS 140-2 compliant.
My major reason for looking into this is in the event that one of our
consultants has a laptop stolen, and someone might be able to retrieve
clients confidential information from the hard disk. We're not a goverment
organisation, bank or anything, but it would damage the company's reputation
if a client were to find their information had been lost/made public!
Ben
- Posted by Sebastian G. on July 13th, 2007
Juergen Nieveler wrote:
It was one example from the non-FDE products from Ultimaco provides. Over
the years we've seen many such implementation errors, and one really can't
reasonably trust the vendor for now having created a proper implementation.
The issue about checking the correctness of the implementation. That means
not just the cipher, but also the key management (including key creation and
key destruction) and the rest (f.e. that it doesn't store a backup of the
key somewhere else). Didn't we learn something from PGP 5.x?
- Posted by Sebastian G. on July 13th, 2007
Juergen Nieveler wrote:
Two words: Microsoft Windows
- Posted by Ari on July 21st, 2007
On Mon, 09 Jul 2007 05:56:31 -0000, Saqib Ali wrote:
Truecrypt
Truecrypt
Truecrypt
Truecrypt
Why the hell would I want that?
Free OK? Truecrypt
Truecrypt
Truecrypt
Truecrypt
Truecrypt
- Posted by ric on July 24th, 2007
On Jul 23, 10:08 am, Juergen Nieveler
<juergen.nieveler.nos...@arcor.de> wrote:
I'd bring to the table Pointsec - we use this and it's good and scales
to the enterprise for key recovery etc, and also potentially MS
Bitlocker in Vista. Not used the latter, obviously treat with
caution, but it does seem to be ticking the boxes so far from brief
conversations with our architects...
- Posted by Ari on July 24th, 2007
On 23 Jul 2007 09:08:45 GMT, Juergen Nieveler wrote:
In-excluding OS?
- Posted by Ari on July 25th, 2007
On 24 Jul 2007 19:12:49 GMT, Juergen Nieveler wrote:
Fair enough.
Please repeat, I missed the point, Thx for the info.
- Posted by SafeBoot Simon on July 25th, 2007
I hate to blow my own trumpet but have you thought about SafeBoot
(www.safeboot.com)?
In my biased opinion it works better than the other products you're
looking at - for only 20 machines you'll not need some of the more
advanced stuff like AD integration, webhelpdesk etc, but you might
find those features technically interesting.
S.
On Jul 24, 9:58 pm, Ari <arisilverst...@yahoo.com> wrote:
- Posted by Ari on July 25th, 2007
On Wed, 25 Jul 2007 13:23:22 -0000, SafeBoot Simon wrote:
You really don't hate too?
- Posted by SafeBoot Simon on July 27th, 2007
On Jul 25, 11:56 am, Ari <arisilverst...@yahoo.com> wrote:
It galls me to have to lower myself to marketing.. but hey, whatever
helps.. ;-)
- Posted by Ari on July 27th, 2007
On Fri, 27 Jul 2007 04:23:56 -0000, SafeBoot Simon wrote:
lol
--
"You can't trust code that you did not totally create yourself"
Ken Thompson "Reflections on Trusting Trust"
http://www.acm.org/classics/sep95/
- Posted by se on September 6th, 2007
Just do not create a password reset floppy and you'll be fine. Make an mbr
backup with an external software. Free compusec allows one to create a
temporary service password. On login you have got 2 seconds to press F1
where you can set service password. Login is "Service". The password expires
automatically when user logs in with their login.
- Posted by Sebastian G. on September 7th, 2007
se wrote:
You can create a password reset floppy from any installation, and the worst
about Free CompuSec is that it will work on any other machine.
