So I'm using Vista...

[Frozen Sooner]

My laptop finally went off to the big bit farm in the sky tonight-there is a major problem with the video card that I can't fix with firmware updates or system restores. Went ahead and bought a new laptop, and of course you can't buy anything without Vista preloaded on it anymore.

I ain't a fan right now. I'm already annoyed at the lack of compatibility between the new version of Office and Palm software. I'm really annoyed at the crappy Bluetooth interface, though I guess that one's not on MS.

I am, however, a fan of the built-in biometric security on the notebook. Instead of entering a password, I just have to run my finger over the scanner. Then again, my prints are probably now on file in Redmond.

[OUHOMER]

your prints were probaly already on file. I know mine are

[Vaevictis]

I am, however, a fan of the built-in biometric security on the notebook. Instead of entering a password, I just have to run my finger over the scanner. Then again, my prints are probably now on file in Redmond.

Heh, I've always wondered if this is really worth anything.

Think about it. Laptops have the authorized user's finger prints all over them. I mean, I guess it'll stop casual intruders, but serious ones, I really doubt.

[BajaOklahoma]

Laptops have the authorized user's finger prints all over them. I mean, I guess it'll stop casual intruders, but serious ones, I really doubt.

Debbie Downer. Make Mike think it isn't so cool any more. He hasn't even had it for 24 hours and you're already ruining it for him. :(



;)

[Vaevictis]

Heh, security is always a downer :)

I mean, I guess it's more convenient than typing in a password, and in conjunction with a password, it's probably more secure because you're making them jump through more hoops. But I imagine most people use it by itself.

[Vaevictis]

And personally, I hate biometrics. If anyone really wants to get into a truly secure biometric system, think of what they have to take from you in order to get in.

I much prefer a smart card / password system.

[Ike]

Heh, security is always a downer :)

I mean, I guess it's more convenient than typing in a password, and in conjunction with a password, it's probably more secure because you're making them jump through more hoops. But I imagine most people use it by itself.

I also like the idea of a USB keylock...saw this on a dedicated war-driving machine once where the full HD was encrypted and the encryption key only existed on a USB-finger drive key. So you turn on the computer, and it can't do anything until the correct finger drive is inserted.


Anyway, thought it was an interesting idear

[Vaevictis]

Yep, that's a good option too.

I think I prefer the smart card one though, because of the dimensions. I'd rather have something that can easily fit into my wallet, or in a book or something than a USB device.

[Vaevictis]

Or maybe even cooler, a RFID style system where you just have to have the device in reasonable proximity to the computer, and the computer just reads the device.

Then you could put it in or on literally anything.

[Frozen Sooner]

And personally, I hate biometrics. If anyone really wants to get into a truly secure biometric system, think of what they have to take from you in order to get in.

I much prefer a smart card / password system.

I've actually mentioned this in connection to ATM security.

I just like the convenience factor of the fingerprint dealie.

Oh, yeah, and I guess Vista comes with some encryption scheme for your hard drive.

[SicEmBaylor]

I also like the idea of a USB keylock...saw this on a dedicated war-driving machine once where the full HD was encrypted and the encryption key only existed on a USB-finger drive key. So you turn on the computer, and it can't do anything until the correct finger drive is inserted.


Anyway, thought it was an interesting idear

I've got that and it works great. In fact, it's a free little program you can download at sourceforge.com

I'll send you the program itself if you want it. It randomly picks an encryption key and installs that encryption key on your USB drive that only matches up with the encryption key on that particular computer. I just press a button on my laptop and then the system is locked and you have to insert the USB drive to unlock it.



It's awesome.

[GrapevineSooner]

Think I'll stick with XP then.

[SicEmBaylor]

http://sourceforge.net/projects/usl/

There's the link to the USB system lock. ^

[Frozen Sooner]

I've got that and it works great. In fact, it's a free little program you can download at sourceforge.com

I'll send you the program itself if you want it. It randomly picks an encryption key and installs that encryption key on your USB drive that only matches up with the encryption key on that particular computer. I just press a button on my laptop and then the system is locked and you have to insert the USB drive to unlock it.



It's awesome.

So does it use a truly random one-time pad scheme or is there an algorithm used to generate pseudo-random numbers? 'Cause the former is impossible to crack. The latter is just really difficult to crack-like more difficult than anyone without the resources of a major government behind them to do in a reasonable amount of time.

[SicEmBaylor]

So does it use a truly random one-time pad scheme or is there an algorithm used to generate pseudo-random numbers? 'Cause the former is impossible to crack. The latter is just really difficult to crack-like more difficult than anyone without the resources of a major government behind them to do in a reasonable amount of time.

I honestly have no clue. I just use it to stop my roommates or whoever else from messing around with my comp.

[Frozen Sooner]

I honestly have no clue. I just use it to stop my roommates or whoever else from messing around with my comp.

Are your roommates such a-holes that they won't respect "Hey, don't mess with my computer?"

[SicEmBaylor]

Are your roommates such a-holes that they won't respect "Hey, don't mess with my computer?"

It's not just my roommates, but I naturally distrust everyone and assume the absolute worst in any individual and any situation. I go through life thinking I'm going to die a horrific death at any moment if that gives you an indication of my paranoia.

I'm so paranoid that I look both ways before crossing a one way street.

[Ike]

http://sourceforge.net/projects/usl/

There's the link to the USB system lock. ^


I'm somewhat impressed that the guy who can't change a tire just posted a sourceforge link. Maybe there is some small sliver of hope for you SicEm...

[SicEmBaylor]

I'm somewhat impressed that the guy who can't change a tire just posted a sourceforge link. Maybe there is some small sliver of hope for you SicEm...

I can't do cars. I can do computers. I can't exactly write software, but I can troubleshoot myself out of nearly every problem I've ever had, upgrade/change out hardware, etc.

I discovered sourceforge the first time I created a new partition on my hard drive to install linux. I didn't really know how to do it at the time, so I kept having to figure it out through trial and error but I got it up and working just fine.

[Frozen Sooner]

I'm somewhat impressed that the guy who can't change a tire just posted a sourceforge link. Maybe there is some small sliver of hope for you SicEm...

So, Ike, you want to look at the documentation on that and tell me whether it's using an algorithm or a one-time pad?

I bet if it's an algorithm it's using zeta functions.

[Vaevictis]

So does it use a truly random one-time pad scheme or is there an algorithm used to generate pseudo-random numbers? 'Cause the former is impossible to crack. The latter is just really difficult to crack-like more difficult than anyone without the resources of a major government behind them to do in a reasonable amount of time.


Private Sub CreateKey()
CreatedANewKey = True
UnLockKey = ""
Dim md5handler As Object
Set md5handler = New MD5
Do
UnLockKey = UnLockKey + LCase$(md5handler.MD5(Str(Time()) + "USB System Lock" + Str(Rnd * 100)))
Loop Until Len(UnLockKey) >= 128
Set md5handler = Nothing
If (Len(UnLockKey) > 128) Then UnLockKey = Left$(UnLockKey, 64) + Right$(UnLockKey, 64)
Call SaveSetting("USB System Lock", "", "Key", UnLockKey, HKEY_LOCAL_MACHINE)
End Sub

It's not even that complex. It looks like it's basically just storing a password in the registry, and comparing the password on the USB key, and unlocking if they match.

[Ike]

So does it use a truly random one-time pad scheme or is there an algorithm used to generate pseudo-random numbers? 'Cause the former is impossible to crack. The latter is just really difficult to crack-like more difficult than anyone without the resources of a major government behind them to do in a reasonable amount of time.

looking at the project home page, it looks like they use a pseudo random number generator (and only works for windows). It stores a key in the registry and on a usb device, and bypasses the task manager (dunno how, but this is what they say) to ensure that the computer won't boot without the key.


this won't protect you from the feds or any body really that only wants to look at the contents of a hard drive. It doesn't do full drive encryption.


oh, and it doesn't work under safe mode.

[SicEmBaylor]

I thought one time pads were pad and pen era stuff.

[Ike]

It's not even that complex. It looks like it's basically just storing a password in the registry, and comparing the password on the USB key, and unlocking if they match.


and it looks like it's generating a password based upon nothing more than a time stamp.

[Vaevictis]

I thought one time pads were pad and pen era stuff.

No, they still use them. And they have the advantage of being a method -- if not the only method -- that is completely unbreakable if done correctly.

[Vaevictis]

and it looks like it's generating a password based upon nothing more than a time stamp.

shrug, I don't know enough about VB to talk about the properties of the Rnd*100 part.

[Vaevictis]

Just looked up Rnd, it's a typical old-school pseudo-random number generator.

EDIT: Wow, it appears as if he doesn't even call Randomize to seed it. I bet that it generates the same random number for that part of the string every time.

EDIT 2: Heh, am I reading the VB date function right? It only has resolution down to the day? Heh, that doesn't make for a very large key space.

EDIT 3: Ah hah. Okay, he's using time, not date. That ups the key space a lot if you have to do it manually.

[Ike]

shrug, I don't know enough about VB to talk about the properties of the Rnd*100 part.
whoops...I read that too fast then...time stamp + a random number (which most are based on a seed and a time stamp)....so I was half right ;)

[Ike]

No, they still use them. And they have the advantage of being a method -- if not the only method -- that is completely unbreakable if done correctly.

I was always intrigued by some of the web-cam based random number generators...that was a fun idea.

[Frozen Sooner]

I thought one time pads were pad and pen era stuff.

Nope. The name comes from pen and paper, but a one-time pad can be generated on computer. To give an example from fiction, you could generate a one-time pad by randomly typing on a computer, then having the computer time your keystrokes, discarding the most significant digits.

And Vae is correct-one-time pads if implemented correctly are truly unbreakable.

[Frozen Sooner]

So hey, Ike and Vae, if you haven't read it already, pick up Neal Stephenson's Cryptonomicon. I bought it on the recommendation of my late grandfather. He got his start in the military working cryptanalysis in the Pacific theater in WWII and said that it got most of the details of cryptanalysis right.

[Vaevictis]

Man, I wish I had more time for more classes. I've only got the summer left before I'm supposed to be done with my master's degree. I really wanted to take a couple classes on wavelets, fourier analysis and cryptography :(

My boss/advisor keeps telling me that I could if I'd go for my PhD. And I keep telling him "No Way." If I'm going to do any more school, it'll be an MBA or law.

[Ike]

So hey, Ike and Vae, if you haven't read it already, pick up Neal Stephenson's Cryptonomicon. I bought it on the recommendation of my late grandfather. He got his start in the military working cryptanalysis in the Pacific theater in WWII and said that it got most of the details of cryptanalysis right.
maybe when this whole trying to graduate business is over for me I will. Lately though, my reading list has been limited to physics journals.

[Ike]

Just looked up Rnd, it's a typical old-school pseudo-random number generator.

EDIT: Wow, it appears as if he doesn't even call Randomize to seed it. I bet that it generates the same random number for that part of the string every time.

EDIT 2: Heh, am I reading the VB date function right? It only has resolution down to the day? Heh, that doesn't make for a very large key space.

EDIT 3: Ah hah. Okay, he's using time, not date. That ups the key space a lot if you have to do it manually.


Thinking about it though, the purpose for this program probably doesn't require THAT strong of a key. The only thing it will do is prevent bootup without the key. For investigative purposes, they typically start by making an image of a hard drive, which completely removes the need to boot up the system containing the hard drive, and laptop theives are probably going to format the disk anyway, which they can do with a simple boot CD (or in this case by booting into safe mode)....so really, it's only useful purpose is to prevent nosy roomates from poking around on your machine, and for that, the key doesn't have to be all that strong because you figure even a total whiz kid roomie wouldn't have the time to crack even this key.

[Vaevictis]

So hey, Ike and Vae, if you haven't read it already, pick up Neal Stephenson's Cryptonomicon. I bought it on the recommendation of my late grandfather. He got his start in the military working cryptanalysis in the Pacific theater in WWII and said that it got most of the details of cryptanalysis right.

Heh, man, I've got a stack of books literally 6 feet tall that I've got lined up for reading. These are non-trivial things too, like Knuth's TAOCP (managed to finish book 1), SICP, a book on computation theory, etc.

I've got several years worth of backlog :(

[Vaevictis]

the key doesn't have to be all that strong because you figure even a total whiz kid roomie wouldn't have the time to crack even this key.

Eh, I bet a total wiz kid could; just stitch together a USB device that keeps presenting itself over and over again with a different key. :) If the roommate could guess to within a year of when the key was generated, he could probably narrow it down to about 32 million possible keys. That's really not that many. And if the roommates were using his computer, I bet they could guess it to the month.

[Frozen Sooner]

Eh, I bet a total wiz kid could; just stitch together a USB device that keeps presenting itself over and over again with a different key. :) If the roommate could guess to within a year of when the key was generated, he could probably narrow it down to about 32 million possible keys. That's really not that many. And if the roommates were using his computer, I bet they could guess it to the month.

Honestly, if the key is stored in the registry, I wouldn't even bother using cryptanalytic techniques on it.

Look at the recent attacks on the copy protection scheme on HD DVD and BD.

[SicEmBaylor]

I think I'm safe. One of my roomates (and admittedly myself) couldn't figure out how to put a futon together for 2 hours. He's a 2.0 GPA biz major.

My other roommate is 1st year law student who gets ****ed off and goes into a rage when the lid on the jar of pickles is on too tight. He doesn't have enough patience to open a jar of pickles much less try to break any kind of keys.

[Vaevictis]

Honestly, if the key is stored in the registry, I wouldn't even bother using cryptanalytic techniques on it.

Look at the recent attacks on the copy protection scheme on HD DVD and BD.

Yeah, but some of us are geeks who enjoy doing this sort of thing just because we can ;)

[Newbomb Turk]

Think I'll stick with XP then.

I would. I only have Vista because I bought a new PC. I would never upgrade to Vista. I hate it.

[Frozen Sooner]

Yeah, but some of us are geeks who enjoy doing this sort of thing just because we can ;)

True. It just seems odd to design a security system that's that easily bypassed.

Kinda like putting a really nice lock on your front door and then putting a note with a tracing of the key on it.

[Vaevictis]

True. It just seems odd to design a security system that's that easily bypassed.

Oh, that's an oddity that is easily resolved: The coder didn't know anything about what he was doing.

The fact that he used VB as his language reinforces my suspicion to that effect.

(VB being the language of choice of MIS majors everywhere.)

[soonerboomer93]

sometimes the best security is the deterrent. Are you going to try and borrow the computer that has a password on it, or the one you can just turn on and play with?



oh, and if I wanted onto it, I would just pull the hard drive. That's almost always the easiest thing to do. Just pull the drive and access it as a secondary drive in a desktop computer.

[OCUDad]

This thread is nerdier than an old nerdy thing.

[Frozen Sooner]

sometimes the best security is the deterrent. Are you going to try and borrow the computer that has a password on it, or the one you can just turn on and play with?



oh, and if I wanted onto it, I would just pull the hard drive. That's almost always the easiest thing to do. Just pull the drive and access it as a secondary drive in a desktop computer.

Which is why bit encryption is much easier.

[soonerboomer93]

actually, there's a couple settings in windows that makes pulling the drive not as easy. But I can get around that pretty quickly. The main advantage of pulling the drive for me, is it's easier to transfer information to a different source.

Of course, this was pretty much sop when working on computers for customers, since no one ever backs up data, but needs it transfered over, or gets some nasty *** virus on their system, or has a failing drive.

[slickdawg]

I can't say that I like Vista very much. XP Pro is where it's at for me.

[garland sooner]

You know... there may be a perfectly good reason why Vista is teh suck.

It was called Project Longhorn. :texan:

Think about it. It was doomed the second it was named.

[Frozen Sooner]

You know... there may be a perfectly good reason why Vista is teh suck.

It was called Project Longhorn. :texan:

Think about it. It was doomed the second it was named.

Something of which I am well aware.

This thing is slow as molasses. I'm running 2GB of memory on a Core 2 T7200 processor, so you'd think it'd move a little faster. However, my iTunes library duped itself and I'm deleting half of it, and it's taking upwards of an hour to process the deletion.

[soonerboomer93]

might be that itunes isn't really working that well on vista

could also be a hard drive issue, especially if you're noticing heavy reads/writes

[Frozen Sooner]

The hard drive is a WD 250GB external USB drive, so that shouldn't be an issue. I guess it's possible that Vista's USB implementation isn't quite up to snuff yet.

[soonerboomer93]

actually, that's part of the issue. I have an external usb drive and frankly, when it's on my performance suffers a bit. I actually ordered an external case and a 160gb 2.5 in drive. I'll use them to have an external firewire drive (no ac adapter necessary). But I have to travel with my laptop regularily enough that it's more prefereable to me.

[Okieflyer]

I can't say that I like Vista very much. XP Pro is where it's at for me.

Yes stay with that.

There are a lot of things I do like about Vista. But the lack of compatabilty with certain things makes it not worth the trouble.

[SoonerJack]

I think I'm safe. One of my roomates (and admittedly myself) couldn't figure out how to put a futon together for 2 hours. He's a 2.0 GPA biz major.

Hey Sicem,

Futons are not easy to assemble. We've bought and returned like 2 of them and they all had problems going together. The hardest was one we bought from a thrift store. No instructions, just our imaginations and some wrenches.:D