Data protection on USB drives?

mrsinbad

Enlightened
Joined
May 30, 2003
Messages
201
Location
Nassau County, NY
Wow, thanks guys for all your recommendations, including the Bushmaster... but personally, I like the Street Sweeper for CQ work.

On the subject of creating a strong password, wouldn't a mnemonic phrase with special character substitution be stronger than any pattern? Something like...

Mary had a little lamb, it's fleece was white as snow... would end up being...

MHALLIFWWAS and when you substitute some special characters, you end up with...

MH@77IFWW@$

Wouldn't this be considered a strong password?

Of course the strongest passwords would be the dynamic ones....
 

Apollo Cree

Enlightened
Joined
Nov 23, 2009
Messages
451
Location
United States of America
Wow, thanks guys for all your recommendations, including the Bushmaster... but personally, I like the Street Sweeper for CQ work.

On the subject of creating a strong password, wouldn't a mnemonic phrase with special character substitution be stronger than any pattern? Something like...

Mary had a little lamb, it's fleece was white as snow... would end up being...

MHALLIFWWAS and when you substitute some special characters, you end up with...

MH@77IFWW@$

Wouldn't this be considered a strong password?

Of course the strongest passwords would be the dynamic ones....


Don't use a common phrase, or a phrase from a book, movie, nursery rhyme, etc.

There is a program called "crack" that does a "dictionary attack" on passwords. It tries various common password creation schemes, such as combining a couple of smaller words, possible birthdays, character substitutions, adding a number in the middle, wife or dog names, months, etc. "Crack" and similar programs will break an amazingly high percentage of the passwords used by people.

There has been a LOT of work and tricks added to "crack" programs, such as precompliled lists of passwords and "hash" values, etc. Crack programs have lists of common phrases, lists of words, names, etc.

Make up a phrase of your own that you can remember. For instance, "Jodie Foster told Hannibal Lector she remembered lambs being slaughtered on the farm she lived on as a small child in Olathe Kansas." "JFTHLSRLBSOTFSLOAASCIOK"

The more "unrelated randomness" in the string the better.

"Jodie Foster told Hannibal Lector about lambs. Chocolate covered grasshoppers taste funny. Those geese honked as they flew over at night."
"JFTHLALCCGTFTGHATFOAN"

Throwing in the @ and similar stuff helps a little, but the password guessing programs know how to try those tricks. Personally, I prefer to simply throw in a few more characters than to go to the effort to remember which characters shift and substitute.

The more characters the better.

There's an entire science on the "randomness" of passwords. Google password entropy. In simplified terms, it estimates how many tries an enemy who knows everything about you except the actual password has to make before he guesses the password correctly.

Every additional "random" thing you throw in, the more entropy (or bit strength) you have.

In theory, randomly chosen letters have about 4.5 bits per letter. Letters from a phrase probably have less entropy, so assume 3 bits per letter for a MADE UP phrase. Use a lot of letters. 20 letters get you something like 60 bits of entropy, which is reasonable.

Be sure that the encryption algorithm you're using really uses longer passwords. Some of them will let you enter 20 letters, but ignore anything after a certain length. Check out the specs for the algorithm, and then try typing in the last character wrong and see that it doesn't encrypt.

You won't get a good short answer on encryption in a short discussion. The "professional" cryptography and security groups spend thousands and thousands of pages of discussion and don't come up with clear answers.
 

LittleBill

Newly Enlightened
Joined
Jan 21, 2009
Messages
123
get a biometric thumb drive, they make them.

all passwords can be cracked. super computers can crack WPA handshakes. i talk to guys who can do a million passwords in like 4 hours.

feel that confident?

you want to be more insane

RSA security, rolling password changes every 2 minutes, on top of another password.

locks only keep honest people out, guns provide tons of persuasion for the data you consider "important", which in reality most people could care less about, because otherwise it would not be allowed out of the building on a usb drive:eek:

the programs listed will keep 99% of the people out, the 1% you will never stop if they are determined
 
Last edited:

paulr

Flashaholic
Joined
Mar 29, 2003
Messages
10,832
Use a phrase rather than a word. See www.diceware.com for instructions on generating the phrase. I think I may have mentioned that earlier but it doesn't hurt to mention it again. That site demystifies a lot of the nonsense about this subject.
 

Flashanator

Flashlight Enthusiast
Joined
Jan 19, 2007
Messages
1,203
Location
The 11th Dimension
get a biometric thumb drive, they make them.

all passwords can be cracked. super computers can crack WPA handshakes. i talk to guys who can do a million passwords in like 4 hours.

feel that confident?

you want to be more insane

RSA security, rolling password changes every 2 minutes, on top of another password.

locks only keep honest people out, guns provide tons of persuasion for the data you consider "important", which in reality most people could care less about, because otherwise it would not be allowed out of the building on a usb drive:eek:

the programs listed will keep 99% of the people out, the 1% you will never stop if they are determined

What if the password is 63characters long & very complicated? How long before super computers could crack it? I read it can take 100's of thousands of years for desktop pcs. Just curious.
 

nasa779

Newly Enlightened
Joined
Mar 7, 2009
Messages
126
Location
Steel City
I try not to put anything that is really important on a USB drive because I can't lock specific folders or files, but sometimes I have to. What do you guys do or recommend for me to lock access to files or folders? Should I encrypt instead? Thanks.


go to thinkgeek.com and buy an iron key.....

if the wrong password is typed 3 times i think it is, it literally destroys the flash memory reader inside itself... and its solid steel =]
 

vaughnsphotoart

Newly Enlightened
Joined
Sep 6, 2008
Messages
45
I tried and compared several, and I ended up settling on Private Disk by Dekart. It runs happily off a usb drive, and I found it to be easier to use than TrueCrypt.

The only thing is it is only 128 bit encryption in the "light" (aka free) version. Paying gets you 256 bit and other goodies.

http://www.dekart.com/products/
 
Top