|
Posted by Joe John on May 8, 2006, 8:04 am
Please log in for more thread options
> Any encryption scheme is crackable given enough resources. I've heard
> that if you lost your keys then you might as well kiss your data
> goodbye because decrypting it is very difficult. Hell even you seem to
> contradict yourself in your next post:
>
Hi:
Contradiction? QED as above.
The importance of the passphrase or key, is fundamental to cryptography.
There are guidelines to insure a password is secure, and truecrypt docs
describe the process.
>
>> Quicken filenames, locations etc., are well known and thus, easily
>> located [ thus copied] even by ActiveX scripts in websites or worse,
>> trojans.
> Quicken files can be located in different places. For example, mine
> are not in the standard place. Still this provides little to no
> security.
As you write below, locating the files requires additional code, and thus
increases the trojan's payload. Its a simple security manouver rather
than using default locations but its not secure like using a lock. If
you can't find me you can't get me, and moving it does not make it easy.
>> An example of a secure mode of installing files see Firefox or
>> Mozilla directory structure and filenames.
> What?!? It does no such thing! I wrote and posted a simple Perl script
> to not only find where Firefox or Mozilla store their directory
> structure (AKA profile) and grep through the address book extracting
> email addresses. Having a slt component of the path to the profile
> does nothing, one can easily traverse the users file system once they
> are code running on the users machine. It's the file system itself
> that tells you where things are and supplies any missing directory
> names. Trivial to do and not secure at all!
How Mozilla's uses directory structures is open software yet, like moving
your Quicken files from default locations, an increase level of security
over IE or default. If your script as you say has located _all_ Mozilla
files with you as superuser, its possible but its not complete. I wont'
detail were all files are or what they are called or how they are
structured, suffice to say that secure files are assembled only in memory
at runtime so individually the files are not useful.
| 
Yahoo! 
Google 
Windows Live 
del.icio.us 
digg 
Netscape 
XML Sitemap