In the last post I described how to securely and permanently remove a file from the disk drive using Eraser.

Now what happen if you need to securely store, not delete, any files? In this post, we will introduce another open source tools that will help you do just that – TrueCrypt.

With TrueCrypt you can protect your sensitive data, create a virtual encrypted disk within a file and mount it as a disk. You can also encrypt an a hard disk partition or a device, such as USB flash drive. The encryption is done automatically and transparently in real time. The author calls it an on-the-fly-encrypted volume .

Using TrueCrypt

TrypeCrypt can be a little confusing in the beginning for some user, such as the concept of mounting a disk volume (similar to using Daemons Tools). However it is worth exploring if you are looking for ways to securely store your data.

Start with the introduction to get an basic idea of the software. The Beginner’s Tutorial gives a step by step instruction on how to create a first encrypted drive.

TrueCrypt’s Features

TrueCrpyt is a very powerful software with many features for the normal user that just want to secure some file to the hyper-sensitive secret agent. For some, reading the TypeCrypt documentation is like reading a spy novel riddled with technical details.

On-the-fly-encrypted volume simply means that you do not have to decrypt a file as you access it. For example if you have a text file in a TrueCrypt volume, you can just double-click to open it. It will be decrypted behind the scene and encrypted again as you save and close the file.

Plausible deniability is an interesting concept where hidden volume can be created using different password. Of course I hope I will never be in such a situation where an adversary forces me to reveal my password.

Traveller mode is a way to run TrueCrypt without having to install it on the operating system under which it is running. For example you can have a TypeCrypt USB drive and using it on any computer.

Chinese support

You can download language pack to update interface to diffenent languages. Simplified Chinese pack is available.

After downloading the language pack, unzip and copy the xml file to the install folder (eg. C:Program FilesTrueCrypt ).

Where to get it?

• TrueCrypt is at http://www.truecrypt.org/
• Current version: 4.3
• Function: File encryption and security utility

Random Posts

• From Pegasus Mail to Thunderbird to GMail
• More free and open source softwares
• Open Source at the Expense of Productivity?
• Google offers Free Hosted Applications
• Revisiting the Search for a Backup Solution
• A Notepad Replacement
• Free development softwares alternatives
• Foxit Reader – PDF Reader on diet

Regular readers will know that I keep a keen eye on security and protection on private data. Previously I covered using KeePass to store password (of course the best would be to keep everything in the head), using Tor and Privoxy for anonymous browsing and setting up a VPN to share data using Hamachi.

In this post (and the next), I want to share some tools that will secure your data on your harddisk.

Eraser is an open source security tool which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.

Why do you want to do this?

The reason lies in the fact that when you delete a file, Windows does not really remove the file from the harddisk. It just removes the reference of the file (not the actual content). The file content still remains on the disk until another file is written over it. Even after file is written over it, it might still be possible for a sophisticated person to recover the data by studying the magnetic patterns on the disk surface.

Nevermind if you do not quite understand the last paragraph*. Just remember if you need to securely remove a file so that no one else can recover it, you need a tool like Eraser.

Tools like Eraser goes by a few description. They are sometime referred to as file shredder, disk wiper, destructive delete, etc.

Basically there are 2 main functions that you want to use them for

1. To delete (shred) an existing file or disk so that it is no longer recoverable.
2. To clean (wipe) your empty harddisk space so that old, deleted data cannot be recovered.

Eraser can do both.

Using Eraser

After installing, erasing a file is just a simple right-click on the file and choose Erase.

You can leave the Options as its default and go ahead and click Yes.

A status box will appear showing the erasing. Depending on your file size this may take a while.

Wiping Empty Disk Space

To wipe empty/unused disk space, right-click on a disk drive.

Follow the same confirmation as the file shredding. If you have a large disk, this will take a long time.

*Useful reference:

• File wiping on Wikipedia
• Why a normal delete is not sufficient

Chinese support

Ufortunately it seems like the UI does not support other languages.

Where to get it?

• Eraser is at http://www.heidi.ie/eraser/
• Current version: 5.82
• Function: File Shedder (Eraser)

Related Post:

• KeePass 1.06 release
• Are you still using FTP? Beware
• Punch through web filter with Tor
• Remember all your passwords with KeePass

One solution is to get Hamachi installed on both PCs.

Hamachi is not open source but the free version is very usable and I have used it on occassions between office, home and client’s location. (Hamachi had just been acquired by LogMeIn Inc in August 2006, it seems like the free version will continue to be available.)

There are a number of solutions available to achieve remote connection, even Windows XP comes with Remote Desktop. But what makes Hamachi stands out is the ease of use. Once installed, you just have to follow the few guided steps to get it up and running.

If you have ever tried connecting to remote computers with softwares like VNC, PCAnywhere or even a VPN you will find that the setup is often a big hassle, especially for non-technical users.

Here are a few problematic scenarios I can think of,

• you are behind a firewall in a client’s office
• you office LAN is behind a router (or wireless router)
• you do not know the IP of the remote computer
• you need some to run a host/server at the remote computer to listen to your connection

Hamachi’s concept, however, makes it easy to deal with all these sceanrios. There are no ports to be opened or configured and no need to find the remote IP. (For the technically inclined, find out how it works)

The steps are simple (and Hamachi comes with a very intuitive Quick Guide that explains each step.)

1. Download and run the install. (Assuming you are using the Windows version.)
2. If this is your first installation, you need to create a Network.
   A Network is basically like a workgroup with members of the same Network can share resource.
3. Once you have installed Hamachi on other computers, add them to the same Network

Once Hamachi is running this is what you see.

How to connect to shared folders?

If your office LAN has a few computer sharing files, you can install Hamachi with all computers in the same Hamachi network.

Right-click on any member of the network and click browse. You will be able to browse the file like in Windows’ Network Neighbourhood.

One draw back of the free version Hamachi is that the program cannot be run as a service. What this means is that a Windows XP user is required to log on and run Hamachi. In another word, connecting to an unattended computer may fail if the computer does not auto-logon like in the case of multiple user or password protected computer.

Fear not! Go to the Hamachi forum, a source of many useful information, you will find solution to this and many more advanced usage.

In the meantime, try Hamachi, I’m sure it will bring a new level of connectedness in your business and work.

What I like about Hamachi?

• very easy to use, even for non-technical users
• no messy configuration
• file and print sharing across multiple LAN and locations
• other network protocols (like SSH, FTP, HTTP, VNC) can go through it transparently
• encrypted

My wishlist for Hamachi

• official support for FreeBSD

Chinese support

The Simplified Chinese version of Hamachi can downloaded from the download page (click on “Click here for more languages”).

In the English version, Hamachi is able to support Chinese characters in the Nickname and Network name. So there is no problem using Hamachi in a mixed English-Chinese environment.

Where to get it?

• Hamachi is at http://www.hamachi.cc/
• Current version: 1.0.1.1
• Function: VPN, LAN over the Internet

Related Post:

• Remote Control with UltraVNC

All your passwords are kept in one database, which is locked with one master key or a key-disk. You only have to remember one single master password or insert the key-disk to unlock the whole database.

Databases are encrypted using very secure encryption algorithms (AES and Twofish).

A new version, 1.06, is available. (Thanks to the update alert built into the program.)

Related Post:

• Remember all your passwords with KeePass
• Wipe all trace with Eraser
• Are you still using FTP? Beware
• Punch through web filter with Tor
• Importing from Password Safe to KeePass database

I was shocked!

You see, in the last 7-8 years I have not use FTP on my servers. Even on the local office server I refuse to allow FTP to be installed. For file transfer I just use SFTP (Filezilla supports this).

Are you still using FTP, you might want to read the following and discover why it is time to take note

• Details of how FTP works and security.
• FTP Security Considerations

The traditional FTP protocol is highly insecure: it sends passwords in the clear. For this reason FTP has been recognized as one of the largest remaining security liabilities in most UNIX systems. As of 2006 FTP still remains one of the Internet’s most popular file upload mechanisms.

Another security risk lies not with FTP itself but with the widespread use of wireless internet connection.

With wireless, your FTP password travelling in clear over the air can be easily captured. You may be surprised that wireless attack is actually very easy. The kid next door may just be looking at your wireless traffic now.

So, if you are using FTP on your hosting server and at work, ask why. Security file transfer like SFTP, SCP, FTP over SSL are widely available. Perhaps it is time to ask if the hosting provider support them or move on to a more knowledgable hosting provider.

At this point I am still talking to the vendor to see how the FTP requirement can be relaxed or best removed.

Reference:

• Wireless Security Recommendations for Rutgers
• Wireless security on Wikipedia

Related Post:

• Filezilla FTP client
• Wipe all trace with Eraser
• KeePass 1.06 release
• Punch through web filter with Tor
• Remember all your passwords with KeePass

Tor

Tor’s website describe it as “an anonymous Internet communication system“. Which doesn’t really helps to understand what it is.

The normal business user would not need to know how Tor works (read this overview if you want to know), only what it does.

One of Tor usage is to get pass blocked website. Which is what I am going to describe in this article.

If you work in some countries (no name here to protect this site) that filters web traffic you may want to read on.

If you are on Windows platform you would want to download the Tor & Privoxy & Vidalia bundle.

Tor has comes a long way since the day when user need to hand configure everything. Tor actually need to be used together with Privoxy to get pass web filter. But now the Viadlia does the configuration and Privoxy is bundled together. Just download and the setup does everything.

After setup you should have 2 icons on the notification area.

• Right click on Tor and select Start if not already started
• Right click on Privoxy and select Enable

Next to configure your web browser.

Firefox

• From the menu select
  Tools > Options … > Connection Settings …

• Select Manual proxy configuration:
• Enter localhost for HTTP Proxy
• Enter 8118 for Port
• Check Use this proxy server for all protocols
• Click OK

Internet Explorer

• From the menu select
  Tools > Internet Options … > Connections > LAN Settings …

• Check Use a proxy server for your LAN
• Click Advanced…
• Enter localhost for Proxy address to use
• Enter 8118 for Port
• Check Use the same proxy server for all protocols
• Click OK

Now surf to a website that you do not have access before.

User Experience

One of the disadvantage of using Tor is the the speed can be slow, some time painfully so. So you may not want to surf with it.

Privoxy also block ads and certain website. Depending on your preference you may or may not like this.

If everything work fine, great. But if you need customization, be prepared to dig around for information and read alot.

The tool does not take up too much space so it is good to have it around. Who knows you may travel to one of those filtering country.

Chinese support

Chinese language interface in Tor is included.

• Right click on Tor
• Select Configure
• Click Appearance
• Select from Language drop down
• Click Save (on the top row)

Where to get it?

• Tor is at http://tor.eff.org/
• Current version: 0.1.1.23
• Function: anonymous Internet communication system (use as web filter bypass)

Related Post:

• Wipe all trace with Eraser
• KeePass 1.06 release
• Are you still using FTP? Beware
• Remember all your passwords with KeePass

If you want to migrate the Password Safe database to KeePass, here’s how you do it.

1. Use the Password Safe function to export to CSV file
   File > Export To > Plain Text
2. Import the text file into KeePass
   File > Import From> PWSafe v2 TXT file

The mistake I made was to import the encrypted datafile which produces garbage. You need to export to plain text and import the text file.

Related Post:

• KeePass 1.06 release
• Remember all your passwords with KeePass

To help with remembering, I started with standard menonics, then use associations. Then I became more lazy started using standard passwords for sites that I don’t really care about.

Still, the problem is how to manage passwords overload ?

Let me introduce KeePass .

Many years (5?) back I found a program call Gator, the concept is simple – a program that stay behind the scene and remembers all the password and pops up when it is needed. It was like godsend. That was my first introduction to password management utility.

Later I found that it contains spyware and wipe it off. Since then I stayed off such program if it comes from a commercial company. Imagine, a program that saves your password spying on you. That’s the ultimate betrayal.

Anyway, after years of staying off password remembering softwares, I ran across an opensource version called Password Safe. I was skeptical at first but my guard lowered when I learned it was opensource.

One of the benefits of open source softwares is that the source is open for all to review. While this does not stop evil person from doing evil, it allows knowledgeable people to make sure the code is safe.

Truth is I am going crazy remembering passwords and I really need a tool, any tool.

Password Safe is really a simple program. The look and feel is not very polished and the interface need a little use to. But the show-stopper for me is that there is not support for Chinese.

Then I found KeePass.

Actually I found KeePass a while back. But a typical change-resister that I am, I was reluctant to learn a new software. Especially when I had many passwords already stored in Password Safe.

The reason for finally making the switch is unclear now. Maybe it was because I found KeePass listed as one of the top SourceForge project. Or it could be the nice website. The last straw broke the camel’s back.

First impression

Looks aside, the interface is a much welcomed change from Password Safe. The Tree-Content-Data windows layout on the left-right-bottom is well thought out. Very much like the familiar email client. Compared to in Password Safe, KeePass layout makes it very easy and fast to find and see data.

KeePass also seems to have more features and more mature. For example, in setting up a new password database, there is a very fancy interface to generate password from mouse movement!

It also allows you to keep notes and attach file to the account.

What I like about KeePass Password Safe?

• Auto-type feature.
  Auto fill username password and the enter key with a simple key-stoke combination. Brilliant.
• Password generation. No more thinking of password, just generate and save.
• Opensource, no spyware
• Nice interface
• Good information layout
• I mention it supports Chinese? (and other languages)

Room for improvement

• Auto-type could be more accurate in determining username/password to use.

Chinese support

Entries and Notes can be entered in Chinese and display correctly. Chinese translation for the interface can be downloaded from keepass.sourceforge.net/translations.php.

Just follow the 3 steps instruction on the page to switch the interface language.

Where to get it?

• KeePass is at http://keepass.sourceforge.net/
• Current version: 1.05
• Function: Password management utility

Related Post:

• KeePass 1.06 release
• Wipe all trace with Eraser
• Are you still using FTP? Beware
• Punch through web filter with Tor
• Importing from Password Safe to KeePass database

ClamWin Antivirus is one of the better open source anti-virus program that is invading that stronghold in the MS Windows domain. (Is there others?)

ClamWin is based on the ClamAV antivirus engine. Harnessing the power of the community, the concept of an opensource virus directory look set to take on the commercial counterpart.

I decided to check it out a year ago when reinstalling my Win XP. The last anti-virus from Trend Micro never make a return.

My first impression after seeing the main screen of the program is that it still have some way to go in catching up with commercial equivalents.

Over time ClamWin had improved but mainly in the look department. Functionality wise it is very much a plain scanner.

You may have an insecure feeling about it, whether it can catch that virus that will wipe out the system.

That was my thoughts too. Over the last one year it caught no less than 5 viruses. So it does works!

Despite the spartan look it is has fairly complete features.

• File scanning
  speed is rather slow (no quantitiave data though but does seems slower) Nice animation though.
• Online virus database update
  initial database took a while to download, subsequent updates are fast, simple and automated.
• Nice set of preference

Wish List

• Scanning on file access, download
• Clean, recover file
• Integration with email scanning
  (Since moving to GMail, this became less important to me but nevertheless still a must have)
• Integration with spyware scanning
• Localization of interface

Chinese support

No Chinese support. The main reason none of my desktop at work is using it.

Where to get it?

• ClamWin is at http://www.clamwin.com/
• Current version: 0.88.3.1
• Function: Windows Anti virus scanner

• Share your LAN with Hamachi
• Official support of QQ in Gaim
• Integrated instant messaging with Gaim
• Free desktop applications roundup
• Importing from Password Safe to KeePass database
• Wipe all trace with Eraser
• WordWeb – a dictionary to use offline
• Filezilla FTP client