Regular readers will know that I keep a keen eye on security and protection on private data. Previously I covered using KeePass to store password (of course the best would be to keep everything in the head), using Tor and Privoxy for anonymous browsing and setting up a VPN to share data using Hamachi.

In this post (and the next), I want to share some tools that will secure your data on your harddisk.

Eraser is an open source security tool which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.

Why do you want to do this?

The reason lies in the fact that when you delete a file, Windows does not really remove the file from the harddisk. It just removes the reference of the file (not the actual content). The file content still remains on the disk until another file is written over it. Even after file is written over it, it might still be possible for a sophisticated person to recover the data by studying the magnetic patterns on the disk surface.

Nevermind if you do not quite understand the last paragraph*. Just remember if you need to securely remove a file so that no one else can recover it, you need a tool like Eraser.

Tools like Eraser goes by a few description. They are sometime referred to as file shredder, disk wiper, destructive delete, etc.

Basically there are 2 main functions that you want to use them for

1. To delete (shred) an existing file or disk so that it is no longer recoverable.
2. To clean (wipe) your empty harddisk space so that old, deleted data cannot be recovered.

Eraser can do both.

Using Eraser

After installing, erasing a file is just a simple right-click on the file and choose Erase.

You can leave the Options as its default and go ahead and click Yes.

A status box will appear showing the erasing. Depending on your file size this may take a while.

Wiping Empty Disk Space

To wipe empty/unused disk space, right-click on a disk drive.

Follow the same confirmation as the file shredding. If you have a large disk, this will take a long time.

*Useful reference:

• File wiping on Wikipedia
• Why a normal delete is not sufficient

Chinese support

Ufortunately it seems like the UI does not support other languages.

Where to get it?

• Eraser is at http://www.heidi.ie/eraser/
• Current version: 5.82
• Function: File Shedder (Eraser)

Related Post:

• KeePass 1.06 release
• Are you still using FTP? Beware
• Punch through web filter with Tor
• Remember all your passwords with KeePass

All your passwords are kept in one database, which is locked with one master key or a key-disk. You only have to remember one single master password or insert the key-disk to unlock the whole database.

Databases are encrypted using very secure encryption algorithms (AES and Twofish).

A new version, 1.06, is available. (Thanks to the update alert built into the program.)

Related Post:

• Remember all your passwords with KeePass
• Wipe all trace with Eraser
• Are you still using FTP? Beware
• Punch through web filter with Tor
• Importing from Password Safe to KeePass database

I was shocked!

You see, in the last 7-8 years I have not use FTP on my servers. Even on the local office server I refuse to allow FTP to be installed. For file transfer I just use SFTP (Filezilla supports this).

Are you still using FTP, you might want to read the following and discover why it is time to take note

• Details of how FTP works and security.
• FTP Security Considerations

The traditional FTP protocol is highly insecure: it sends passwords in the clear. For this reason FTP has been recognized as one of the largest remaining security liabilities in most UNIX systems. As of 2006 FTP still remains one of the Internet’s most popular file upload mechanisms.

Another security risk lies not with FTP itself but with the widespread use of wireless internet connection.

With wireless, your FTP password travelling in clear over the air can be easily captured. You may be surprised that wireless attack is actually very easy. The kid next door may just be looking at your wireless traffic now.

So, if you are using FTP on your hosting server and at work, ask why. Security file transfer like SFTP, SCP, FTP over SSL are widely available. Perhaps it is time to ask if the hosting provider support them or move on to a more knowledgable hosting provider.

At this point I am still talking to the vendor to see how the FTP requirement can be relaxed or best removed.

Reference:

• Wireless Security Recommendations for Rutgers
• Wireless security on Wikipedia

Related Post:

• Filezilla FTP client
• Wipe all trace with Eraser
• KeePass 1.06 release
• Punch through web filter with Tor
• Remember all your passwords with KeePass

Tor

Tor’s website describe it as “an anonymous Internet communication system“. Which doesn’t really helps to understand what it is.

The normal business user would not need to know how Tor works (read this overview if you want to know), only what it does.

One of Tor usage is to get pass blocked website. Which is what I am going to describe in this article.

If you work in some countries (no name here to protect this site) that filters web traffic you may want to read on.

If you are on Windows platform you would want to download the Tor & Privoxy & Vidalia bundle.

Tor has comes a long way since the day when user need to hand configure everything. Tor actually need to be used together with Privoxy to get pass web filter. But now the Viadlia does the configuration and Privoxy is bundled together. Just download and the setup does everything.

After setup you should have 2 icons on the notification area.

• Right click on Tor and select Start if not already started
• Right click on Privoxy and select Enable

Next to configure your web browser.

Firefox

• From the menu select
  Tools > Options … > Connection Settings …

• Select Manual proxy configuration:
• Enter localhost for HTTP Proxy
• Enter 8118 for Port
• Check Use this proxy server for all protocols
• Click OK

Internet Explorer

• From the menu select
  Tools > Internet Options … > Connections > LAN Settings …

• Check Use a proxy server for your LAN
• Click Advanced…
• Enter localhost for Proxy address to use
• Enter 8118 for Port
• Check Use the same proxy server for all protocols
• Click OK

Now surf to a website that you do not have access before.

User Experience

One of the disadvantage of using Tor is the the speed can be slow, some time painfully so. So you may not want to surf with it.

Privoxy also block ads and certain website. Depending on your preference you may or may not like this.

If everything work fine, great. But if you need customization, be prepared to dig around for information and read alot.

The tool does not take up too much space so it is good to have it around. Who knows you may travel to one of those filtering country.

Chinese support

Chinese language interface in Tor is included.

• Right click on Tor
• Select Configure
• Click Appearance
• Select from Language drop down
• Click Save (on the top row)

Where to get it?

• Tor is at http://tor.eff.org/
• Current version: 0.1.1.23
• Function: anonymous Internet communication system (use as web filter bypass)

Related Post:

• Wipe all trace with Eraser
• KeePass 1.06 release
• Are you still using FTP? Beware
• Remember all your passwords with KeePass

To help with remembering, I started with standard menonics, then use associations. Then I became more lazy started using standard passwords for sites that I don’t really care about.

Still, the problem is how to manage passwords overload ?

Let me introduce KeePass .

Many years (5?) back I found a program call Gator, the concept is simple – a program that stay behind the scene and remembers all the password and pops up when it is needed. It was like godsend. That was my first introduction to password management utility.

Later I found that it contains spyware and wipe it off. Since then I stayed off such program if it comes from a commercial company. Imagine, a program that saves your password spying on you. That’s the ultimate betrayal.

Anyway, after years of staying off password remembering softwares, I ran across an opensource version called Password Safe. I was skeptical at first but my guard lowered when I learned it was opensource.

One of the benefits of open source softwares is that the source is open for all to review. While this does not stop evil person from doing evil, it allows knowledgeable people to make sure the code is safe.

Truth is I am going crazy remembering passwords and I really need a tool, any tool.

Password Safe is really a simple program. The look and feel is not very polished and the interface need a little use to. But the show-stopper for me is that there is not support for Chinese.

Then I found KeePass.

Actually I found KeePass a while back. But a typical change-resister that I am, I was reluctant to learn a new software. Especially when I had many passwords already stored in Password Safe.

The reason for finally making the switch is unclear now. Maybe it was because I found KeePass listed as one of the top SourceForge project. Or it could be the nice website. The last straw broke the camel’s back.

First impression

Looks aside, the interface is a much welcomed change from Password Safe. The Tree-Content-Data windows layout on the left-right-bottom is well thought out. Very much like the familiar email client. Compared to in Password Safe, KeePass layout makes it very easy and fast to find and see data.

KeePass also seems to have more features and more mature. For example, in setting up a new password database, there is a very fancy interface to generate password from mouse movement!

It also allows you to keep notes and attach file to the account.

What I like about KeePass Password Safe?

• Auto-type feature.
  Auto fill username password and the enter key with a simple key-stoke combination. Brilliant.
• Password generation. No more thinking of password, just generate and save.
• Opensource, no spyware
• Nice interface
• Good information layout
• I mention it supports Chinese? (and other languages)

Room for improvement

• Auto-type could be more accurate in determining username/password to use.

Chinese support

Entries and Notes can be entered in Chinese and display correctly. Chinese translation for the interface can be downloaded from keepass.sourceforge.net/translations.php.

Just follow the 3 steps instruction on the page to switch the interface language.

Where to get it?

• KeePass is at http://keepass.sourceforge.net/
• Current version: 1.05
• Function: Password management utility

Related Post:

• KeePass 1.06 release
• Wipe all trace with Eraser
• Are you still using FTP? Beware
• Punch through web filter with Tor
• Importing from Password Safe to KeePass database