yon Leveron blog

From: Bruce Schneier <schneier@schneier.com>
Date: Mon, Dec 14, 2009 at 22:41
Subject: CRYPTO-GRAM, December 15, 2009
To: CRYPTO-GRAM-LIST@listserv.modwest.com

CRYPTO-GRAM

December 15, 2009

by Bruce Schneier
Chief Security Technology Officer, BT
schneier@schneier.com
http://www.schneier.com

A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>.

You can read this issue on the web at <http://www.schneier.com/crypto-gram-0912.html>.  These same essays appear in the “Schneier on Security” blog: <http://www.schneier.com/blog>.  An RSS feed is available.

** *** ***** ******* *********** *************

In this issue:
Terrorists Targeting High-Profile Events
Eric Schmidt on Privacy
News
A Taxonomy of Social Networking Data
The Psychology of Being Scammed
Schneier News
Reacting to Security Vulnerabilities

** *** ***** ******* *********** *************

Terrorists Targeting High-Profile Events

In an AP story on increased security at major football (the American variety) events, this sentence struck me: “‘High-profile events are something that terrorist groups would love to interrupt somehow,’ said Anthony Mangione, chief of U.S. Immigration and Customs Enforcement’s Miami office.”

This is certainly the conventional wisdom, but is there any actual evidence that it’s true?  The 9/11 terrorists could have easily chosen a different date and a major event — sporting or other — to target, but they didn’t.  The London and Madrid train bombers could have just as easily chosen more high-profile events to bomb, but they didn’t.  The Mumbai terrorists chose an ordinary day and ordinary targets.  Aum Shinrikyo chose an ordinary day and ordinary train lines.  Timothy McVeigh chose the ordinary Oklahoma City Federal Building.  Irish terrorists chose, and Palestinian terrorists continue to choose, ordinary targets.  Some of this can be attributed to the fact that ordinary targets are easier targets, but not a lot of it.

The only examples that come to mind of terrorists choosing high-profile events or targets are the idiot wannabe terrorists who would have been incapable of doing anything unless egged on by a government informant. Hardly convincing evidence.

Yes, I’ve seen the movie Black Sunday.  But is there any reason to believe that terrorists want to target these sorts of events other than us projecting our own fears and prejudices onto the terrorists’ motives?

AP story:
http://www.huffingtonpost.com/2009/12/03/orange-bowl-pro-bowl-and-_n_379052.html or http://tinyurl.com/yhc9kpe

Idiot wannabe terrorists:
http://www.schneier.com/essay-174.html

I wrote about protecting the World Series some years ago.
http://www.schneier.com/essay-065.html

** *** ***** ******* *********** *************

Eric Schmidt on Privacy

Schmidt said:

I think judgment matters. If you have something that you don’t
want anyone to know, maybe you shouldn’t be doing it in the first
place. If you really need that kind of privacy, the reality is
that search engines — including Google — do retain this
information for some time and it’s important, for example, that we
are all subject in the United States to the Patriot Act and it is
possible that all that information could be made available to the
authorities.

This, from 2006, is my response:

Privacy protects us from abuses by those in power, even if we’re
doing nothing wrong at the time of surveillance.

We do nothing wrong when we make love or go to the bathroom. We
are not deliberately hiding anything when we seek out private
places for reflection or conversation. We keep private journals,
sing in the privacy of the shower, and write letters to secret
lovers and then burn them. Privacy is a basic human need.

[...]

For if we are observed in all matters, we are constantly under
threat of correction, judgment, criticism, even plagiarism of our
own uniqueness. We become children, fettered under watchful eyes,
constantly fearful that — either now or in the uncertain future
– patterns we leave behind will be brought back to implicate us,
by whatever authority has now become focused upon our once-private
and innocent acts. We lose our individuality, because everything
we do is observable and recordable.

[...]

This is the loss of freedom we face when our privacy is taken from
us. This is life in former East Germany, or life in Saddam
Hussein’s Iraq. And it’s our future as we allow an ever-intrusive
eye into our personal, private lives.

Too many wrongly characterize the debate as “security versus
privacy.” The real choice is liberty versus control. Tyranny,
whether it arises under threat of foreign physical attack or under
constant domestic authoritative scrutiny, is still tyranny.
Liberty requires security without intrusion, security plus
privacy. Widespread police surveillance is the very definition of
a police state. And that’s why we should champion privacy even
when we have nothing to hide.

Schmidt’s remarks:
http://gawker.com/5419271/google-ceo-secrets-are-for-filthy-people

My essay on the value of privacy:
http://www.schneier.com/essay-114.html

See also Daniel Solove’s “‘I’ve Got Nothing to Hide’ and Other Misunderstandings of Privacy.”
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565

** *** ***** ******* *********** *************

News

Interesting research on public reactions to terrorist threats.  Not that it’s surprising: Fear makes people deferential, docile, and distrustful, and both politicians and marketers have learned to take advantage of this.
http://www.schneier.com/blog/archives/2009/11/public_reaction.html
Jennifer Merolla and Elizabeth Zechmeister have written a book, Democracy at Risk: How Terrorist Threats Affect the Public.  I haven’t read it yet.
http://www.amazon.com/gp/product/0226520552/counterpane/

Funny image: anti-malware detection and the original Trojan Horse.
http://www.sampsonuk.net/B3TA/TrojanHorse.jpg

A study in the British Journal of Criminology makes the point that drink-spiking date-raping is basically an urban legend.  The hypothesis is that perpetuating the fear of drug-based rape allows parents and friends to warn young women off excessive drinking without criticizing their personal choices.  The fake bogeyman lets people avoid talking about the real issues.
http://www.schneier.com/blog/archives/2009/11/a_useful_side-e.html

Door locks that open if you tap a particular rhythm.
http://www.engadget.com/2009/11/04/secret-knock-door-lock-defends-home-from-rhythmically-impaired/ or http://tinyurl.com/yes7sy5
http://spritesmods.com/?art=knock2open
http://www.taplock.com/

Neat research in “quantum ghost imaging.”  Despite its name, it has nothing to do with quantum mechanics; it’s a way to use a camera and a light source to produce images of objects that the camera cannot see.
http://www.newscientist.com/article/dn13825
http://www.globalsecurity.org/military/library/news/2009/11/mil-091102-afps05.htm or http://tinyurl.com/yzo22l8
http://arxiv1.library.cornell.edu/PS_cache/arxiv/pdf/0807/0807.2614v1.pdf or http://tinyurl.com/y9cxzvb

How smart are Islamic terrorists?  According to “Organizational Learning and Islamic Militancy,” written by Michael Kenney for the U.S. Department of Justice in May, not very.
http://www.schneier.com/blog/archives/2009/11/how_smart_are_i.html

Research on stabbing people with stuff you can get through airport security.
http://www.ncbi.nlm.nih.gov/pubmed/17325460?itool=EntrezSystem2.PEntrez.Pubmed.Pubmed_ResultsPanel.Pubmed_RVDocSum&ordinalpos=257 or http://tinyurl.com/ybgvnec

Denial-of-service attacks against CALEA:
http://www.schneier.com/blog/archives/2009/11/denial-of-servi.html

Funny: career fair fail.
http://failblog.org/2009/11/07/career-fair-fail/
See the caption on the original photo for the real story.
http://www.flickr.com/photos/paperghost/776598575/in/set-72157600761788702/ or http://tinyurl.com/ykrxc8o

Al Qaeda secret code broken: maybe this is a real story, and maybe not.
http://www.schneier.com/blog/archives/2009/11/al_qaeda_secret.html

Decertifying “terrorist” pilots:
http://www.schneier.com/blog/archives/2009/11/decertifying_te.html

Norbt (no robot) is a low-security web application to encrypt web pages.  You can create and encrypt a webpage.  The key is an answer to a question; anyone who knows the answer can see the page.  I’m not sure this is very useful.
https://norbt.com/

This paper, on users rationally rejecting security advice, by Cormac Herley at Microsoft Research, sounds like me:
http://research.microsoft.com/en-us/um/people/cormac/papers/2009/SoLongAndNoThanks.pdf or http://tinyurl.com/ygwsxno
Related article on usable security:
http://cacm.acm.org/magazines/2009/11/48419-usable-security-how-to-get-it/fulltext or http://tinyurl.com/yklgwfb

If you allow players in an online world to penalize each other, you open the door to extortion.
http://www.schneier.com/blog/archives/2009/11/virtual_mafia_i.html

Long, detailed, and very good story of the Mumbai terrorist attacks of last year.
http://www.vqronline.org/webexclusive/2009/11/19/motlagh-mumbai-attacks/ or http://tinyurl.com/yknrgun
My own short commentary in the aftermath of the attacks.
http://www.schneier.com/blog/archives/2008/12/lessons_from_mu.html

Wikileaks has published pager intercepts from New York on 9/11. It’s disturbing to realize that someone, possibly not even a government, was routinely intercepting most (all?) of the pager data in lower Manhattan as far back as 2001.  Who was doing it?  For that purpose?  That, we don’t know.
http://www.schneier.com/blog/archives/2009/11/leaked_911_text.html

This 1996 interview with psychiatrist Robert DuPont was part of a Frontline program called “Nuclear Reaction.”  He’s talking about the role fear plays in the perception of nuclear power.  It’s a lot of the sorts of things I say, but particularly interesting is his comments on familiarity and how it reduces fear.
http://www.pbs.org/wgbh/pages/frontline/shows/reaction/interviews/dupont.html or http://tinyurl.com/ygxbfvz
So, among other reasons, terrorism is scary because it’s so rare.  When it’s more common — England during the Troubles, Israel today — people have a more rational reaction to it.
http://www.schneier.com/blog/archives/2009/11/fear_and_overre.html

Long blog post of mine on cyberwarfare policy; lots of links.
http://www.schneier.com/blog/archives/2009/12/cyberwarfare_po.html

This research centers on looking at the radio characteristics of individual RFID chips and creating a “fingerprint.”  It makes sense; fingerprinting individual radios based on their transmission characteristics is as old as WW II.  But while the research centers on using this as an anti-counterfeiting measure, I think it would much more likely be used as an identification and surveillance tool.  Even if the communication is fully encrypted, this technology could be used to uniquely identify the chip.
http://dailyheadlines.uark.edu/16260.htm

With Windows Volume Shadow Copy, it can be impossibly to securely delete a file.
http://blog.szynalski.com/2009/11/23/volume-shadow-copy-system-restore/ or http://tinyurl.com/yleobxl

Sprint provides U.S. law enforcement with cell phone customer location data:
http://www.schneier.com/blog/archives/2009/12/sprint_provides.html

Using fake documents to get a valid U.S. passport:
http://www.schneier.com/blog/archives/2009/12/using_fake_docu.html
No credential can be more secure than its breeder documents and issuance procedures.

Article on “Emotional epidemiology” from the New England Journal of Medicine.  It sounds familiar.
http://www.schneier.com/blog/archives/2009/12/emotional_epide.html

The TSA accidentally published its standard operating procedures:
http://www.schneier.com/blog/archives/2009/12/tsa_publishes_s.html
It might have compromised an intelligence program:
http://politics.theatlantic.com/2009/12/did_the_tsa_compromise_an_intelligence_program.php or http://tinyurl.com/y96ngm5

No real news on Obama’s cybersecurity czar:
http://www.schneier.com/blog/archives/2009/12/obamas_cybersec_1.html
For the record — as the rumors circulate occasionally — I don’t want the job.

Wondermark on passwords:
http://wondermark.com/576/

U.S./Russia cyber arms control talks:
http://www.schneier.com/blog/archives/2009/12/usrussia_cyber.html

** *** ***** ******* *********** *************

A Taxonomy of Social Networking Data

At the Internet Governance Forum in Sharm El Sheikh this week, there was a conversation on social networking data.  Someone made the point that there are several different types of data, and it would be useful to separate them.  This is my taxonomy of social networking data.

1. Service data.  Service data is the data you need to give to a social networking site in order to use it.  It might include your legal name, your age, and your credit card number.

2. Disclosed data.  This is what you post on your own pages: blog entries, photographs, messages, comments, and so on.

3. Entrusted data.  This is what you post on other people’s pages.  It’s basically the same stuff as disclosed data, but the difference is that you don’t have control over the data — someone else does.

4. Incidental data.  Incidental data is data the other people post about you.  Again, it’s basically the same stuff as disclosed data, but the difference is that 1) you don’t have control over it, and 2) you didn’t create it in the first place.

5. Behavioral data.  This is data that the site collects about your habits by recording what you do and who you do it with.

Different social networking sites give users different rights for each data type.  Some are always private, some can be made private, and some are always public.  Some can be edited or deleted — I know one site that allows entrusted data to be edited or deleted within a 24-hour period — and some cannot. Some can be viewed and some cannot.

And people *should* have different rights with respect to each data type.  It’s clear that people should be allowed to change and delete their disclosed data.  It’s less clear what rights they have for their entrusted data.  And far less clear for their incidental data.  If you post pictures of a party with me in them, can I demand you remove those pictures — or at least blur out my face?  And what about behavioral data?  It’s often a critical part of a social networking site’s business model.  We often don’t mind if they use it to target advertisements, but are probably less sanguine about them selling it to third parties.

As we continue our conversations about what sorts of fundamental rights people have with respect to their data, this taxonomy will be useful.

Lots of discussion at the blog entry:
http://www.schneier.com/blog/archives/2009/11/a_taxonomy_of_s.html

Another categorization centered on destination instead of trust level:
http://mechpoe.blogspot.com/2009/11/another-categorization-of-social.html or http://tinyurl.com/y9q5exr

** *** ***** ******* *********** *************

The Psychology of Being Scammed

This is a very interesting paper: “Understanding scam victims: seven principles for systems security, by Frank Stajano and Paul Wilson.” Paul Wilson produces and stars in the British television show The Real Hustle, which does hidden camera demonstrations of con games.  (There’s no DVD of the show available, but there are bits of it on YouTube.) Frank Stajano is at the Computer Laboratory of the University of Cambridge.

The paper describes a dozen different con scenarios — entertaining in itself — and then lists and explains six general psychological principles that con artists use:

1. The distraction principle.  While you are distracted by what retains your interest, hustlers can do anything to you and you won’t notice.

2. The social compliance principle.  Society trains people not to question authority. Hustlers exploit this “suspension of suspiciousness” to make you do what they want.

3. The herd principle. Even suspicious marks will let their guard down when everyone next to them appears to share the same risks. Safety in numbers? Not if they’re all conspiring against you.

4. The dishonesty principle. Anything illegal you do will be used against you by the fraudster, making it harder for you to seek help once you realize you’ve been had.

5. The deception principle. Things and people are not what they seem. Hustlers know how to manipulate you to make you believe that they are.

6. The need and greed principle. Your needs and desires make you vulnerable. Once hustlers know what you really want, they can easily manipulate you.

It all makes for very good reading.

The paper:
http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-754.html

The Real Hustle:
http://www.imdb.com/title/tt0791615/

Two previous posts on the psychology of conning and being conned.
http://www.schneier.com/blog/archives/2009/06/the_psychology_3.html
http://www.schneier.com/blog/archives/2008/10/the_psychology_1.html

** *** ***** ******* *********** *************

Schneier News

Interview with me conducted in Rotterdam in October.
http://risky.biz/RB2-schneier

Interview with me from Gulf News:
http://gulfnews.com/business/technology/cloud-computing-is-here-to-stay-1.532744 or http://tinyurl.com/y8jnskv

Video of the talk on “The Future of Privacy” that I gave to the Open Rights Group in early December:
http://www.openrightsgroup.org/blog/2009/Bruce-Schneier-video-and-book-giveaway or http://tinyurl.com/ya92ksc

** *** ***** ******* *********** *************

Reacting to Security Vulnerabilities

Last month, researchers found a security flaw in the SSL protocol, which is used to protect sensitive web data. The protocol is used for online commerce, webmail, and social networking sites. Basically, hackers could hijack an SSL session and execute commands without the knowledge of either the client or the server. The list of affected products is enormous.

If this sounds serious to you, you’re right. It is serious. Given that, what should you do now? Should you not use SSL until it’s fixed, and only pay for internet purchases over the phone? Should you download some kind of protection? Should you take some other remedial action? What?

If you read the IT press regularly, you’ll see this sort of question again and again. The answer for this particular vulnerability, as for pretty much any other vulnerability you read about, is the same: do nothing. That’s right, nothing. Don’t panic. Don’t change your behavior. Ignore the problem, and let the vendors figure it out.

There are several reasons for this. One, it’s hard to figure out which vulnerabilities are serious and which are not. Vulnerabilities such as this happen multiple times a month. They affect different software, different operating systems, and different web protocols. The press either mentions them or not, somewhat randomly; just because it’s in the news doesn’t mean it’s serious.

Two, it’s hard to figure out if there’s anything you can do. Many vulnerabilities affect operating systems or Internet protocols. The only sure fix would be to avoid using your computer. Some  vulnerabilities have surprising consequences. The SSL vulnerability mentioned above could be used to hack Twitter. Did you expect that? I sure didn’t.

Three, the odds of a particular vulnerability affecting you are small. There are a lot of fish in the Internet, and you’re just one of billions.

Four, often you can’t do anything. These vulnerabilities affect clients and servers, individuals and corporations. A lot of your data isn’t under your direct control — it’s on your web-based email servers, in some corporate database, or in a cloud computing application. If a vulnerability affects the computers running Facebook, for example, your data is at risk, whether you log in to Facebook or not.

It’s much smarter to have a reasonable set of default security practices and continue doing them. This includes:

1. Install an antivirus program if you run Windows, and configure it to update daily. It doesn’t matter which one you use; they’re all about the same. For Windows, I like the free version of AVG Internet Security. Apple Mac and Linux users can ignore this, as virus writers target the operating system with the largest market share.

2. Configure your OS and network router properly. Microsoft’s operating systems come with a lot of security enabled by default; this is good. But have someone who knows what they’re doing check the configuration of your router, too.

3. Turn on automatic software updates. This is the mechanism by which your software patches itself in the background, without you having to do anything. Make sure it’s turned on for your computer, OS, security software, and any applications that have the option. Yes, you have to do it for everything, as they often have separate mechanisms.

4. Show common sense regarding the Internet. This might be the hardest thing, and the most important. Know when an email is real, and when you shouldn’t click on the link. Know when a website is suspicious. Know when something is amiss.

5. Perform regular backups. This is vital. If you’re infected with something, you may have to reinstall your operating system and applications. Good backups ensure you don’t lose your data — documents, photographs, music — if that becomes necessary.

That’s basically it. I could give a longer list of safe computing practices, but this short one is likely to keep you safe. After that, trust the vendors. They spent all last month scrambling to fix the SSL vulnerability, and they’ll spend all this month scrambling to fix whatever new vulnerabilities are discovered. Let that be their problem.

SSL flaw:
http://www.eweekeurope.co.uk/news/security-researchers-uncover-ssl-vulnerability-2355 or http://tinyurl.com/yge9not
http://www.linuxtoday.com/news_story.php3?ltsn=2009-11-06-008-35-NW-DV-NT or http://tinyurl.com/yb9pxsa
http://isc.sans.org/diary.html?storyid=7534
http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1373678,00.html or http://tinyurl.com/yhw7vhb
http://www.tombom.co.uk/blog/?p=85
http://www.securityfocus.com/bid/36935/info

SSL flaw used to hack Twitter:
http://www.techworld.com.au/article/326496/ssl_flaw_could_been_used_hack_twitter or http://tinyurl.com/yevj4uv
http://www.eweek.com/c/a/Security/Researcher-Demonstrates-SSL-Vulnerability-on-Twitter-291904/ or http://tinyurl.com/yejjhkz

AVG Anti-virus:
http://lifehacker.com/5401255/best-antivirus-application-avg

My 2004 article on safe personal computing:
http://www.schneier.com/blog/archives/2004/12/safe_personal_c.html

** *** ***** ******* *********** *************

Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.  You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>.  Back issues are also available at that URL.

Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable.  Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier.  Schneier is the author of the best sellers “Schneier on Security,” “Beyond Fear,” “Secrets and Lies,” and “Applied Cryptography,” and an inventor of the Blowfish, Twofish, Threefish, Helix, Phelix, and Skein algorithms.  He is the Chief Security Technology Officer of BT BCSG, and is on the Board of Directors of the Electronic Privacy Information Center (EPIC).  He is a frequent writer and lecturer on security topics.  See <http://www.schneier.com>.

Crypto-Gram is a personal newsletter.  Opinions expressed are not necessarily those of BT.

Copyright (c) 2009 by Bruce Schneier.

Alas, this is going to be a challenging Tech week, I can tell. All I can report for now is that the current revision of Acronis Trueimage Home 2010 (version number 13.0.6053) doesn’t seem to work well with my TrueCrypt’d boot partition setup, under Windows 7 x64 [Version 6.1.7600].

Back to the drawing board – I’d really like to upgrade from DriveImage XML at some point [ahem] but at least it works!

—————-
Now playing: Eric Cartman – Come Sail Away
via FoxyTunes

I’m still happy with the capabilities of torrent-for-business models – with many downloads now weighing in at multi-gigabyte levels, it makes sense, even for World of Warcraft updates / installs, which have long used the technology. But things are changing with the relative need for even centralized “trackers” :

The development of DHT has reached a stage where a tracker is no longer needed to use a torrent. DHT (combined with PEX) is highly effective in finding peers without the need for a centralized service. If you run uTorrent you might have noticed in the tracker tab of your torrents that the [Peer Exchange] (PEX) row is often reporting a lot more peers than the trackers you might have for that torrent. These peers all came to you without the use of a central tracker service! This is what we consider to be the future. Faster and more stability for the users because there is no central point to rely upon.

Now that the decentralized system for finding peers is so well developed, TPB has decided that there is no need to run a tracker anymore, so it will remain down! It’s the end of an era, but the era is no longer up2date. We have put a server in a museum already, and now the tracking can be put there as well.

By moving to a more decentralized system of handling tracking (DHT+PEX) and distributions of torrent files (Magnet Links), BitTorrent will become less vulnerable to downtime and outages:

• With decentralized peer acquisition, there is no central tracker that can be down.
• With decentralized fetching of metadata (torrents) we don’t need to rely on a single server that stores and distributes torrent files.

---

I can even imagine this extended a bit to house educational video clips, distributed. Perhaps not as easily streamed, but certainly viable as a file-based video download approach. c.f. http://www.godaddy.com/hosting/word-camp.aspx for an example; not sure how much they captured, but as I’ve said there is little reason these days not to capture the vast majority of it these days, given low space costs and the huge userbase of WordPress.

—————-
Now playing: Monty Python – Interlude 2
via FoxyTunes

Pretty handy timing, the day before Windows 7 launches to the general public!

I’ve alluded to TrueCrypt before, but have yet to do a real “feature” on it.

(below changelog via http://www.truecrypt.org/docs/?s=version-history )

---

TrueCrypt 6.3

October 21, 2009

New features:

• Full support for Windows 7.

• Full support for Mac OS X 10.6 Snow Leopard.

• The ability to configure selected volumes as ‘system favorite volumes’. This is useful, for example, when you have volumes that need to be mounted before system and application services start and before users start logging on. It is also useful when there are network-shared folders located on a TrueCrypt volume and you need to ensure that the network shares will be restored by the system each time it is restarted. For more information, see the chapter ‘Main Program Window‘, section ‘Program Menu‘, subsection ‘Volumes -> Save Currently Mounted Volumes as Favorite‘ in the documentation. (Windows)

Improvements and bug fixes:

• ‘Favorite’ volumes residing within partitions or dynamic volumes will no longer be affected by changes in disk device numbers, which may occur, e.g., when a drive is removed or added.  (Windows)

• Many other minor improvements and bug fixes.  (Windows, Mac OS X, and Linux)

The latest version of TrueCrypt can always be downloaded from http://www.truecrypt.org/downloads

Just launched today : New Acronis True Image Home 2010 is the most reliable and easy to use backup solution. Now with online backup option! Delivers powerful insurance for Windows 7 migration.

Acronis is very confident in their new product, and I have to agree; it looks even easier to use than before, and they’ve been steadily adding features instead of Bling. It’s always a good sign when they’re willing to let you try it out for free : Acronis True Image Home 2010 Free Trial Download.

For each picture below, clicking it should show an enlarged version in a new window.

I ran through a couple of Beta testing versions before this new launch, and Acronis looks like they made the minor changes needed. I was really glad to see the launch, as I’ve been relying on this for some time since I’m running the production Windows 7 on my (windows) machines.

Acronis says : “With Acronis True Image Home 2010, rest assured that all your important data including images, music, documents and applications are well protected and can easily be recovered in the event of any disaster. Also the newest Acronis True Image Home 2010 is the best solution for moving your system to Windows 7 and storing your backups online.”

The only portion I would add is that the online backup is optional; you can still use the conventional backup mode to practically any device (DVD, network, firewire or usb hard disk, etc.)

Since I prefer to have both a local copy (external hard disk, unplugged from electrical system when not in use) as well as an offsite backup copy (online is increasingly attractive, as long as it’s well encrypted, which True Image 2010 supports) this really fits my needs.

I’m quite happy with the dual destination backup feature as well; it’s refreshing to see this brought from their Enterprise market down to a much less expensive home / home office product.

Thanks for reading this launch information and review of Acronis True Image 2010. I hope you’ll be as satisfied as I am with the newest version of their flagship product. You can download a completely functional evaluation copy for free here, or you can order the full product for $49.99 directly from the picture link below.

Reasonable and basic intro for folks.

How to Encrypt and Erase a Hard Drive – by Digital Trends 2009 08/23

One thing many neglect : a true benefit of running your hard disks as FDE / Full Disk Encryption is that when you are done, there should be nothing to erase; the data is useless without your high-quality key.

Excerpt :

---

We discussed the importance of backing up the data stored on your computer’s hard drive in a previous story. But what happens if your computer is lost or stolen? Notebooks are particularly vulnerable. A thoroughly executed back-up plan will alleviate data loss, but do you want strangers perusing the highly personal information you’ve stored on that machine? We didn’t think so; that’s why we put together this guide to keeping your electronic data secure.

First, we’ll take you through the process of encrypting the data on your hard drive, so that you can use passwords to control who can see it. And since no computer lasts forever, we’ll show you how to scrub your hard drive so that no one will ever be able to retrieve anything from it when you decide it’s time to put it out to pasture.

---

Of course, I’ve enjoying watching many a hard drive scrub, and then sleep with the fishes. Commercial hard drive shredding is a fun day at the office

I’ll reiterate to folks, I’m software agnostic.  Open source and on Linux?  Grand.  Often closed source, straight from that-supposed-devil company Microsoft?  Nifty.  OSX and whatever you want to run there?  Sure enough.

I’m just looking to get the job done well.  There really are times when one choice is better in my work, and times for the others also.  Each of us may have reasons to choose a ‘preferred’ system, or package type.  This is fine – live and let live, and all that. (your day will go better if you start to adopt that; I’m sure trying!)

I’d like to briefly hit a fave topic – cryptography. I suppose it all started with reading books too early, but that’s another story and I won’t bore you with my vice.  Suffice it to say, I was interested in simple transposition ciphers by the age of six or so, pencil and paper style.

Now we have other options.  Which is good, as my writing is terrible.  PGP commercial style.  GPG open source style.  Phil Zimmermann, with two N’s please! (kudos to Phil for making the world a better place)

Hushmail for secure email.  Full disk encryption by TrueCrypt, among others.  Much more secure VoIP that most other implementations.

Be careful of snake oil; noted security folks tend to frown on this and generally have a “doghouse” category for things that just aren’t right.  If something relies on security through obscurity, it automatically fails in my estimate.