Being that the TR’s biggest selling point is mobility, it worries me how easy it would be for someone to pick it up, walk away with it, and access my personal data.  Probably the best security is to not keep any sensitive files on the TR at all.  Lacking that option, I’m thinking the best things to do are: [list][*]Create a BIOS/boot password. [*]Disable the Windows Welcome screen.  (i.e., use NT-style logon)[*]Disable all unnecessary accounts, including Guest. [*]Create passwords for all accounts. [*]Disable all unnessary network protocols.[*]Enable Windows Firewall on all network connections and make sure you enable only the services you know you definitely need. (None, typically.)[*]Encrypt (important) files.[/list:u]  I’ve implemented everything except the last bullet.  Anyone know of good encryption software? I’m looking for something with the following features:[list][*](Mostly) transparent file encryption and decryption.[*]Support for very long passphrases and/or keys.[*]Encryption of entire folders/partitions.[*]Allows me to secure My Documents/etc without having to jump through obscene hoops.  (NTFS junctions are OK.)[*]Won’t leave the cipher key laying around neither in RAM nor the hibernation file.[/list:u]My options seem to be:[list][*] Microsoft EFS [*] PGPdisk [*] DiskCrypt / ScramDisk [/list:u]I’m don’t know much about any of these solutions, other than the fact that they exist.  Anyone have recommendations?

Thanks!

EFS is built into NTFS on XP Pro. That’s probably the easiest to install and the most transparent.

I am in the same boat, working for a security company. I must have 2 hardware solutions on my computers that go with me to work.

I use both a fingerprint ID and a USB key.

If one or both devices are not present, the PC will not boot.

The data on the drives are encrypted and split so recovery outside of the TR is not possible (im sure its possible I guess, but not easy).

Its been my knowledge that software solutions can only take you so far. We have dedicated cracker/hackers at my company that are supposed to exploit our systems…they haven’t found too many software solutions they would use.

Erik

For now, I am using EFS because it’s built into Windows.  I know, I know ... poor excuse. 

Once I get my Sony Bluetooth module, Zire 72, BT keyboard, and BT mouse (all wish list for now), I’ll have the right USB port totally free.  I might go with DriveCrypt (sp in my original post) with the USB-based Rainbow iKey since the car-key-like behavior should be good for that I’m willing to put up with.

Of course, I still need to figure out where/how they’re storing the encryption key once it’s read off the iKey…

Nothing Sony…i forgot the name, i’ll post it tonight, my TR is at work.

Erik

Safehouse Drive Encryption
<http//www.pcdynamics.com>

I use ethentica hardware, custom software.

Erik

I use DriveCrypt Plus Pack as it has reasonably strong sector-level encryption. It also has a nice little touch were you can fake a serious disk error on bootup, with on mine appears after the Bios password as it would if it were for real.  At this fake disk error screen, you then tap in your passkey and the system continues to boot in the normal way! Very usefull as im sure you get round the bios password quite easily as with desktops.

Incidentally, anyone know of any manufacturer built-in bios passwords?

I also use Bestcrypt, which is a container based encryption tool, which like others, mounts to a virtual drive and can be used by any application etc.  The advantage of BestCrypt is that its the only one i’ve found that lets you use 448bit Blowfish encryption which is very strong indeed.

any of these software out here thats mentioned above cheap or free ..???

CRYPTiC Wrote

Disable all unnecessary accounts, including Guest.

I think an “ASP.NET Machine Account” is created for those of us who use Desktop Sidebar.

Questions:
(1) For security sake, should we delete it because it is a possible entry point?
(2) How big of a risk is it to have this account enabled?
(3) Should I encrypt my photos used in the slideshow on Desktop Sidebar?  :o