FlyerTalk Forums - View Single Post - Securing my new PC
View Single Post
Old Aug 7, 2005 | 10:10 am
  #7  
Doppy
FlyerTalk Evangelist
Conversation Starter
All eyes on you!
25 Years on Site
 
Join Date: May 2000
Location: أمريكا
Posts: 26,931
Re: Questions 4 and 5:

I don't know what Outlook does when you "delete" an e-mail in it, so I can't answer that.

If you want to securely delete actual files, download this PGP Keys freeware program:
http://web.mit.edu/network/pgp.html

It will let you "wipe" files from your hard drive. Typically when you delete a file, the file system simply changes the file attribute to "deleted," which frees up the space, but doesn't actually delete the file (it's like putting a sticker on a physical file cabinet that says "deleted" - the files are still there). This program will "wipe" the files by completely overwriting them with garbage characters. You can select how many times you want it to go over the files, IIRC, 7 times is optimal.

Encrypting files is very complicated stuff, and the Web site above will have much better and longer explanations than I can give. That said, here's a quick summary:
There are two main options for sending messages securely. The first is to encrypt them in a "self decrypting archive." Basically this creates an executable file that will decrypt itself when someone types in the correct passphase. Let's say you created a word document you want to send to me. After installing PGP Keys, you right-click the file and tell the program to create a self decrypting archive. It prompts you to enter a passphrase (they don't call it a password because you should really type something longer in - i.e. a phrase - so that it is more difficult to break via a brute force attack. Somewhere around 100 characters is optimal, but then that's a lot to remember or pass along to someone else.) The passphrase you enter is used as the "key" upon which the file is encrypted. You can then e-mail the file to me and I'll be able to decrypt it by typing the same passphrase in exactly. Of course, you'll have to securely communicate the passphrase to me, which can be trickly. The benefit here is that I don't need to have any special software installed on my computer.

The better way to send secure messages is called public key encryption. In the same example where you wish to send me a message securely, I install an encryption program on my computer and create a key. The longer the better (mine is 4096 bytes). The program creates two different keys - a public key which I upload to a central server and a private key which I store in a secure location and disclose to no one.

You download and install a compatible program on your computer. You then retrieve my public key from the keyserver. After typing a message up - say in Outlook - you tell the program to encrypt the message using my key so that only I can read it. Then you e-mail the message to me. I decrypt it using my private key and my secret passphrase (the passphrase provides an extra level of security in case someone gets their hands on my private key) and am able to read it.

However, with the above, there's no guarantee that you actually sent me the message - someone could be pretending to be you. To protect against that, rather than simply encrypting the message you sent to me, you could have encrypted and "signed" the message. Using your private key, the program would generate a "signature" and appended that to the message. When I decrypted the message, the program would verify your signature by comparing it to your public key, which I would have downloaded from the public keyserver.

This method is more secure than the self decrypting archive and also allows you to communicate with anyone who has a public key on a public keyserver without having to agree upon a passphrase ahead of time in a secure manner, which is difficult. The downside is that you both have to have programs that are able to encrypt and decrypt with compatible encryption algorithms.

There are also ways of verifying that public keys have not been tampered with, but that's a lesson for another time.

Hope this helps.
Doppy is offline