In article
< .com>,
wrote:
>I think Mike was trying to say if you have sensitive information that
>you are storing on an encrypted floppy, to make sure that you dispose
>of any temporary files that are created that could hold your
>information in plaintext.
>
>Windows XP introduced EFS, Encrypted File System.. If you right click
>on a folder and go to its properties, you can chose to either encrypt
>or compress a folder. Then the only user that can decrypt the file is
>the one whos SID encrypted it, or an encryption agent (Administrator).
>
>Heres a tutorial.
>http://www.iopus.com/guides/efs.htm
EFS works. But there are serious "lurks" for the unwary.
Putting aside for the moment the (by no means trivial) question
of backdoors and the NSA, the problems with EFS include:
1. It is not an OTF (on the fly) encryption scheme. Instead
it extracts encrypted files as plaintext versions onto the HD and
later erases them when the (possibly modified) plaintext version
is reencrypted. These deleted-but-not-scrubbed extracted
plaintext versions are a major headache requiring scrubbing, etc.
Also, if an unencrypted (plaintext) file is used in, say,
Microsoft Word, there are significant dangers of additional
plaintext leakage paths (e.g., ~.tmp files, etc.)
2. You must take **special measures** to ensure that the
decrypting keys have been removed from the HD. The default is to
**keep** them on the HD (using a pretty weak protection scheme)
for administrative purposes.
In short, EFS can work moderately well, but managing it properly
is not obvious or straightforward and therein lies the danger.
Regards,
Similar Threads
