keeping data safe

[pinbrook]

I've been mulling over which is more secure - to keep confidential data within google docs accessed over a wireless connection or within a password protected excel file on laptop with wireless connection? I'd be interested in other peoples thoughts.

[chris ashdown]

Can you elaborate a bit more jo

[jont]

There have been security issues raised with cloud computing and confidential data as there are possible issues with storing the data in a country outside of your location which the Data Protection Act may not cover.

The password protection built into Excel is easily circumvented (you can readily buy hash tables with all the possible combinations and taking a minute to crack)

If data is confidential it needs a 3rd party encryption tool such as TrueCrypt which is free and very secure.

[Chunkford]

ooooo good question.
I would probably go for passworded excel file on your laptop.
At least the the excel file is 'with you' and not accessible for hacking 24/7 from anywhere with an internet connection.

[pinbrook]

Truecrypt on an SD card might do the job... but i wonder what happens if i also upload said data to online storage too. Will i be able to download and unencrypt it when my backup software encrypts it too? can you encrypt encrypted data and decrypt it?

i like to have 2 copies of everything

[jont]

You can encrypt a file as many times as you like so long as you use a different public encryption key. The one in your backup and the one in TrueCrypt will be different so should be no issue.

I use TrueCrypt on a flash stick for moving files between home and office... it essentially creates an encrypted volume on the disk that needs mounting via TrueCrypt ...once the password mounts the drive it acts just as a normal flash drive to copy and paste files to and from.

[pinbrook]

coincidently i read this today

http://www.theregister.co.uk/2009/07..._twitter_hack/

[jont]

For all your hacking needs on breaking passwords see :

http://www.facebook.com/
http://www.ancestry.co.uk/

[Mike Hughes]

And set up an ecommerce site that has user accounts and passwords (or any kind of similar website). Oh yes, and ask for mother's maiden name in case you need to resend the password.

There are so many sites that want a username and password that most people use the same one for everything.

So, PCI-DSS will protect credit card information but the really important stuff like passwords are ignored. I refuse to create an account on anything but a few trusted sites (and have a different password for forums etc).

The microsoft passport / live ID type schemes make sense but no one uses them so they're a waste of time really.

Mike

[jont]

ask for mother's maiden name in case you need to resend the password.

for all maiden names see :

http://www.ancestry.co.uk/

and for pets names see:

http://www.afacebook.com/

they are invaluable when you forget your passwords

[jont]

There are so many sites that want a username and password that most people use the same one for everything.

This is the greatest concern for security experts - as people join more and more sites they are unable to remember the passwords so use the same for everything .. crack an easy one wine password retrieval and you are into everything else they do online (which can be found by accessing online email accounts). Scary what information some people release into the public domain that can be used against them (no need to rummage through dustbins for envelopes)

[Mark H]

Another vote for Truecrypt - we use it for the same things as Jont, also to encrypt the Actinic site folder on the main PC so that it's potential loss wouldn't compromise customer data. A Truecrypt file with a good password is effectively unbreakable by anyone, and could be uploaded to any webspace with complete confidence.

A Truecrypt file could only be opened by getting the password right. A password like B33r&Mug could be cracked using a PC running 10,000 password guesses a second, however this would take approximately 22,875 years.......

http://www.lockdown.co.uk/?pg=combi&s=articles

[parklifeclothes]

Another vote for Truecrypt - we use it for the same things as Jont, also to encrypt the Actinic site folder on the main PC so that it's potential loss wouldn't compromise customer data. A Truecrypt file with a good password is effectively unbreakable by anyone, and could be uploaded to any webspace with complete confidence.

A Truecrypt file could only be opened by getting the password right. A password like B33r&Mug could be cracked using a PC running 10,000 password guesses a second, however this would take approximately 22,875 years.......

I'll have a cup of tea and then make a start shall I??

[Mark H]

You might want to pass on the tea if you want to have any chance of cracking it before the end of the world

[chris ashdown]

most software only allows one word passwords of letters and Numbers

I wonder what difference it would make if you could also use comma's etc and especially spaces, which would I imagine really increase the time span,

But where it all fails is although it may take the 22000 years it could also be the first one found in 0.000001 seconds, or number ten at 0.00001 second