Data storage for the truly paranoid...

[pc-0x90]

While thinking of what I was bringing to defcon in terms of computers & software, I decided on bringing backups of my software on CD, but I wasn't sure how I wanted to store my pgp keys.

A couple ideas came to mind, such as on a smart card, with a USB reader/writer (just enough space for a key I believe, and fits nicely in a wallet) or a USB Keychain hard-drive..

I was wondering if anyone has used either of these techs much, or has had better ideas for this kind of thing in the past.

(One low tech option that's already been suggested was to just carry a sheet of paper in my wallet, but that's just not nifty enough for me)

[skroo]

One of my favourites was my old Rio PMP300. It only had 32MB of RAM, but that was more than enough for some useful tools, various keys, and a tune or two.

Somewhere out there (though the name escapes me) is a package that treats the PMP300 as another physical drive, so you can treat as just another part of the filesystem. Windows and Linux version were both available IIRC, and there was even a similar driver for BeOS, though it only worked under R4.5.

[fremont_dslam]

If you have the money, i find that Sony Memory sticks kick ass! I have 2 128 Mb sticks, a floppy disk adapter, and a usb device, both needed driver wrinting, but is wasn't too hard. And it acts like a mountable filesystem, and best of all they are so small, so they are easy to hide anywhere ( shoe, electrical socket, whatever )

[blackwave]

Originally posted by pc-0x90
I was wondering if anyone has used either of these techs much, or has had better ideas for this kind of thing in the past.


Smart Cards/ USB Tokens work wonderfully, depending on the size of your key and the size of your smart card you may fit one or two certs on one device. This is also a good method to keep your key private since the device will zeroize when there are 1 too many invalid pin attempts. (These devices usually require some type of middleware to interface with)

Though if you have a lot of large keys and want to carrry them all, you can use a USB flash drive (they are up to a gig), and are the size of a usb token, (just nowhere near secure)...

The work around I came up with for a lot of private data was to NTFS format the usb drive, and then load PGPDisk (from the last pgp international version that included it) this way if the usb drive is lost they would still need a passphrase to mount the drive, and use whatever is inside. Of course you could also use EFS/NTFS which would require a cert on the machine to be able to access the PGPDisk file to mount it...

The cool thing with the flash drives is that most oses support them so all you do is plug-and-pray...

Some of the newer flash drives are coming out with a simple passphrase to unlock the drive... but I am waiting to get one of those in a week or so... surely the password middleware will be broken in a few minutes... :)

[astcell]

Those USB keys are cook but be sure which way your ports face, you may not be able to set the laptop flat and still use it.

I use SecureID by RSA security, I will login to a VPN with a password that changes every 60 seconds.

[blackwave]

Originally posted by astcell
Those USB keys are cook but be sure which way your ports face, you may not be able to set the laptop flat and still use it.


Yeah, most flash drives come with a USB extension cable that can fit in your usb-mini hubs. They are also inexpensive enough to carry a few around or keep in a safe deposit box for 10 years.

[astcell]

If you have 4 USB ports, make a RAID out of the drives...I wonder if you can put some of the boot sector on it. The potential is unlimited.

[blackwave]

Originally posted by astcell
I wonder if you can put some of the boot sector on it.

In fact the flash drives are bootable, though mostly come limited to booting to a Windows environment. :)

[astcell]

Are the USB devices friendly to Linux?

[blackwave]

Originally posted by astcell
Are the USB devices friendly to Linux?

Yes they are *nix compatible :)

[L0nd0]

Originally posted by blackwave


In fact the flash drives are bootable, though mostly come limited to booting to a Windows environment. :)


I was able to get BEOS as well as Linux to boot via flash drive, it dose work but it takes a bit of tweaking. I believe I got it to work with Linux by accident not sure. But Blackwave is definitly right in this matter flash drives are really a windows friendly device.

[blackwave]

Originally posted by L0nd0
But Blackwave is definitly right in this matter flash drives are really a windows friendly device.

They are certainly phun to play with, I should be getting the latest model any day now... :)

[astcell]

How about if I use 4 USB ports and install Windows in a RAID across 4 1GB cards, then encrypt the results so that you need all 4 cards to even boot the device....

Just when you build a bigger mousetrap, along comes a smarter mouse.

[blackwave]

Originally posted by astcell
How about if I use 4 USB ports and install Windows in a RAID across 4 1GB cards, then encrypt the results so that you need all 4 cards to even boot the device....


You certainly would have the fastest windows on the planet.

[astcell]

I'll get the BSOD much faster than anyone else! Flash cards are not good for computer ram because of too many read/writes, the cards do have a limit. I wonder about the 1GB drives through, if they can handle many read/writes, and thus be used as a main PC drive.

[blackwave]

Originally posted by astcell
I wonder about the 1GB drives through, if they can handle many read/writes, and thus be used as a main PC drive.

Could be a fun little project...

[astcell]

Oh it can handle being th drive, I wonder if it can handle being the RAM, the flash card that is. The cards have a r/w capability of about 100,000 r/w, whixh is great for digital cameras but for computer memory, it'll last a few days.

Yea, great to test and find out but not on MY dollar!

[blackwave]

Originally posted by astcell
I wonder if it can handle being the RAM, the flash card that is.

Sounds like over complicating and paying more for than something would be worth.

[astcell]

Speaking of paying more, why is 128MB SDRAM going for $11 but a 128mb flash card is $99?

[blackwave]

At yesterday's meeting Freaky whipped out his usb token and mentioned that it is the kind that has that middleware 'security'... unfortunately he said this security feature doesn't work on anything other than windows.. ;)
I will get mine soon... it would be too funny if I used a windows box to 'protect' the data, and then if I mounted it on an *nix/BSD box would it just show me the data?... oh well we shall see. <laughing hysterically>

[astcell]

Well if anything needs security it's Windows! The fact that it only works on windows just compounds the error. It's like having a padlock that will not work on a vault, it will only work on a shoebox.

[blackwave]

Originally posted by astcell
Well if anything needs security it's Windows! The fact that it only works on windows just compounds the error. It's like having a padlock that will not work on a vault, it will only work on a shoebox.

haha, nice analogy... I will check to see if this is the case when it comes in. :)

[zero]

Originally posted by blackwave
I will get mine soon... it would be too funny if I used a windows box to 'protect' the data, and then if I mounted it on an *nix/BSD box would it just show me the data?... oh well we shall see. <laughing hysterically>

Unlikely....I'd suspect, since it's the easiest to do, that they've created a crypto driver for windows but not other platforms.

[blackwave]

Originally posted by zero
Unlikely....I'd suspect, since it's the easiest to do, that they've created a crypto driver for windows but not other platforms.

I am still waiting to get mine. It would be lame if all required was not to use their new driver and still be able to access the data. But however lame it may be, it certainly wouldn't be surprise in the least.

[astcell]

Speaking of data storage for the paranoid (are we?) can I use two IBM 1GB Microdrives in PC Card slots and have a RAID on them?

[mfreeck]

Originally posted by astcell
Speaking of data storage for the paranoid (are we?) can I use two IBM 1GB Microdrives in PC Card slots and have a RAID on them?

I've heard from various sources that microdrives die in about a year, and also have a long "warm up" time before they recognize correctly.

[astcell]

They have a 1 year warranty...figures. I wonder if they die more when used in a computer vs. a digital camera? I guess that means I'll stick with CF cards.

[mfreeck]

Originally posted by astcell
They have a 1 year warranty...figures. I wonder if they die more when used in a computer vs. a digital camera? I guess that means I'll stick with CF cards.

I heard a long rant from someone (a journalist I think) who hated microdrives... I am not even sure they made it through warranty. I have also heard from someone who used it in a mobile computer who said it was 1yr. CF cards also last ~1yr in a computer if you are silly enough not to do something about the tmp files.

[astcell]

I believe that if a microdrive gets corrupted you lose one file, but if you drip it you can lose all your data, and a CF card can survive a drop while a corrupt sector can lose all the data on the card.

I thought about the possibility of using the CF card for RAM, but apparently the CF can only be written and read about a million times, which is fine for digital photography but not for RAM.

[mfreeck]

Originally posted by astcell
I believe that if a microdrive gets corrupted you lose one file, but if you drip it you can lose all your data, and a CF card can survive a drop while a corrupt sector can lose all the data on the card.


I hadn't heard about possible corruption. I believe though that when the CF dies (stop being able to write), you still have all the data there, unlike a HD. That's how it worked for my PMP300 anyways.


I thought about the possibility of using the CF card for RAM, but apparently the CF can only be written and read about a million times

Heh, yeah, I wouldn't recommend that. :) CF with a ramdisk on the other hand would be happy. So far 1G CF is down to ~$450, but that is still alot for one measly gig.

[astcell]

1GB CF at $450? Where at? I still see them for $999. I got my 512mb card for $163.

[mfreeck]

Originally posted by astcell
1GB CF at $450? Where at? I still see them for $999. I got my 512mb card for $163.
Actually just under $490 (http://store.yahoo.com/upgradecenterinc/mefc1g.html)
512mb are about $140 and falling. Most vendors still sell 1gb for about $750 though.

[astcell]

My 128mb card was $199 two years ago... I do hope the 1GB comes down!

[highwizard]

The USB 2.0 Portable Hard Drive has served my friends quite well for a while. http://www.thinkgeek.com/computing/drives/5ad4/