Some random and ultimately pointless commentary
-
From the cybersecurity training: > Nonpublic information should only be saved to your network drive Why do we even have hard drives then on our computers? IMO, non-public information includes source code, proprietary in-house and third party documentation, and so forth. WTF? But this one: > The information on your computer is only fully protected by encryption when it is powered off or in hibernate mode. Simply locking your computer is not sufficient for encryption. :laugh: Yeah, information is definitely "protected" when the computer is off. But how encryption protects your data when the computer is off is beyond me. Maybe I'm not as smart as I thought. And unrelated, when I browsed over to norsecorp.com (live feed of cyberattacks, yeah, right) I got this (my bold): > This page is currently offline. However, because the site uses Cloudflare's Always Online™ technology you can continue to surf a snapshot of the site. We will keep checking in the background and, as soon as the site comes back, you will automatically be served the live version. Dude. You really don't want to use "currently offline" and "Always Online" in the same sentence. :laugh:
Latest Article - Building a Prototype Web-Based Diagramming Tool with SVG and Javascript Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny Artificial intelligence is the only remedy for natural stupidity. - CDP1802
Marc Clifton wrote:
Nonpublic information should only be saved to your network drive
So "private" information then? If it's private to me, I'm not sure it should be made "publicly" available.
Marc Clifton wrote:
Dude. You really don't want to use "currently offline" and "Always Online" in the same sentence. :laugh:
I understand what you are saying, but perhaps since the latter is a proper noun (i.e., capitalized), it's not really referring to a state, thus those terms can co-mingle. :confused:
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
-
Marc Clifton wrote:
how encryption protects your data when the computer is off is beyond me
When the power goes off, the decryption key field that is generated by the processor fan stops, and the HDD then loses the ability to decrypt it's magnetically stored data. (With SSD drives, it's all down to little tiny Leprechauns who live in the SATA cable)
Sent from my Amstrad PC 1640 Bad command or file name. Bad, bad command! Sit! Stay! Staaaay... AntiTwitter: @DalekDave is now a follower!
OriginalGriff wrote:
(With SSD drives, it's all down to little tiny Leprechauns who live in the SATA cable)
What did they do to the homunculus that used to have that job? You didn't cheap out and get the Leprechaun version, did you?
"The difference between genius and stupidity is that genius has its limits." - Albert Einstein
"If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010
-
Marc Clifton wrote:
Nonpublic information should only be saved to your network drive
So "private" information then? If it's private to me, I'm not sure it should be made "publicly" available.
Marc Clifton wrote:
Dude. You really don't want to use "currently offline" and "Always Online" in the same sentence. :laugh:
I understand what you are saying, but perhaps since the latter is a proper noun (i.e., capitalized), it's not really referring to a state, thus those terms can co-mingle. :confused:
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
David Crow wrote:
but perhaps since the latter is a proper noun (i.e., capitalized), it's not really referring to a state, thus those terms can co-mingle.
Quite so, but the proper noun is a product that "guarantees" delivery of a cached static page when your server is down. Which (the cached static page) wasn't working. :rolleyes:
Latest Article - Building a Prototype Web-Based Diagramming Tool with SVG and Javascript Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny Artificial intelligence is the only remedy for natural stupidity. - CDP1802
-
David Crow wrote:
but perhaps since the latter is a proper noun (i.e., capitalized), it's not really referring to a state, thus those terms can co-mingle.
Quite so, but the proper noun is a product that "guarantees" delivery of a cached static page when your server is down. Which (the cached static page) wasn't working. :rolleyes:
Latest Article - Building a Prototype Web-Based Diagramming Tool with SVG and Javascript Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny Artificial intelligence is the only remedy for natural stupidity. - CDP1802
Maybe that page falls outside of the "limited copy" range, or it's perhaps not considered "popular."
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
-
OriginalGriff wrote:
(With SSD drives, it's all down to little tiny Leprechauns who live in the SATA cable)
What did they do to the homunculus that used to have that job? You didn't cheap out and get the Leprechaun version, did you?
"The difference between genius and stupidity is that genius has its limits." - Albert Einstein
"If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010
The manufacturers outsourced the work to Ireland years ago.
Sent from my Amstrad PC 1640 Bad command or file name. Bad, bad command! Sit! Stay! Staaaay... AntiTwitter: @DalekDave is now a follower!
-
From the cybersecurity training: > Nonpublic information should only be saved to your network drive Why do we even have hard drives then on our computers? IMO, non-public information includes source code, proprietary in-house and third party documentation, and so forth. WTF? But this one: > The information on your computer is only fully protected by encryption when it is powered off or in hibernate mode. Simply locking your computer is not sufficient for encryption. :laugh: Yeah, information is definitely "protected" when the computer is off. But how encryption protects your data when the computer is off is beyond me. Maybe I'm not as smart as I thought. And unrelated, when I browsed over to norsecorp.com (live feed of cyberattacks, yeah, right) I got this (my bold): > This page is currently offline. However, because the site uses Cloudflare's Always Online™ technology you can continue to surf a snapshot of the site. We will keep checking in the background and, as soon as the site comes back, you will automatically be served the live version. Dude. You really don't want to use "currently offline" and "Always Online" in the same sentence. :laugh:
Latest Article - Building a Prototype Web-Based Diagramming Tool with SVG and Javascript Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny Artificial intelligence is the only remedy for natural stupidity. - CDP1802
Some people have a mouth that is Always Online™ even when their brain is currently offline :D
Best, Sander Continuous Integration, Delivery, and Deployment arrgh.js - Bringing LINQ to JavaScript Object-Oriented Programming in C# Succinctly
-
Not knowing the exact situation, I might still give them the benefit of doubt and assume they were using folder redirection. You can set up folders - and the desktop is a perfectly good candidate - to be rerouted to some server share. I'm not a domain policy expert, but I'd be surprised if it couldn't be done and that some organizations are doing exactly that today.
Windows has Roaming Profiles which are copied back and forth when you log on or off. One issue my company ran into under XP was that the IE cache folders were in the user profile so the copy process would take forever.
-
Windows has Roaming Profiles which are copied back and forth when you log on or off. One issue my company ran into under XP was that the IE cache folders were in the user profile so the copy process would take forever.
Roland M Smith wrote:
Windows has Roaming Profiles...
Not by default it doesn't. If you set up the servers, Active Directory and Group Policy correctly it will have.
Michael Martin Australia "I controlled my laughter and simple said "No,I am very busy,so I can't write any code for you". The moment they heard this all the smiling face turned into a sad looking face and one of them farted. So I had to leave the place as soon as possible." - Mr.Prakash One Fine Saturday. 24/04/2004
-
From the cybersecurity training: > Nonpublic information should only be saved to your network drive Why do we even have hard drives then on our computers? IMO, non-public information includes source code, proprietary in-house and third party documentation, and so forth. WTF? But this one: > The information on your computer is only fully protected by encryption when it is powered off or in hibernate mode. Simply locking your computer is not sufficient for encryption. :laugh: Yeah, information is definitely "protected" when the computer is off. But how encryption protects your data when the computer is off is beyond me. Maybe I'm not as smart as I thought. And unrelated, when I browsed over to norsecorp.com (live feed of cyberattacks, yeah, right) I got this (my bold): > This page is currently offline. However, because the site uses Cloudflare's Always Online™ technology you can continue to surf a snapshot of the site. We will keep checking in the background and, as soon as the site comes back, you will automatically be served the live version. Dude. You really don't want to use "currently offline" and "Always Online" in the same sentence. :laugh:
Latest Article - Building a Prototype Web-Based Diagramming Tool with SVG and Javascript Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny Artificial intelligence is the only remedy for natural stupidity. - CDP1802
I think it was HP that had a laptop that was insanely secure, but may have been slightly less so if you were already logged in.
-
From the cybersecurity training: > Nonpublic information should only be saved to your network drive Why do we even have hard drives then on our computers? IMO, non-public information includes source code, proprietary in-house and third party documentation, and so forth. WTF? But this one: > The information on your computer is only fully protected by encryption when it is powered off or in hibernate mode. Simply locking your computer is not sufficient for encryption. :laugh: Yeah, information is definitely "protected" when the computer is off. But how encryption protects your data when the computer is off is beyond me. Maybe I'm not as smart as I thought. And unrelated, when I browsed over to norsecorp.com (live feed of cyberattacks, yeah, right) I got this (my bold): > This page is currently offline. However, because the site uses Cloudflare's Always Online™ technology you can continue to surf a snapshot of the site. We will keep checking in the background and, as soon as the site comes back, you will automatically be served the live version. Dude. You really don't want to use "currently offline" and "Always Online" in the same sentence. :laugh:
Latest Article - Building a Prototype Web-Based Diagramming Tool with SVG and Javascript Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny Artificial intelligence is the only remedy for natural stupidity. - CDP1802
Quote:
Nonpublic information should only be saved to your network drive
This means that only public (insensitive) data should be on your computer in case it is lost or stolen?
Quote:
The information on your computer is only fully protected by encryption when it is powered off or in hibernate mode. Simply locking your computer is not sufficient for encryption.
As mentioned before, encryption keys are deleted from memory cache when computer is powered off. I gues that's how BitLocker works, this is talking about disk encryption!
-
No, they thought the desktop was some kind of special entity of the operating system that only the person currently logged on could access. They had no idea it was just a folder on the drive and the desktop an application that renders those files as icons.
Lots of people refuse to believe me when I tell them that super-cryptic login password on your home PC is a poor joke if your computer is stolen (or seized by some authorities, if that is what you fear). I have had to open their PC and pick out the disk, then install it as the D: drive on my own PC (with my own login), and show them: Look here, I can read your files that you thought were secret because I couldn't log in with your password! I see their open mouths and the horror in their faces... You can take some measures, such as using Windows' built in encryption of your private files. Once you log in, giving your password, Windows inspects it: Yes, that's what I expected, then I will decrypt your files for you. ... But Windows knew in advance all it needs to decrypt the files. If some FBI agent puts the disk with the encrypted files into his special-edition Windows, telling it: Now pretend that Joe Smuggler just has specified his login password, and go ahead: Decrypt his files for me, as you would for him! - then Windows has all the info it needs to do the job. My version of Windows won't accept an order to simulate a Joe Smuggler login, but I am sure that such versions exist. In the IDE days, I had a hardware encryption device on the IDE cable, with a physical key (looking like a USB stick) that had to be plugged in when the machine was rebooted, then it could be unplugged and hidden away. In those days, the electronics were not fast enough to handle more than a 40 bit key, yet I consider that far more safe than today's BitLocker where Windows doesn't need you to supply a single bit of secret key: It will decrypt without that. It has all the information it needs to open up the disk. I never saw such encryption devices for SATA; maybe the FBI has made them illegal in the USA. They could be marketed in other countries, though! Unless I have to supply a key that Windows doesn't know, doesn't save, the files are not protected against eavesdropping, period. In theory, Windows could have a keylogger and an analysis program that knows which applications are encryption programs, and save the password typed along with the file name in a secret database, but I am not that paranoid; I don't think Windows does.
-
> The attack relies on the data remanence property of DRAM and SRAM to retrieve memory contents that remain readable in the seconds to minutes after power has been removed. I was working with a video capture card (B&W) in the 80's. I had turned the machine off, pulled the card out of the slot and moved it to another computer, then booted that computer. Crazily, even after a couple minutes of no power, a good 80% of the image that had been in memory was still there and recognizable. We're talking minutes, not seconds, and not SRAM either.
Latest Article - Building a Prototype Web-Based Diagramming Tool with SVG and Javascript Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny Artificial intelligence is the only remedy for natural stupidity. - CDP1802
How did you make sure the new boot didn't overwrote memory space? Also how did you access that specific part of memory?
-
dandy72 wrote:
Not knowing the exact situation
They're idiots. That's the exact situation.
-
Windows has Roaming Profiles which are copied back and forth when you log on or off. One issue my company ran into under XP was that the IE cache folders were in the user profile so the copy process would take forever.
That's not the policy I had in mind. In any case - I remember that one very well - a few years ago, when MSDN still shipped on CDs/DVDs, they made the mistake at one point of installing 1+ GB worth of data to the roaming profile...which slowed down logins to the point where it rendered systems unusable. I'm a first-hand witness in this case.
-
From the cybersecurity training: > Nonpublic information should only be saved to your network drive Why do we even have hard drives then on our computers? IMO, non-public information includes source code, proprietary in-house and third party documentation, and so forth. WTF? But this one: > The information on your computer is only fully protected by encryption when it is powered off or in hibernate mode. Simply locking your computer is not sufficient for encryption. :laugh: Yeah, information is definitely "protected" when the computer is off. But how encryption protects your data when the computer is off is beyond me. Maybe I'm not as smart as I thought. And unrelated, when I browsed over to norsecorp.com (live feed of cyberattacks, yeah, right) I got this (my bold): > This page is currently offline. However, because the site uses Cloudflare's Always Online™ technology you can continue to surf a snapshot of the site. We will keep checking in the background and, as soon as the site comes back, you will automatically be served the live version. Dude. You really don't want to use "currently offline" and "Always Online" in the same sentence. :laugh:
Latest Article - Building a Prototype Web-Based Diagramming Tool with SVG and Javascript Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny Artificial intelligence is the only remedy for natural stupidity. - CDP1802
The information on your computer is only fully protected by encryption when it is powered off or in hibernate mode. Simply locking your computer is not sufficient for encryption. :laugh: Yeah, information is definitely "protected" when the computer is off. But how encryption protects your data when the computer is off is beyond me. Maybe I'm not as smart as I thought.
I guess this refers to some setup of encryption keys is done during boot up (for e.g. full disk encryption) or login (for private user files encryption). If someone can access the computer in other ways while it is still running, and with the keys set up, the intruder may be able to decrypt files. If the intruder can log in under another user name, full disk encryption doesn't protect the disk. If he can access the machine through a network, he may be able to impersonate himself as you, and retrieve your files regardless of keyboard and screen being locked. If the full-disk encryption requires a password at boot time, the thief won't be able to boot up the machine. If you haven't logged in, the decryption of your personal files is not set up. So I am not laughing as much of it as you do. I do laugh at Windows decrypting my personal files without me giving any decryption key, and I must have blind faith in Windows not doing the same encryption for someone else. But if you open an encrypted .zip archive in WinZip, and type in the secret password for retrieving one file from the archive, then WinZip will remember that password until you close WinZip, so that any passer-by could sit down at your desk and see other encrypted files without specifying the password. You must exit WinZip to avoid such peeking. Similarly, you must log out to avoid peeking into your Windows encrypted private files. Even though it is old now: Security aware people should read the design documents for the Kerberos authentication system. There is a thorough discussion of all the considerations they made to make sure no eavesdropper would be able to pick up secret keys and passwords.
