Miscellaneous laptop discussions forum: Buying laptop - is fingerprint security worth it?

http://www.google.com/search?q=Researcher+Hacks+Microsoft+Fingerprint+Reader&start=0&start=0&ie=utf-8&oe=utf-8&client=mozilla&rls=org.mozilla:en-US:unofficial

If you were looking for bulletproof can't leak solutions,
this may not be it. For instance even with this, what
stops me from removing the hard disk and copying out the
files?

I won't repeat the basics of security here. But you must
maintain physical control of that laptop.

Bob

I wonder why not an USB pocket hard disk for "your stuff"?

I saw the 100GB pocket unit for not a lot today.

Bob

The brand of the external drive doesn't really matter all that much. The actual drive inside will come from one of the major brands. I have seen little difference between brands. Some brands offer a 3 year warranty so you may want to look for that.

Just make sure the drive is a 1.8'' format, not the 2.5'' format. The 2.5'' drives are NOT pocket sized by the time they add the case and electronics.

Thanks for the in-depth answers, gentlemen.

The staff at the stores here normally cannot give me this kind of information.

K Katz

I work with laptops on a daily basis. I have had all kinds of requests for data recovery or file access e.g. I lost my BIOS password can you remove it? or I can't get into Joe Blow's profile to see what he's been hiding can you remove his passwords? etc. These things are easy to get around, even when users set Biometric passwords to stop people booting up their machine, easy to get around. And when they set Windows biometrics passwords for log-ins, also easy to remove.

The only thing that has stopped me so far is the Biometric "Safe" folder. Basically comes standard on Toshiba machines with Biometrics and uses your fingerprint as an encryption key for every file that you enter into that folder, and if you really want to get technical and remove the drive to try accessing that data, guess what, you can't. You are supposed to set a password as a backup to your fingerprint but really don't need to and it just weakens the folders security. You can even put your mail store files in there to prevent people opening your archive mail, just make sure you unlock your "Safe" before opening applications that references files you are keeping in it.

Having said that, life is a case of balance, you make a stronger lock and they make a stronger crook.

When you do get your machine set a BIOS password, a HDD password, a Windows Password and a register a fingerprint for your "Safe" folder then you can rest assured that your files are for your eyes only.

An extremely simple fix to this is "TAKE YOUR LAPTOP HOME AT NIGHT!" Why even risk a security breach, when you could just bring your laptop home each night and save yourself from all the multiple passwords for bios, hd, etc.

I like to look for simplicity.

To me, carrying the laptop home every night has its own pitfalls. So does having a removable drive (unless you need to carry your data between computers).

I take a simpler route.

Create a new, encrypted, virtual drive to hold all your data. You can move all your data there, such as your emails, word documents, and so on.

There are several such programs available (try sourceforge.net and download.com). Some are freeware, some are free for smaller-scale use, and some are high-end programs (such as pgp.com).

I use Cryptainer, and have been happy with it. Enter a password to load the drive. Close the program (or turn off the computer) to protect.

Choose the right program, and you have high-end cryptography that (supposedly) even the government can't break.

Well, you are optimistic. I have registered all my right hand fingerprints on my brand new Toshiba Tecra. Logging on using fingerprints is accepted about one time in five (counting 3 successive failures in one logon as one attempt). And I can just log on in the normal way and bypass the fingerprinting in any case.

Now it may be quite possible (I've not investigated it) to turn off the regular logon, but why should I - I'd be stranded most of the time? And it is very possible I'm doing something else wrong. But the first 2/3 times it worked. Maybe something got corrupted, but this is NOT a letter in support.

Meanwhile your boss is clearly someone to be avoided socially. I also live in a developing country and happen to be the boss. Such behaviour is unacceptable, and if it causes you to leave, he's lost a good worker. You want me to have a word with this idiot?

What type of files are you wanting to protect?

If you are wanting to place security over simple files created by a Microsoft Office programme such as "Word" then you can add a password to the file that will prevent the file from being opened. As far as I am aware, this sort of password doesnt have a "backdoor" in, but it is wise to bare in mind that this password cannot be reset or recovered if forgotten. It can be found by either going to "Save As..." and clicking the tools option within the box that opens and selecting "security" from the list of options. Not all of the Office programmes can have passwords added in this manner though, some you have to go to the "tools" menu, from there select "options" and then head to the "security" tab and apply passwords from there. You can add a password to either open a file, to edit a file or even both. If you apply one to both, then I would use 2 different passwords, this means that on the slim chance that your boss even manages to get through the first password, at least he cannot edit it without the second.
For other file types such as images and music, then im not so sure that passwords may be added in this manner, unless somebody else can rectify me otherwise...

Hope that helps

James.

My system: Sony Vaio AR790U/B Notebook PC Vista Ultimate.

After doing a lot of research I found what I believe to be one of the best security setups for my laptop.

First I replaced the Vaios 2 Seagate RAID hard drives my laptop came with for 2 Hitachi TravelStar 160GB hard drives that have hardware encryption built-in (Hitachi Bulk Encryption). The Bulk Encryption is activated by simply creating a password on boot in the BIOS. Once you create a password in BIOS, the entire hard drive is encrypted.

The encryption key is linked to the BIOS and cannot be removed or stored anywhere else. If the hard drives are removed from my notebook, they will not be readable by any other windows, Linux or any system. So in other words, the BIOS of my VAIO, holds the encryption key and if the VAIO and hard drive are separated from one another, then the data cant be accessed even with my password. Whats amazing about the Hitachi TravelStar drive is that the Bilk Encryption does NOT slow down my system at all in performance. Furthermore its actually faster because its running at 7200rpm rather than 5400rpms as the stock hard drives were rated at. Also the Hitachi 7200rpm drives use less power than a comparable 5400rpm drive from Seagate. Ive had the Hitachi drives installed for a few months now and all is perfect.

Now on top of the Hardware based encryption I went one step further and installed TrueCrypt 6.0a and did a full system encryption. Ive been told that my system should be just a bit slower but I honestly have not noticed. The TrueCrypt full system encryption has worked very well as in no issues or crashes of any kind. TrueCrypt requires you make a boot up CD, in case of corruption of the software. So Should TrueCrypt fail to work on boot up, you can use the CD, but youll still need to enter your password. I also do a weekly backup of all my data (using the AMAZING SyncBackSE), to an external USB 2.0 drive (which is entirely encrypted by TrueCrypt as well and stored in a small fireproof safe).
This security setup means that each time I start my Laptop, first the BIOS password entry field pops up 5sec after pressing the power button. Immediately after pressing that password, TrueCrypts password entry field comes up; I enter that password (same long password as the one for BIOS but with a small modification). And then windows loads up and everything remains decrypted until I simply shut down windows and everything becomes encrypted again and its all very quick as if nothing is going on.

Now my only complaint is that even though my long passwords are easy for me to remember and input; I would very much like it if I could have a USB biometric fingerprint reader that I could just insert and have it enter the BIOS and TrueCrypt passwords for me. Sadly, it seems that there is no correct technology that would allow this because Windows needs to boot before you can use a Biometric USB reader. If Im wrong about this, I would love to hear of a possible solution to this?

Ashton

id say just use your bios password instead of the windows password.. thats the better way to go imo