encrypt
Latest
OS X Lion update accidentally outs user passwords in plain text, stumbles over FileVault
Are you an avid user of OS X's FileVault encryption and running a recently updated version of Lion? It may be time to consider changing your passwords. According to security researcher David Emry, users who used FileVault prior to upgrading to 10.7.3 may be able to find their password in a system-wide debug log file, stored in plain text outside of the encrypted area. This puts the password at risk of being read by other users or enterprising cyber criminals, Emry explains, and even opens the door for new flaw-specific malware. FileVault 2, on the other hand, seems to be unaffected by the bug. The community doesn't currently have a way to fight the flaw without disabling FileVault, so users rushing to change their password now may find it being logged as well. Obviously, we'll let you all know once we hear back from Apple regarding this matter.
Passware claims FileVault 2 can be cracked in under an hour, sells you the software to prove it
Lunch hours may never feel safe again. That is, if you have a Mac running Lion / FileVault 2, like leaving your computer around, or have unscrupulous colleagues. Data recovery firm Passware claims its "Forensic" edition software can decrypt files protected by FileVault 2 in just 40 minutes -- whether it's "letmein" or "H4x0rl8t0rK1tt3h" you chose to stand in its way. Using live-memory analysis over firewire, the encryption key can be accessed from FileVault's partition, gifting the pilferer privy access to keychain files and login data -- and therefore pretty much everything else. If you want to try this out for yourself, conveniently, Passware will sell you the software ($995 for a single user license) without so much as a flash of a badge.
Dell adding Samsung's encrypted SSDs to its arsenal
Dell's been doing both solid state and encrypted drives for some time now, but only now is the company combining both efforts and preparing to offer encrypted SSDs in the coming months. The Samsung-manufactured drives will come in 64GB, 128GB, and 256GB options, and though the hardware encryption method isn't specified, we'd venture a guess it'll have something to do with Trusted Computer Group's 128-bit standards adopted by Sammy and virtually every other drive maker back in January. No word just yet on how much they'll cost, but if current prices are any indication, it won't come cheap.
Iomega kicks out two more eGo portable hard drives
The last Iomega eGo drives we saw were notably sleek, but the company's going back to a more bruiser image with the newest in the series -- the Encrypt and BlackBelt once again feature that rubber PowerGrip that cushions the case against impact. As you might expect, the $150 Encrypt features hardware-based 128-bit AES encryption that pops up when the drive is connected to a Windows PC to protect your 320GB of precious memories, while the $120 BlackBelt drops the fancy-pants crypto and just murders out 250GB of storage with a double-black finish and little rubber spikeys. That ought to scare the bad guys away, right? Available now, with the usual assortment of backup utilities you'll just delete anyway. [Via Electronista] Read - BlackBelt Read - Encrypt
Safari AppleScript to enable Private Browsing, mount temporary download disk image
Now that we know how to enable the AppleScript menubar item, it's time to give Safari some AppleScript-enabled privacy features.For all those times when you need to enable Private Browsing and 'private downloading' in Safari, a macosxhints reader has posted an AppleScript with setup instructions that can enable Private Browsing and mount a disk image and temporarily changing Safari's download folder to said disk image for the ultimate in browsing privacy (macosxhints uses 'online banking' as a usage scenario; I guess that works).The script requires a little bit of setup and customization however, so check out the post for instructions. When you're finished you'll have a simple, handy AppleScript that prompts you to enable or disable Private Browsing in Safari, and then it will mount your encrypted (password-prompted) disk image for safe, secure and private downloading as well. Enjoy.
1Passwd - password/form manager lets Firefox use the Keychain
*Oh snap!* Agile Web Solutions has created a password and form manager extension for both Safari and Firefox that fixes one of my biggest gripes about Mozilla's flagship browser: it can store website passwords in Mac OS X's Keychain Access application. For those who haven't stumbled upon the wonders of the Keychain: it's a system-wide secure password manager that most other Mac OS X apps can use to store logins for things like websites and FTP access. 1Passwd is an extension that, amongst other features, lets Firefox join the Keychain party party so you can have one secure, centralized area for managing (and backing up) your logins. This also means that if you have a .Mac account, any passwords you enter into Firefox will sync between your Macs. But 1Passwd doesn't stop at handle just your login information. Check out the full feature list to see everything else it can do for both Safari and Firefox.If beer could be sent virtually through PayPal, I'd send Agile Web Solutions a twelve pack; this brings Firefox one step closer to being a true Mac OS X browser. 1Passwd is currently in a third beta release, and those who opt to test the beta and offer their email addresses will receive a discount off its (somewhat steep) $29.95 price.
JungleDisk offers a far cheaper, cross-platform, encrypted iDisk
JungleDisk is quite possibly the first serious, easy to set up alternative I've seen to Apple's .Mac iDisk. Using the power of WebDAV, JungleDisk allows you to mount an online, syncing hard drive (with various size options available) on Mac OS X, Windows and Linux, and save and access data to and from it as if you were working with files in a local folder on your desktop. This is all run through Amazon's S3 online storage web service, which is "based on the idea that quality Internet-based storage should be taken for granted". As an extra kick-in-the-pants to .Mac's iDisk, data sent to and from your JungleDisk is encrypted. A software package is available for each OS to make installation and setup a snap.Pricing is spectacularly low, though I'm slightly confused as to how billing works. They truly mean: "pay only for what you use" - there isn't a flat monthly or yearly fee for your storage and bandwidth. Instead, on their pricing page, they state that you are charged $0.15 USD per gigabyte of storage per month, and $0.20 USD per gigabyte of data transfer. They offer a convenient pricing chart on their main page to compare with other services.I'm already a .Mac customer right now, as I like the integration of all their other services. But JungleDrive sounds like a great alternative for those who only want the ease of use of an iDisk. If you have already used this service or will try it out soon (bonus points for more than one platform), please feel free to comment on your experience.[via ~stevenf]
Automator action for encrypting/decrypting files
Interested in beefing up security on some of your files or folders, but wary of the consequences if FileVault takes on a mind of its own? This Encrypt and Decrypt Files Automator action might be right up your alley, as it allows you to perform these actions with an algorithm and password. Perfect for fitting into the workflows of even the most security-conscious Mac OS X Tiger users.The action is free and can be had over at Automator World.
