Make using Truecrypt as easy as possible for teachers

[SimpleSi]

So, I'm playing this weekend with encryption (as report season coming up and it seems like me/teacher/head will get shot if class3's reports get lost on a bus and published in the Yorks Morning Pillar so ...

I've 2 plans....

 

1 buy some hardware encrypted pendrives but I've no idea how they work and what's the easiest one to use so I'd welcome any info there

 

and

2 preffered (as its cheaper) use truecrypt

 

Now I've only got to do about 7/school and I can autoit (or use the msi in the other thread) to get it installed on teacher's laptops/smartboard machines but I need for the teachers to able to use it as simply as possible (and I don't think clicking on automount inside the truecrypt program is easy enough!)

 

How are you using it?

 

regards

Simon

[SimpleSi]

mm - found the tray icon:embarassed:

 

Are people encrypting whole drive/partition or creating an encrypted file container?

[john]

The Encrypted Pen Drives are the easiest way I've found Si You just plug it in the PC, it loads up the software asking for the password, you enter that and voilla it just works.

[laserblazer]

What sort are you using John?

[john]

Safestick, well I'm using one of them, but that is what we are getting. We will be getting from from Proband as they are the cheapest place for them, as well as being a lovely sponsor on here They are very easy to work just like the Integral cheap ones but more secure.

[timbo343]

We have a couple of the Integral Rubber ones and they seem to work a treat. 6 times of entering your password wrong and it wipes the drive, plus they are AES 256bit encryption.

[john]

We have a couple of the Integral Rubber ones and they seem to work a treat. 6 times of entering your password wrong and it wipes the drive, plus they are AES 256bit encryption.

 

and the re-format works, as I gave that a try when I got mine

 

The Safesticks are more intelligent you can use software to control them, remotely reset them over the internet if they are lost so next time they see an internet connection they wipe themselves (a bit like a Win Mobile phone setup to Sync with the right version of Exchange) and have some other clever tools on the software.

[SimpleSi]

Thansk for the feedback - I was thinking that the Truecrypt solution was too cheap (even more me )

 

But I still need as cheap as possible as I just want them as a backside covering item for school reports (not the most sensitive of data I'd hope we'd all agree) so I'm going to buy a an integral one to try out.

 

Now all my teacher laptops run as admin but will they work OK if the user doesn't have admin privleges? (as a head from a school I don't work at was asking about them for her school and I suspect their laptops are locked down)

 

regards

 

Simon

[FN-GM]

how much do these Safesticks cost? Ish?

Do you need admin rights to run the .exe on the pen drive?

 

Thanks

[timbo343]

Thansk for the feedback - I was thinking that the Truecrypt solution was too cheap (even more me )

 

But I still need as cheap as possible as I just want them as a backside covering item for school reports (not the most sensitive of data I'd hope we'd all agree) so I'm going to buy a an integral one to try out.

 

Now all my teacher laptops run as admin but will they work OK if the user doesn't have admin privleges? (as a head from a school I don't work at was asking about them for her school and I suspect their laptops are locked down)

 

regards

 

Simon

 

Si

 

I know that the intergral ones work fine just as long as you havent blocked any exes running from any local group policies. On our network we found a problem that we have created a software restriction on drive D: E: and F: etc to stop exes running from usb sticks. The only thing we had to do was just remove this and they work fine even with locked down accounts. They don't require you to install anything, it just works off the stick.

[timbo343]

and the re-format works, as I gave that a try when I got mine

 

The Safesticks are more intelligent you can use software to control them, remotely reset them over the internet if they are lost so next time they see an internet connection they wipe themselves (a bit like a Win Mobile phone setup to Sync with the right version of Exchange) and have some other clever tools on the software.

 

I think we looked at the safe stick option but decided it was going to cost too much, but we liked the management idea of it all.

[Sylv3r]

These Safesticks certainly sound good - I am interested in the price also if you are able to share.

 

I might grab one as a test unit to have a play - I notice a few sites offer an evaluation unit, not sure if I could put up with the additional sales calls though!

[john]

I think we looked at the safe stick option but decided it was going to cost too much, but we liked the management idea of it all.

 

Yeh they are costly things (pricing is on the Proband website so sign into your account if you are a member or PM them on here to sign up) they are the cheapest place for them as they got the big NHS contract for them and as a result of that buying power they got there price cannot be beaten.

 

The reason we will go for them is they are the only ones that seem to be recommended and approved by our dear friends Tim and its all about ticking boxes

[enjay]

SafeStick's management software is certainly powerful, but we simply couldn't justify the cost - something like £750 for the console and £20/1GB stick. Encrypted drives (all types, not just SafeStick) also have the disadvantage that they take about 10 seconds from inserting to being usable, which I don't think is acceptable.

 

I'm about to get people using TrueCrypt - container folders, not whole drive encryption, with autorun files / right-click options to mount/dismount. Thanks in a huge way to Arthur for helping me with this.

[SimpleSi]

Well I've got an Integral Crypto drive.

 

Now I've "discovered" TTM (Truecrypt traveller mode) - there's not much difference in ease of use but the Integral screen is simpler (but non-standard so I'll need to show them how to use it) whereas the TTM uses standard windows dialog box (but has 5 unnecessay options!)

 

The Integral involves little setting up (just the password really) but TTM needs (a little bit more work)

 

The Integral makes the 1st autorun partition look like a CD ROM so I can enable CD-ROM autorun but still keep USB Autorun disabled so that's good.

 

 

I think on balance the Integrals win

 

regards

Simon

PS Now - what's the reality of long passwords/brute force attacks.

 

How long would it take the Yorks Morning Fence (employing a spotty faced youth) to find out the names of class 1 and how they did in literacy on a normal 2 year old laptop if the password was 6 chars?

 

Anyone here done that sort of thing (and is able to talk about it with killing me afterwards )

[enjay]

PS Now - what's the reality of long passwords/brute force attacks.

 

How long would it take the Yorks Morning Fence (employing a spotty faced youth) to find out the names of class 1 and how they did in literacy on a normal 2 year old laptop if the password was 6 chars?

 

http://www.mandylionlabs.com/documents/BFTCalc.xls

[SimpleSi]

[delete]I'm not too sure that's how long it would take a 2 year laptop? [/delete]

(Just saw that it is )

[SimpleSi]

looks like passphrases are going to be the key then

(10chars or more)

[PiqueABoo]

Anyone here done that sort of thing (and is able to talk about it with killing me afterwards )

 

Yeah, I'm a retired world expert on the Windows NT side of things.

 

Passwords are context dependant i.e. a good password for one system/application, isn't necessarily a good one for another. It depends on the crypto and in some cases how it is configured e.g. not a lot of people know this, but you've been able to adjust some interesting bits in Windows so you can take account of advances in brute force rates (via newer, faster hardware), since XP. Further some crypto despite being labelled as something you've heard of e.g. AES, isn't necessarily implemented or used well and can at times seriously undermine the security of your lovely long and complex passwords. [i've seen an app touting AES which when I played, took seconds for any password]

 

Summary: There is no reliable answer unless you know the system/application the password is for.

[dicox]

We encrypt whole laptop with truecrypt - saves any messing about - just one extra password to remember when logging in. Takes an hour or so to do but worth it in my opinion. Have to keep a Truecrypt rescue CD for each laptop though.

I've attached a guide I wrote for other techies in my LA. (I think - first time attachment user....)

Truecrypt.pdf

[jamin100]

if you run truecrypt from the command line (or a shortcut) with /n added then it wont make you burn the ISO image. Instead you can just store them on the server somewhere and burn them when you need to.

[SimpleSi]

@dicox

Best 1st post of the year

 

regards

 

Simon