With recent cases of mass personal data going astray, many organisations, particularly in the public sector, have banned the removal of laptops from their normal locations until the data directories on laptop hard drives have been encrypted.
Here - the abstract is below - is a clear and convincing 5 minute video and paper from Princeton University's Center for Information Technology Policy by J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten, describing a common set of circumstances under which the password for the encrypted data can be extracted from the laptop, rendering the data easily available.
Contrary to popular assumption, DRAMs used in most modern computers retain their contents for seconds to minutes after power is lost, even at operating temperatures and even if removed from a motherboard. Although DRAMs become less reliable when they are not refreshed, they are not immediately erased, and their contents persist sufficiently for malicious (or forensic) acquisition of usable full-system memory images. We show that this phenomenon limits the ability of an operating system to protect cryptographic key material from an attacker with physical access. We use cold reboots to mount attacks on popular disk encryption systems — BitLocker, FileVault, dm-crypt, and TrueCrypt — using no special devices or materials. We experimentally characterize the extent and predictability of memory remanence and report that remanence times can be increased dramatically with simple techniques.
Google Sites - what JotSpot's "application wiki" has become
We've used JotSpot internally in ALT to good effect for our "Operations Manual" for several years; and during 2005-2006 I was involved in using it for producing the TUC's online course development and management manual. Last year Google bought JotSpot, and JotSpot went into a sort of benign limbo - we ceased having to pay for the service, no new features were added to it, and no new JotSpot sites could be created. After six months of rumour that the Google version of JotSpot was imminent, Google finally relaunched JotSpot today as Google Sites. I've not had a chance to look at it properly; but at first glance it appears simpler than JotSpot - not necessarily a bad thing, but not necessarily a good thing either. Our existing JotSpot site remains unchanged,
and the question within ALT will be whether we can start to create new user accounts on the site, which we've not been able to do since last year's take-over. I have a nasty feeling that we'll not be able to, though I hope I'll be proved wrong. with its functionality apparently intact. So far so good, but I had (naively) been hoping that existing JotSpot sites would miraculously transform themselves into the new "sites" system without any action by subscribers. According to this 29 February report in InfoWorld by Juan Carlos Perez, Google intends to provide a "one click" conversion process. If readers have insights or practical experience on this issue please comment below.Posted on 28/02/2008 in News and comment | Permalink | Comments (0)
|