RainbowInWater

Handing laptops to friends

Slashdot has a request for information from an art student who wants to know how to let other people briefly use their laptop while still protecting the laptop from infection and the data from snooping. After glancing at the slashdot comments the answers can be roughly grouped into these categories.

• Setup a guest account and use quick user switching. This solution works on both Windows and Linux.
• Use VMWare or equivalent software. Start the VMWare and run all your questionable things including other people’s logins in it.
• Say “NO.” Don’t ever loan out your laptop, its yours not theirs and lending it is an necessary risk from the point of physical and data damage.

How to keep secure passwords in your pocket

Security Focus has an interesting blog post on writing down passwords. The recommendation is that you then select a four character common “pin” which you memorize. For each site you then select a complex completely random unique six character password and write it down on a paper in your wallet. The password for each site is generated by appending your memorized password to the password written in your wallet to create a secure ten character password. The idea is that now you are using different passwords for each site but are not experiencing the extra cognitive load of memorizing a large number of long passwords. You are also not writing down complete passwords so someone stealing your wallet will not have your complete passwords.

I think this is an interesting idea and would be interested in any known research on its effectiveness and usability in practice.

Physical and file system access-control merging?

I was trolling through my daily news feed when I ran across this article on SecureIDNews. Its about a company which is marketing a card which controls access to both physical spaces and computers. I found this an interesting article since my research focuses on ethnographic studies of both physical and logical access-control administration. As a researcher I continuously get criticism from the computer security community that physical access control is a solved problem that has nothing to do with them. I’m glad to see someone interested in merging control of the two systems and am interested in how the merger will go.

Collection of articles on security metrics

The metrics center has a nice collection of articles on security metrics and data anonymization.

http://www.metricscenter.org/index.php/resourcesmain/articles

Posted under Interesting URLs | No Comments »