Re: Password

I agree that application encryption is a farce.  In fact, I believe it
to be a trap for the unwary.

Your proposed solution is helpful (I have been using this directory
scheme for the past 12 years.)  But it only protects data from honest
people and it probably doesn't need protection from them.  In one
sense, it is just swapping user passwords for document passwords.
There are lots of programs that will crack passwords, be they user or
document, fairly quickly unless a very random password is used.  There
are several schemes for creating random pass words that are easy to
remember forever -- well at least until you get over 70.  Any one that
can gain physical access to any computer can get everything off of it
hard drive.  This applies to the cleaning lady as well as the staff.

I've spent many hours thinking about this possible problem and, in my
humble opinion, there is no way to achieve really good security
without using are really good security product like Jerry recommended
and be very careful about installing, using and preserving pass
phrases.  I have some ideas about that also, but that's for another
time. 

By the way, Jerry, one doesn't necessarily have to _buy_ such a
product.  One of if not the best one available is available for most
operating systems.

http://gnupg.org

and is free for the time and trouble of installing it.  Of course, you
can always hire some one to install it for you. ;)  But there are
packages of Window binaries with clever installers.  A quick
configuration guide can be found at:

http://support.isite.net/Eops/GnuPG/

A word of caution: the link to the winpt.org download page is
inaccurate. It is now hosted by SourceForge and a link to the
download page can be found at at the top of:

http://winpt.sourceforge.net/en/

Don't knock it till you've tried it.  It is really very simple and
fast to use.

If I've repeated stuff you already know, I apologize.  

Bobby Sanders

--On Wed, 4 Aug 2004 21:10:30 -0400, "Annette S. Leung" <aleung-o/[email protected]> said:

  ASL> There are a number of solutions that are much more secure than
  ASL> file-level password protection, which I don't think has been
  ASL> seen as particularly useful for many years now. Aside from
  ASL> encryption, which is probably unnecessarily complex for most
  ASL> business environments and working documents, security can be
  ASL> applied at the level of the operating system; this is possible
  ASL> in Windows, Unix/Linux variants, and should not be a problem
  ASL> with Mac OSX. Documents can be stored in directories on a file
  ASL> server that are accessible only to specific users and user
  ASL> groups. The server can be set up so that users can only see
  ASL> and/or modify documents in directories that they have access
  ASL> to. Although very granular control can be achieved, it does not
  ASL> necessarily require large amounts of administrative time. In
  ASL> addition, groupware like Microsoft Exchange server, should be
  ASL> able to create similar structures that are somewhat easier to
  ASL> administer, allowing delegated users to add/delete people
  ASL> authorized to access particular project/client directories.

  ASL> Is there still room for abuse? Sure, but schemes like the above
  ASL> can often limit the amount of damage large numbers of people
  ASL> can do and concentrate it in the hands of a hopefully
  ASL> well-screened few.

---- Original message ----
  >> Date: Wed, 04 Aug 2004 19:42:37 -0400 From: "Stuart Levine"
  >> <[email protected]> Subject: [NetLawyers] Password To:
  >> [email protected]
  >>
  >> One of the attorneys in this office password protected a
  ASL> computer folder
  >> several years ago and now wants to access teh folder, but
  ASL> has forgotten the
  >> password.  He asked me how to gain access.
  >>
  >> I did not know, but knew that the web knew.  I put in the
  ASL> words "wordperfect
  >> lost password" on alltheweb.  I received 62,800 hits.  I
  ASL> did not go past the
  >> first 20 hits, all of which were for commercial software
  ASL> that promised to
  >> recover the password, in most cases inexpensively.
  >>
  >> Now, I will assume that only 1/3 of the remedies actually
  ASL> work.  Does that
  >> trouble anyone on this list besides me?  What would prevent
  ASL> me or a
  >> disgruntled employee from buying the software and accessing
  ASL> all of a firm's
  >> sensitive material?  (While the cheap software that will
  ASL> remedy the problem
  >> only ties into WordPerfect, the same site offered software
  ASL> that would
  >> allegedly would crack Lotus, Quicken, Quickbooks, etc.)
  >>
  >>
  >> ******************************************** Stuart Levine Fisher
  >> & Winner, LLP 315 North Charles Street Baltimore, Maryland 21201
  >> Telephone: 410.385.2000 Telecopier: 443.927.7075 Cellphone:
  >> 410.802.5817 Weblog: http://taxbiz.blogspot.com
  >> http://www.taxation-business.com [email protected]
  >> *********************************************
  >>
  >>
  >>
  >>
  >> ------------------------ Yahoo! Groups Sponsor -------------
-------~-->
  >> Make a clean sweep of pop-up ads. Yahoo! Companion Toolbar.  Now
  >> with Pop-Up Blocker. Get it for free!
  >> http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/dpFolB/TM
  >> ------------------------------------------------------------
--------~->
  >>
  >> -/-/-/-/-/
  >>
  >> There is a read/write Web page with resources that will be
  ASL> linked there and used during the Seminar on PDFs for lawyers
  ASL> and legal applications:
  >>
  >> http://Network-Lawyers.org/PDFLinks
  >>
  >> -/-/-/-/-/
  >>
  >>
  >>
  >> Yahoo! Groups Links
  >>
  >>
  >>
  >>
  >>


------------------------ Yahoo! Groups Sponsor --------------------~--> 
  ASL> Make a clean sweep of pop-up ads. Yahoo! Companion Toolbar.
  ASL> Now with Pop-Up Blocker. Get it for free!
  ASL> http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/dpFolB/TM
--------------------------------------------------------------------~->

  ASL> -/-/-/-/-/

  ASL> There is a read/write Web page with resources that will be
  ASL> linked there and used during the Seminar on PDFs for lawyers
  ASL> and legal applications:

  ASL> http://Network-Lawyers.org/PDFLinks

  ASL> -/-/-/-/-/


 
  ASL> Yahoo! Groups Links



 


------------------------ Yahoo! Groups Sponsor --------------------~--> 
Yahoo! Domains - Claim yours for only $14.70
http://us.click.yahoo.com/Z1wmxD/DREIAA/yQLSAA/dpFolB/TM
--------------------------------------------------------------------~-> 

-/-/-/-/-/

There is a read/write Web page with resources that will be linked there and used during the Seminar on PDFs for lawyers and legal applications:

http://Network-Lawyers.org/PDFLinks

-/-/-/-/-/


 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/Network-Lawyers/

<*> To unsubscribe from this group, send an email to:
    Network-Lawyers-unsubscribe-hHKSG33TihhbjbujkaE4pw@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/