Re: Password

.  Your proposed solution is helpful (I have been using this 
.  directory scheme for the past 12 years.)  But it only 
.  protects data from honest people and it probably doesn't 
.  need protection from them.  In one sense, it is just 
.  swapping user passwords for document passwords. There are 
.  lots of programs that will crack passwords, be they user 
or 
.  document, fairly quickly unless a very random password is 
.  used.  

It never hurts to at least limit the damage that can be done 
and certainly, making it difficult to find the files at all 
is useful. 

Not much you can do about the sticky note under the keyboard 
with sensitive passwords though, that's true. Security 
always comes down to both physical security and user 
education, otherwise social engineering wouldn't be a 
problem.

---- Original message ----
>Date: Wed, 4 Aug 2004 21:33:08 -0500
>From: Bobby Sanders <bsanders-QbcWA/[email protected]>  
>Subject: Re: [NetLawyers] Password  
>To: [email protected]
>
>I agree that application encryption is a farce.  In fact, I 
believe it
>to be a trap for the unwary.
>
>Your proposed solution is helpful (I have been using this 
directory
>scheme for the past 12 years.)  But it only protects data 
from honest
>people and it probably doesn't need protection from them.  
In one
>sense, it is just swapping user passwords for document 
passwords.
>There are lots of programs that will crack passwords, be 
they user or
>document, fairly quickly unless a very random password is 
used.  There
>are several schemes for creating random pass words that are 
easy to
>remember forever -- well at least until you get over 70.  
Any one that
>can gain physical access to any computer can get everything 
off of it
>hard drive.  This applies to the cleaning lady as well as 
the staff.
>
>I've spent many hours thinking about this possible problem 
and, in my
>humble opinion, there is no way to achieve really good 
security
>without using are really good security product like Jerry 
recommended
>and be very careful about installing, using and preserving 
pass
>phrases.  I have some ideas about that also, but that's for 
another
>time. 
>
>By the way, Jerry, one doesn't necessarily have to _buy_ 
such a
>product.  One of if not the best one available is available 
for most
>operating systems.
>
>http://gnupg.org
>
>and is free for the time and trouble of installing it.  Of 
course, you
>can always hire some one to install it for you. ;)  But 
there are
>packages of Window binaries with clever installers.  A quick
>configuration guide can be found at:
>
>http://support.isite.net/Eops/GnuPG/
>
>A word of caution: the link to the winpt.org download page 
is
>inaccurate. It is now hosted by SourceForge and a link to 
the
>download page can be found at at the top of:
>
>http://winpt.sourceforge.net/en/
>
>Don't knock it till you've tried it.  It is really very 
simple and
>fast to use.
>
>If I've repeated stuff you already know, I apologize.  
>
>Bobby Sanders
>
>--On Wed, 4 Aug 2004 21:10:30 -0400, "Annette S. Leung" 
<aleung-o/[email protected]> said:
>
>  ASL> There are a number of solutions that are much more 
secure than
>  ASL> file-level password protection, which I don't think 
has been
>  ASL> seen as particularly useful for many years now. 
Aside from
>  ASL> encryption, which is probably unnecessarily complex 
for most
>  ASL> business environments and working documents, 
security can be
>  ASL> applied at the level of the operating system; this 
is possible
>  ASL> in Windows, Unix/Linux variants, and should not be a 
problem
>  ASL> with Mac OSX. Documents can be stored in directories 
on a file
>  ASL> server that are accessible only to specific users 
and user
>  ASL> groups. The server can be set up so that users can 
only see
>  ASL> and/or modify documents in directories that they 
have access
>  ASL> to. Although very granular control can be achieved, 
it does not
>  ASL> necessarily require large amounts of administrative 
time. In
>  ASL> addition, groupware like Microsoft Exchange server, 
should be
>  ASL> able to create similar structures that are somewhat 
easier to
>  ASL> administer, allowing delegated users to add/delete 
people
>  ASL> authorized to access particular project/client 
directories.
>
>  ASL> Is there still room for abuse? Sure, but schemes 
like the above
>  ASL> can often limit the amount of damage large numbers 
of people
>  ASL> can do and concentrate it in the hands of a hopefully
>  ASL> well-screened few.
>
>---- Original message ----
>  >> Date: Wed, 04 Aug 2004 19:42:37 -0400 From: "Stuart 
Levine"
>  >> <[email protected]> Subject: [NetLawyers] 
Password To:
>  >> [email protected]
>  >>
>  >> One of the attorneys in this office password protected 
a
>  ASL> computer folder
>  >> several years ago and now wants to access teh folder, 
but
>  ASL> has forgotten the
>  >> password.  He asked me how to gain access.
>  >>
>  >> I did not know, but knew that the web knew.  I put in 
the
>  ASL> words "wordperfect
>  >> lost password" on alltheweb.  I received 62,800 hits.  
I
>  ASL> did not go past the
>  >> first 20 hits, all of which were for commercial 
software
>  ASL> that promised to
>  >> recover the password, in most cases inexpensively.
>  >>
>  >> Now, I will assume that only 1/3 of the remedies 
actually
>  ASL> work.  Does that
>  >> trouble anyone on this list besides me?  What would 
prevent
>  ASL> me or a
>  >> disgruntled employee from buying the software and 
accessing
>  ASL> all of a firm's
>  >> sensitive material?  (While the cheap software that 
will
>  ASL> remedy the problem
>  >> only ties into WordPerfect, the same site offered 
software
>  ASL> that would
>  >> allegedly would crack Lotus, Quicken, Quickbooks, etc.)
>  >>
>  >>
>  >> ******************************************** Stuart 
Levine Fisher
>  >> & Winner, LLP 315 North Charles Street Baltimore, 
Maryland 21201
>  >> Telephone: 410.385.2000 Telecopier: 443.927.7075 
Cellphone:
>  >> 410.802.5817 Weblog: http://taxbiz.blogspot.com
>  >> http://www.taxation-business.com [email protected]
>  >> *********************************************
>  >>
>  >>
>  >>
>  >>
>  >> ------------------------ Yahoo! Groups Sponsor --------
-----
>-------~-->
>  >> Make a clean sweep of pop-up ads. Yahoo! Companion 
Toolbar.  Now
>  >> with Pop-Up Blocker. Get it for free!
>  >> 
http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/dpFolB/TM
>  >> -------------------------------------------------------
-----
>--------~->
>  >>
>  >> -/-/-/-/-/
>  >>
>  >> There is a read/write Web page with resources that 
will be
>  ASL> linked there and used during the Seminar on PDFs for 
lawyers
>  ASL> and legal applications:
>  >>
>  >> http://Network-Lawyers.org/PDFLinks
>  >>
>  >> -/-/-/-/-/
>  >>
>  >>
>  >>
>  >> Yahoo! Groups Links
>  >>
>  >>
>  >>
>  >>
>  >>
>
>
>------------------------ Yahoo! Groups Sponsor -------------
-------~--> 
>  ASL> Make a clean sweep of pop-up ads. Yahoo! Companion 
Toolbar.
>  ASL> Now with Pop-Up Blocker. Get it for free!
>  ASL> 
http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/dpFolB/TM
>------------------------------------------------------------
--------~->
>
>  ASL> -/-/-/-/-/
>
>  ASL> There is a read/write Web page with resources that 
will be
>  ASL> linked there and used during the Seminar on PDFs for 
lawyers
>  ASL> and legal applications:
>
>  ASL> http://Network-Lawyers.org/PDFLinks
>
>  ASL> -/-/-/-/-/
>
>
> 
>  ASL> Yahoo! Groups Links
>
>
>
> 
>
>
>------------------------ Yahoo! Groups Sponsor -------------
-------~--> 
>Yahoo! Domains - Claim yours for only $14.70
>http://us.click.yahoo.com/Z1wmxD/DREIAA/yQLSAA/dpFolB/TM
>------------------------------------------------------------
--------~-> 
>
>-/-/-/-/-/
>
>There is a read/write Web page with resources that will be 
linked there and used during the Seminar on PDFs for lawyers 
and legal applications:
>
>http://Network-Lawyers.org/PDFLinks
>
>-/-/-/-/-/
>
>
> 
>Yahoo! Groups Links
>
>
>
> 
>



------------------------ Yahoo! Groups Sponsor --------------------~--> 
Yahoo! Domains - Claim yours for only $14.70
http://us.click.yahoo.com/Z1wmxD/DREIAA/yQLSAA/dpFolB/TM
--------------------------------------------------------------------~-> 

-/-/-/-/-/

There is a read/write Web page with resources that will be linked there and used during the Seminar on PDFs for lawyers and legal applications:

http://Network-Lawyers.org/PDFLinks

-/-/-/-/-/


 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/Network-Lawyers/

<*> To unsubscribe from this group, send an email to:
    Network-Lawyers-unsubscribe-hHKSG33TihhbjbujkaE4pw@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/