Encryption

formerprof · 2006-05-03T14:14:42+00:00

My credit card number was recently compromised, probably through an on-line merchant, although there is no way of knowing. I've suffered no loss and of course the bank has changed my number. The whole affair has forced me to think about security much more seriously however.I maintain Quicken 2005 on my main desktop machine and run it in parallel on my laptop. The files contain my credit card number. I think they must if statement downloads are to work properly. If physical access to either of these machines is obtained by a thief those accounts are compromised; I wouldn't be surprised to find my social security number somewhere in the machines also. The laptop is of course more vulnerable to theft or loss.What to do? How secure is Quicken file encryption? If it's like WORD or EXCEL there are easily available password crackers which open encrypted files, sometimes in a matter of minutes.Good wishes to all. Advice & information will be gratefully received.formerprof

May 03, 2006 44 Replies

Rate this thread:

Andrew DeFaria 20 years ago

So what? It provides little security and is easily defeated. Instead of finding it in the default spot you have to look around a little bit. Big deal

Exactly, it's really no security.

The point is inserting a slt folder in the path to the profile does nothing to keep things secure as any programmer with 1/2 a brain can simply scan for the files. The slt folder does nothing. It's akin to saying "I left my car keys on my desk instead of hanging up on the key rack therefore my car is secure".

Vote

Mark Hood 20 years ago

I don't think that's true (I haven't tested it however).

EFS creates a personal security certificate based on the user account. You can copy this certificate onto removable media (mine is on a thumb drive, protected with a password), remove it from Windows, and then nobody can read the encrypted files (including yourself) until you import the certificate again and supply the password.

Presumably, if you have the certificate and password, you can import it into another account and read the encrypted files (I'll try this tonight).

To get access to your encryption certificate, enable EFS, go to Internet Options in the Control Panel, select the Content tab, and then select Certificates -- you should then see your personal certificate in the next pane. From there you can export it to anywhere you want, and remove it if you like. To re-import it, double click on its icon from wherever you copied it.

I use EFS because it's convenient and transparent, but it probably isn't as strong as I would like.

-- Mark

Vote

Andrew DeFaria 20 years ago

IIRC in a domain environment, domain admins also have the ability to unlock your EFS files for you. This is probably a last resort if users of a domain lose their certs. Then again, I think it probably very rare the number of home users who have bothered to set up a domain! I know I haven't.

So that adds a vulnerability as well as a method of recovery...

Vote