Just how secure do you need to be?

[cytherian]

I've read a number of articles on-line about security, about the latest AES-256 encryption, and so on. Everything seems to be making the assumption that you're guarding against a highly skilled hacker that wants to crack your password and access your files.

But really... just how secure do we need to be?

I'm fully convinced that a secure browser with anti-malware software installed is a must. You just never know when you may inadvertently end up on a nasty website, or receive an attack via the mistake of a colleague or friend that sends you a contaminated e-mail.

But what about your local files? If they're not something you edit or read frequently, I can see zipping them up with an AES-256 encryption featured utility (like WinRAR or 7z). Chances are, the breach of your laptop could be theft or loss... but then, the person who gains your laptop is probably much more interested in resale of your hardware than your personal files.

Then there's the matter of password files. For those of us who have multiple e-mail accounts and use different ID's on several forums, it can become difficult to remember the passwords used for each if they aren't accessed frequently. Storing the passwords in a file makes sense, but a basic text file would be asking for trouble. So, how do you manage this? A password protected Excel spreadsheet is probably a good idea if you're just wanting to be sure that anyone who you mind allow use of your computer can't get access. But a more sophisticated password management program might be in order if you really want to be secure.

What is your strategy for file system security?

 

[ignatzatsonic]

I had a brief torrid affair with pwsafe to manage my passwords.

pwsafe | Free Security & Utilities software downloads at SourceForge.net

I gave it up, but can't recall why.

I'm generally a bit spooked of encryption, fearing that it is either a pain to deal with or might cause problems, such as corrupted files. I keep thinking I should do something about encrypting or otherwise making safe a couple of files, but continue to live dangerously.

I'm backed up heavily and have standard virus and malware protection, but that's about it.

 

[whs]

Anything sensitive I run in Ubuntu in a virtual machine. For the host system I make frequent images - but there is really nothing that could be of interest for a hacker.

 

[Layback Bear]

I keep my password in a little file box in my office/computer room. Some viruses are designed to just cause problems. Their seam to be people that brings joy to. So they create such things. That is why I run what some might say to much security. I rather do that than spend time cleaning out the bad things. To me a normal home computer would at least need a active anti virus and firewall. I have more. To me a bigger problem is people don't keep things like Adobe and Java ect. updated. Another no no people do is download something and don't scan it before installing it. It is kind of like the gas and go crowd. Don't check anything like oil, tires, filters, fluids in their car. Just gas and go. Then wonder why their car doesn't work as it should. Only in new computer users they might now know of all the little things that should be done or checked under the hood of a computer. That's why we are here.

 

[elstupido]

Sandboxie is your friend

 

[Jacee]

My passwords are hand written and hidden under a rock somewhere in the yard

 

[pincushion]

I use Truecrypt containers for my personal information such as passwords or other stuff I need to secure. It is free, reliable (never had a problem in perhaps a decade of use) and it is easy to back-up containers. I use RoboForm for all web passwords (free for up to 10 passwords I think) and I bought it since I do have more than the 10. No problems in using that either. All the passwords are stored in a Truecrypt container as well. I have to remember a secure password of about 20 characters to access either Truecrypt or Roboform but since I tend to use this frequently it is not a problem. The easiest way I have found is to 'chunk' semi-random characters until they can be concatenated and subsequently remembered and this key password is NOT written down anywhere. I could use one of greater length if I wanted but I consider 20 to be adequate.

As to web security well I seem to be living dangerously were it not for the fact that I have NEVER had any malware in over a decades use. I use NIS and SpywareBlaster, run as admin with UAC off, use IE9 for most normal web-browsing and the latest Firefox for anything else - run in Private mode with cache to memory and I use Noscript. I use CCleaner after EVERY browsing session (erasing with single random set) and I do this EVERY time I access my bank or buy anything on-line before continuing browsing. I have separate e-mail accounts for bank, purchasing, and general correspondence, and never open e-mails I am not expecting. I am careful as to where I download any software but I have several free apps that appear to be reliable as well as much bought software. I don't play games, do any p2p file-sharing or any other possibly illegal downloading. I think the latter is the problem for many rather than malware from web-surfing.

I use a second HDD and USB drives to back-up all my data and I image my system partition using Macrium Reflect free edition in case I need to recover from problems. I have used Macrium many times to recover from software problems and this too is very reliable in my view. I image about once a month now and the last restore I needed to do was over a year ago.

Just to add, I wouldn't recommend running as admin with UAC off but for me personally I prefer the greater control over my system and more convenience for me that this supplies.

:huh:

 

[M1GU31]

Have one main email and a backup to recover your main email with different passwords and never use your email passwords for stuff like forums or websites.Use a anti virus and firewall and setup your router firewall to block pinging. That's how i have it ,use a third party firewall that configs the windows firewall to not let in connections from the outside unless i have them listed in the list that they are allowed to pass through.Check with malwarebytes about every 2 weeks or so and if you have to have your passwords written down then do it on a piece of paper,it will be safer then having it in your computer even though it has a password imo. I mean you can trust ppl in your house can you? If not then just hide it and lock it somewhere that they don't know about. Also don't install java,i have it uninstalled and rarely almost 99.9% run into something that needs java. Also don't download anything with a exe or zip file unless its 100% from a trusted source,good to scan a zip file before opening it with a antivirus if your unsure. Saw that one of you mentioned using uac but I don't like it and believe i'm experienced enough to take care of myself with out windows nagging me all the time.

 

[pincushion]

Have one main email and a backup to recover your main email with different passwords and never use your email passwords for stuff like forums or websites.Use a anti virus and firewall and setup your router firewall to block pinging. That's how i have it ,use a third party firewall that configs the windows firewall to not let in connections from the outside unless i have them listed in the list that they are allowed to pass through.Check with malwarebytes about every 2 weeks or so and if you have to have your passwords written down then do it on a piece of paper,it will be safer then having it in your computer even though it has a password imo. I mean you can trust ppl in your house can you? If not then just hide it and lock it somewhere that they don't know about. Also don't install java,i have it uninstalled and rarely almost 99.9% run into something that needs java. Also don't download anything with a exe or zip file unless its 100% from a trusted source,good to scan a zip file before opening it with a antivirus if your unsure. Saw that one of you mentioned using uac but I don't like it and believe i'm experienced enough to take care of myself with out windows nagging me all the time.

If it was me you refer to about UAC then I said I have it switched off, having the same preference as yourself. Agree about most other things and not having Java and it has been officially stated to remove it since it is a very real danger. Have not used it for a long time.

:huh:

 

[Borg 386]

I think a good general rule is to keep as much sensitive data off your PC as possible. Don't have anything on there unless you absolutely need to have it there. Most viruses go digging for personal information & transmit that back home.

If you keep sensitive files on a CDR, you still have access to them...

Here's an interesting article I found recently...

Can You Trust Your Browser With Your Passwords? | PCWorld

 

[M1GU31]

Have one main email and a backup to recover your main email with different passwords and never use your email passwords for stuff like forums or websites.Use a anti virus and firewall and setup your router firewall to block pinging. That's how i have it ,use a third party firewall that configs the windows firewall to not let in connections from the outside unless i have them listed in the list that they are allowed to pass through.Check with malwarebytes about every 2 weeks or so and if you have to have your passwords written down then do it on a piece of paper,it will be safer then having it in your computer even though it has a password imo. I mean you can trust ppl in your house can you? If not then just hide it and lock it somewhere that they don't know about. Also don't install java,i have it uninstalled and rarely almost 99.9% run into something that needs java. Also don't download anything with a exe or zip file unless its 100% from a trusted source,good to scan a zip file before opening it with a antivirus if your unsure. Saw that one of you mentioned using uac but I don't like it and believe i'm experienced enough to take care of myself with out windows nagging me all the time.

If it was me you refer to about UAC then I said I have it switched off, having the same preference as yourself. Agree about most other things and not having Java and it has been officially stated to remove it since it is a very real danger. Have not used it for a long time.

:huh:

Oh i just sort of briefly went through the whole thread,didn't see that one part about you having it off Anyways yea sorry about that.

 

[kbrady1979]

If there is ever a time where you do something without thinking of all the bad stuff that could happen, you are probably not doing it right lol

 

[A Guy]

I use Roboform. Only have to remember the master password. All browser saved passwords are easily found if someone has access to your system. My banking password is in my head. Have Keyscrambler for obfuscating when accessing. Have Zemana looking for keyloggers. Nothing else on my PC I'd worry about falling into anyones hands.

That said, I have overkill security I'm sure, but it doesn't require any effort to maintain, it doesn't eat up a lot of resources, and doesn't slow my PC down. I have never had a virus, or had anything bad infect my system. Now that could be like George Gobel said.,"There was not one Japanese aircraft got past Tulsa".



A Guy

 

[cytherian]

Some really great advice in this thread; thanks for contributing!

As a rule, I always have UAC enabled. It's just good sense and when you're used to entering your password, the process is easy.

I have a fingerprint reader on my computer, so whenever I start it or come out of sleep, all I have to do is swipe my finger. I registered more than one finger, just in case. You can also tie this in to various browsers, but I haven't gotten up the nerve to try this yet. Part of me realized that the less I type passwords, the sooner I'll forget them. I make a point of never forgetting my main login password, though.

On my computer, I created an Excel spreadsheet with some innocuous "home inventory" information in it. There are 100 blank spreadsheets in it. Around sheet 60, I have passwords stored, and it doesn't take long to get there if you know how to navigate Excel. So, it's basically a camouflaged file for confidential information. But if someone looked through it with a binary/hex reader, they'd find the info. As such, all of my passwords are missing some common digits, replaced with ".."; the only place where that information is located is in my head and my will. I'm going to make a point of checking out Roboform and Truecrypt, though.