How good is Win XP Pro encryption?

metalmackey · 11 Nov 2006 at 21:04

Hi,

If I encrypt data on a usb hard drive using the in-built encrytion of XP Pro, how safe is the data if the drive gets stolen?

Thanks

oddjob62 · 11 Nov 2006 at 21:21

Pretty much unbreakable. So make sure you backup your keys in case your computer dies.

metalmackey · 11 Nov 2006 at 21:28

Is the key based on the logon password?

oddjob62 · 11 Nov 2006 at 21:42

http://support.microsoft.com/kb/241201

Memphis · 11 Nov 2006 at 21:46

oddjob62 said:
Pretty much unbreakable. So make sure you backup your keys in case your computer dies.

I can vouch for that. A user of ours managed to encrypt his files. Of course, when we had to change his user ID, he could no longer access.

He lost all of his data.

Ev0 · 11 Nov 2006 at 22:14

Memphis said:
I can vouch for that. A user of ours managed to encrypt his files. Of course, when we had to change his user ID, he could no longer access.

He lost all of his data.

Couldn't you of used the recovery agent certificate or whatever it's called and recovery account to get the data back?

It's turned on for a certain dir on our laptops for users, was funny last week as the certificate expired which messed things up for them a bit

Memphis · 11 Nov 2006 at 23:25

Ev0 said:
Couldn't you of used the recovery agent certificate or whatever it's called and recovery account to get the data back?

Well, long story short, no we couldn't. The circumstances in which the data became encrypted, and the shoddy setup of our servers ment that using the DRA was impossible.

bledd · 12 Nov 2006 at 01:24

oddjob62 said:
Pretty much unbreakable. So make sure you backup your keys in case your computer dies.

yup

as far as i'm concered its 100% reliable, and its definatly worth making a floppy backup of the key, since a password change renders the data unaccessable!

metalmackey · 12 Nov 2006 at 02:39

So if I change my logon password all I do to access the data again is import the backed up certificate? Can you import the certificate in another user account to?

Thanks

oddjob62 · 12 Nov 2006 at 09:05

metalmackey said:
So if I change my logon password all I do to access the data again is import the backed up certificate? Can you import the certificate in another user account to?

Thanks

If you CtrlAltDel and change your password i'm pretty sure that won't clear your certificates, but if you do a password reset, or the OS crashes and you need to reinstall, then you will need to import the certs again. I am almost certain you can import the certs into another account.

fumbles · 12 Nov 2006 at 09:55

Alterntively there is a programme known as TrueCrypt.
http://www.truecrypt.org/

metalmackey · 12 Nov 2006 at 21:55

I came accross this about the XP efs.

For obvious reasons, we won’t mention its greatest flaw. Suffice it to say that an unauthorised user equipped with a small screwdriver should never be allowed anywhere near the computer.

So what is this flaw?

ken1307 · 12 Nov 2006 at 22:40

metalmackey said:
I came accross this about the XP efs.
So what is this flaw?

I dunno, he might un-screw the HDD and take it away?

Berserker · 12 Nov 2006 at 23:50

Indeed. If any tom, dick, or hacker can carry away your PC (or parts thereof), then you may as well forget about security completely.

metalmackey · 13 Nov 2006 at 00:46

Isn't the whole point of encryption to protect the data if the computer/drive is stolen?

oddjob62 · 13 Nov 2006 at 00:55

Yes but in theory, if they had the whole PC, they could crack your user account password, log on, and then simply decrypt the files. That's if you've not set it up securely.

metalmackey · 13 Nov 2006 at 01:03

Any tips on making the accounts more secure?

bledd · 13 Nov 2006 at 01:10

use 8 character passwords with a mixture of capital letters, numbers and non alphabetical or numberic characters..

ie..

0v3rc/ocK

its a bit ott for home use.. but is very secure, a lot better than using a password like 'windows'

set screensaver to 1 min, and to require password upon closing screensaver (blank screensaver is good to use, becuase it switches back to login really quickly)

dont have autologin enabled

oddjob62 · 13 Nov 2006 at 08:22

Also you could disable LM Hash. That would make it a lot harder to brute force crack your password.

metalmackey · 13 Nov 2006 at 14:11

oddjob62 said:
Also you could disable LM Hash. That would make it a lot harder to brute force crack your password.

I just looked up how to do this. I already had a nolmhash in my reg which I set to 1 and rebooted. Does it matter the reg key is called nolmhash and not NoLMHash as it said in the guide?