-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Robert J. Hansen escribió: > Faramir wrote: >> OMG... 8 highly complex steps... surely that will defeat any attempt >> to seize my private key... > > Not really. > > Imagine a piece of malware that looks for new drives to be mounted. As > soon as it gets mounted, the malware looks through the drive looking for > interesting data. Malware such as this already exists and has been > spotted in the wild. > > As soon as you mount a TrueCrypt volume, it becomes subject to these > sorts of attacks. Note that the malware design doesn't have to > accommodate TrueCrypt at all. The design is simple enough and robust > enough to work regardless of whether you're using TrueCrypt or PGPDisk, > or whether you're plugging in a USB token or a FireWire external hard > drive, or... etc., etc.
Ok... but I think I would use this at my university, and there the computers are safe enough... I can run programs (I have used portable FireFox a lot of times), but I can't install anything... and a malware would need to make changes to windows registry in order to be loaded each time the computer start... The idea is to protect the private key if the USB flash drive is lost or stolen. I really think nobody will even know what is a secret key, but since we are talking about security... I mean, I am intending to protect an email nobody is going to hack, so, I should protect the key too, even if nobody is going to know what to do with it if they found it... Maybe I found an interesting solution: steganography. I can hide the secret key inside a picture, and carry some pictures with me, as well as the java program to recover it... Or maybe I should just use a "son-of-b***h" passphrase that will take some thousand years to bruteforce... By the way, how is the private keyring protected? Regards -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQEcBAEBAgAGBQJIJJY6AAoJEIISGkVDGUEOqJsH/ia3VMuHfb4Y9rVuQjsEThP3 EG+WJlDClJ6ASOZpKu2bUQJxmrq0ZiJsHFZuZ6aYaX7zq0uzDcGeNw+Bod/4swRW hT3u32ZOFqbiY9FIPft5QGR6Vl9lwGBK3d7QxHx9n3v54+LbteHoNq+LU4rNRfnx rA7Hj4eLWaD6mZlhvAKMWGPfxiaM5xLiH7MQ/EkXfS6UAxgm5Q0l9turYXGdxDuk t+UuXvmJ+dKKIuxaKa9GyjlyZemAjgEBxsWy+jMa2H/xgSfbFv1vJVufi27x2e91 ZKFqgvstPbuJ+XTLWj9BEy/DrUo5TFo2c+bdJIjqmcCbdftfsz+vvQ8qt+jZxG8= =rjDj -----END PGP SIGNATURE----- _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
