I advise all users of the greater internet to employ encryption at any given opportunity.

Privacy is not just a matter of "having something to hide". More and more we live in a world where your personal data is for sale, whether it is specifically about you, or just a representation of you as a statistic to some advertiser.

I've been told by many that I should not offer advice on encryption. The reasons vary, but some of the more ridiculous ones have included "not letting the bad guys learn about encryption". News flash folks: the bad guys already know, and they're already using it. It's about time you did too.

The advice is simple: Only use encrytion based on open standards, and with source code available so that it can be scrutinised by the public at large. Ignore anything that claims to be proprietary, and especially anything that clamis to be "unbreakable". Understand that encryption is a moving target, and something that needs to change year to year as old standards are broken, and new standards prove to be more resilient and undergo better testing.

Good encryption is not difficult to achieve, and should not have to occur at dollar cost. Also remember that encryption is only part of the solution to data privacy. The more important aspect is you as the user. I won't go into the standard "don't click on strange email attachements" in this article, but please do apply some common sense.

The following are a list of free (as in freedom and as in cost) software that I use regularly. Where possible I try to use software that is cross platform, to allow simple migration of my workflow to other platforms should the need arise.

I use Mozilla Thunderbird. In conjunction I use Gnu Privacy Guard, which is an implementation of OpenPGP. To use this with Mozilla Thunderbird, use the Enigmail Plugin. Grab GnuPG here:

GnuPG for Linux/UNIX: http://www.gnupg.org/

GnuPG for Windows: http://www.gpg4win.org/

GnuPG for Mac: http://macgpg.sourceforge.net/

GnuPG and OpenPGP allow you to do several things. Firstly, you can digitally sign an email to let the reciever know it was definitely from you, and not a third party pretending to be you. Forging an email header is a trivial task, as email was designed in an era when the internet was a trusted platform with connectivity only from military and university institutions. Today it's anything but trustworthy. Similarly, GnuPG allows you to verify that someone else's digital signature is authentic.

In addition, GnuPG allows you to encrypt a message so that only the intended recipeint may read it. When you send an email, it passes through a host of MTAs (Mail Transfer Agents), each one capable of recording and holding the email. How often do you send an email of a personal nature to a loved one, or of a private matter to a work colleague? Encrypting the email via GnuPG/OpenPGP ensures that your message is seen by only the eyes intended (assuming the other party can keep their key a secret - see my warning above about human-level security). As expected, GnuPG also allows you to decrypt messages sent to you from a third party. In addition, GnuPG can act as a standard file encrypter. Handy should you want to encrypt archives of financial records, or perhaps the contents of a USB key.

PGP encryption is not limited to desktop email client users. Mozilla's Firefox web browser in general is a more secure browser, than the default browsers included with Windows and MacOSX, and is available for a multitude of platforms and languages. In addition, it has a marvellous plug-in system that allows the greater community to provide add-ons for the program that do all sorts of things (much like the Enigmail plugin I mention above).

FireGPG, like Enigmail, integrates with GnuPG to provide OpenPGP support for any website. (Meaning you will need to install GnuPG on your machine, available from the links mentioned in the e-mail section above). Whether you want to post a private message on a forum to a user, or send a simple email from a webmail provider, FireGPG handles any PGP text block. It also adds direct integration to Google Mail to add sign and encrypt buttons to the GMail interface.

FireGPG website: http://getfiregpg.org/

Unless you host your own IM server and provide TLS (Transport Layer Security), there's no knowing who gets to see the messages you type. User-to-user encryption via public key cryptography ensures that your messages can pass safely over an untrusted network. Pidgin for Windows and Linux, and it's Mac cousin AdiumX are multi-protocol IM clients that support most of the common IM platforms. They are built to include the ability to use common plugins. One such plugin is Pidgin-Encryption, which employs public-private RSA key pairs to offer automatic encryption of your text, and automatic decryption of text sent by the person you are chatting with.

Laptops and notebooks are becoming more and more popular (with some analysts indicating they are out-selling desktops currently). However as the Data Loss Database indicates, more and more of these devices are being lost and/or stolen. Many of them containing very important (sometimes confidential) data on them. Similarly many of us now carry USB keys (or "pendrives") that contain data far more valuable than the drive itself.

Encrypting files, or even entire partitions and disks is not difficult. Tools exist to do this and make accessing the data easy. One relatively new entry on the market is TrueCrypt. It allows you to create encrypted containers that can be mounted on your system (in Windows as a new drive letter, in Mac and Linux as folders or drives on your desktop) and from there may contain regular files and documents which are as easy to use as any regular file. TrueCrypt offers a wide range of features including multiple encryption ciphers (and the ability to chain them together, should you not trust any particular one), as well as hidden volumes (volumes that will not appear as valid data even under forensic analysis). Under Windows XP, Vista, Windows 7, Server 2003 and Server 2008, full-system disk encryption is also available, forcing a user to enter a password at boot time to access the encrypted disk. Unlike a BIOS password, this cannot be trivially reset, and the disk cannot be put in another system to access the data. A very handy utility for laptop users.

TrueCrypt is open source and free of charge. If you work for or own a business that regularly holds sensitive data (customer credit card numbers, client financial or tax records, etc) on laptops, pendrives, backups (CD/DVD, tapes, etc), encrypting them with TrueCrypt not only is morally responsible, but also allows you and your business to claim plausible deniability in the event that data is lost or stolen.

There are some USB pendrives on the market that offer on-chip encryption (such as IronKey). You can build something similar yourself by partitioning your USB pendrive in two: have one small 30MB partition with the TrueCrypt installers for the operating systems you use day to day, and the rest of your drive an encrypted partition holding your data. While it doesn't have the cool "self destruct" features of IronKey, it does mean you can convert any cheap and nasty USB key into an encrypted device with multi-platform support.

It's worth noting too that operating system manufacturers are now catching on to full-disk encryption, and offering features built in to the OS by default now. Windows Vista Ultimate users and Windows 7 Enterprise or Volume users should investigate BitLocker (sadly not available on "lower end" versions of Vista or Win7); MacOSX users from 10.3 and up can check out File Vault; and Linux users encrypted LVM (available on the Ubuntu "Alternate" installer CD). Please also be aware that some of these have limitations when compared with TrueCrypt. Reading up on these is left to the user.

Like email, telnet existed in a time when internet-using people were largely trustworthy. Today this isn't the case. SSH (Secure SHell) is a replacement remote access shell that encrypts all communication, passwords and data travelling between two computers. SSH is flexible in that it can be configured with public keys to avoid the need to repeatedly type passwords in when administering computers (handy for administrator types who control large amounts of servers). It can also be configured as a generic tunnel (quasi VPN) to encrypt and route data between machines (handy for breaking out past firewalls, or very stupid internet filters if you live in a country with a government run by morons). SSH can also be used to copy files securely between locations, which I cover in slightly more detail below.

Linux and Mac users have the free OpenSSH built in to their operating systems. Simple open a terminal and type "man ssh" to learn more. Windows users can download a variety of SSH clients, the most popular being PuTTY.

As mentioned above, SSH can be used for more than just remote administration. SFTP uses the same encrypted-path idea as SSH (even the same protocol) but provides a complete set of legacy FTP commands. And as with email and telnet, FTP was designed in an era when the Internet was considered fluffy and friendly (not to mention the problems FTP creates with PASV mode behind a NAT).

SFTP comes standard with OpenSSH Server on most Linux, UNIX and MacOSX servers. As of version 5.0, it also allows locking SFTP users down to just SFTP (ie: no SSH/shell access), and putting them in a "jail" that limits them to access only their home folders. Excellent as a secure and full replacement for legacy FTP servers

SFTP is rapidly being added to user-friendly FTP clients everywhere. Grab the following free clients:

Windows: WinSCP.

Windows, Mac, Linux: File-Zilla.

Mac: Cyberduck and Fugu.

Linux KDE users can type "fish://username@server" into Konqueror to browse to SSH/SFTP locations. Linux GNOME users can type "sftp://username@server" into Nautilus to to the same. Both KDE and GNOME will accept keys stored by ssh-agent.

When decommissioning old systems - whether you are selling old gear, giving it away, or returning work provided loan equipment, securely wiping the disks is a must. Contrary to popular belief, formatting your hard disk is not enough. For starters, quick formats only wipe the disk indexes or tables, and leave the actual data untouched. There are a multitude of zero-cost software programs that can recover data in these situations that are very easy even for novices to use. Low-level or "sector zeroing" software is a slightly better alternative, but still not very secure. Data recovery specialists can still recover most, if not all the data on a disk after one of these operations. While the cost may be high, the value (financial or otherwise) of the data on your disks may be higher.

And as mentioned several times now, a business or individual who at any time stored financial records of the general public (TFN/SSN, credit card numbers, bank details, even names and addresses of private citizens) could be up for civil or criminal penalties if they are known to inadvertently pass on such details even via ignorance or mistake (depending on the country you live in, of course).

Big companies should invest in proper hardware devices such as degaussing machines to seurely wipe data from magnetic media. Small businesses and individuals can use software that will generate and write random data in multiple passes to their hard disks. The more times this random data is written to a disk, the lower the chance of even sophisticated data retrieval tools finding all or any of the previous data.

For simple but reliable full system disk wiping, Darik's Boot And Nuke (or DBAN for short) is a good option. Download and burn the CD images to CD-R media, and boot from them. At boot time, choose the "dod" method, which will begin a 7-pass write of mixed random and alternating data patterns to all disks within a system (don't leave any floppy or USB drives in the system by accident!). DBAN works at boot time, outside of the operating system. Downloads are available for both PC and Apple hardware.

MacOSX users can use Disk Utilty's secure erase to erase non-boot disks (i.e.: useful for erasing plug-in USB drives and other removable media). Similar to the above, this will write random data to the disk a number of times (the more passes, the better).

Windows users can use Heidi Eraser also to erase non-system plug-in disks. Heidi Eraser also doubles as a secure file deleter, allowing you to write random data to a file before deleting it from your file system (as above, a standard "delete" merely removes references to a file, leaving the data behind until more data writes over it at a later date).

Sendmail is awful. Really. It needs to die. It has the worst configuration file(s) on the planet, and has been kludged and hacked over the years to try and be secure. If you are using Sendmail as your MTA (Mail Transfer Agent), please consider migrating to Postfix.

While you're there, add the following few lines to your /etc/postfix/main.cf config file:

smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_note_starttls_offer = yes

You will see TLS (Transport Layer Security) messages appear in your mail logs (defaults to /var/log/maillog for RedHat/CentOS, /var/log/mail.info for Debian/Ubuntu, and everyone else read your manuals).

These simple lines will enable basic opportunistic encryption to Postfix. Note that this is not "user to user" encryption, but merely mail server to mail server (or when used as the outbound SMTP server for your location, mail client to mail server encryption). If you are interested in what exactly these commands do (which you should be - never trust random strangers on the internet), or if you want to set up more advanced options like signed SSL certificates and special sources for entropy, consult the Postfix TLS documentation.

I did say I wouldn't talk about this, but I feel it's important so it will get a quick note. Please, always be cautious when dealing with security and encryption. Don't trust anyone who claims to be any sort of "expert" (including anything written in this article), and don't believe anything that claims absolute or unbreakable security. Question everyone and everything, and do your own reasearch. Read articles, particularly those which analyse weaknesses in products (love it or hate it, WikiPedia often has valid criticisms of encryption products in its articles).

More importantly, be sensible with your data. Don't use weak or predictable passwords, don't share your passwords with others, and if you create user accounts and passwords for other people, don't go emailing them or sending them via IM (if you must, please use encryption, which is often a "chicken or egg" problem in itself).

Copyright 2006-2009 StickFreaks