Slashdot Mirror
Encrypting File System Options for Mac OS X?
fieldmouse asks: "I recently had a laptop running Mac OS X stolen. Despite the fact that I got it back, that incident has me looking for an encrypting file system for Mac OS X; preferably one that would create a psuedo drive that I could unlock once when I log on. Anybody have any suggestions?" About 2 years ago, Ask Slashdot did the Linux version of this question. Has this gap been filled in Apple's latest OS offering?
Create an encrypted disk image with Disk Copy, make it writable, and drop your sensitive data in it ;)
Menzoberranzan Networks
Hi,
Have you concidered making an Apple Disk Image (.img file), it can use some form of 40bit encryption..
Sig you!
My cock is still delicious
thank you
Credits: onby
1. Introduction
As everyone knows, Open Source software is the wave of the future. With the market share of GNU/Linux and *BSD increasing every day, interest in Open Source Software is at an all time high.
Developing software within the Open Source model benefits everyone. People can take your code, improve it and then release it back to the community. This cycle continues and leads to the creation of far more stable software than the 'Closed Source' shops can ever hope to create.
So you're itching to create that Doom 3 killer but don't know where to start? Read on!
2. First Steps
The most important thing that any Open Source project needs is a Sourceforge page. There are tens of thousands of successful Open Source projects on Sourceforge; the support you receive here will be invaluable.
OK, so you've registered your Sourceforge project and set the status to '0: Pre-Thinking About It', what's next?
3. Don't Waste Time!
Now you need to set up your SourceForge homepage. Keep it plain and simple - don't use too many HTML tags, just knock something up in VI. Website editors like FrontPage and DreamWeaver just create bloated eye-candy - you need to get your message to the masses!
4. Ask For Help
Since you probably can't program at all you'll need to try and find some people who think they can. If your project is a game you'll probably need an artist too. Ask for help on your new Sourceforge pages. Here is an example to get you started:
"Hi there! Welcom to my SorceForge page! I am planing to create a Fisrt Person Shooter game for Linux that is going to kick Doom 3's ass! I have loads of awesome ideas, like giant robotic spiders! I need some help thouh as I cant program or draw. If you can program or draw the tekstures please get in touch! K thx bye!"
Thousands of talented programmers and artists hang out at Sourceforge ready to devote their time to projects so you should get a team together in no time!
5. The A-Team
So now you have your team together you are ready to change your projects status to '1: Pre-Bickering'. You will need to discuss your ideas with your team mates and see what value they can add to the project. You could use an Instant Messaging program like MSN for this, but since you run Linux you'll have to stick to e-mail.
Don't forget that YOU are in charge! If your team doesn't like the idea of giant robotic spiders just delete them from the project and move on. Someone else can fill their place and this is the beauty of Open Source development. The code might end up a bit messy and the graphics inconsistant - but it's still 'Free as in Speech'!
6. Getting Down To It
Now that you've found a team of right thinking people you're ready to start development. Be prepared for some delays though. Programming is a craft and can take years to learn. Your programmer may be a bit rusty but will probably be writing "hello world" programs after school in no time.
Closed Source games like Doom 3 use the graphics card to do all the hard stuff anyhow, so your programmer will just have to get the NVidia 'API' and it will be plain sailing! Giant robot spiders, here we come!
7. The Outcome
So it's been a few years, you still have no files released or in CVS. Your programmer can't get enough time on the PC because his mother won't let him use it after 8pm. Your artist has run off with a Thai She-Male. Your project is still at '1: Pre-Bickering'...
Congratulations! You now have a successful Open Source project on Sourceforge! Pat yourself on the back, think up another idea and do it all again! See how simple it is?
- posted by poopbot: for all your crapflooding needs
B0WwPrT3dB Post #284
The application/system items on the drive don't need to be encrypted of course so just create a new disk image in disk copy, choosing the 128-bit AES encryption option. You will be prompted for a password to use. (Don't save it to the keychain, duh.) You will have to enter your password twice when you open the image.
Now be very careful with your documents/items and always save them to the encrypted disk image.
The other benefit is that keeping all your important things on that image allows for easy backups.
<?php while ($self != "asleep") { $sheep_count++; } ?>
Use Disk Copy (located in the Utilities folder) to ccreate an encrypted disk image and add that image to you "Login Items" in the Login Prefrence Pane.
If you don't have anything nice to say, shut up you stupid prick.
Not that I've tried this or even really given it much thought about it. But the command line "crypt" in your .login and .logout could always crypt and decrypt your home dir. Just a thought.
if there's a Linux solution, there's at least a relatively easy to create OS X solution, at least. (or does X fully support only HFS+ disks?)
Facts do not cease to exist because they are ignored. - Aldous Huxley
I made a 200mb disc image using Apple's (built in) Disk Copy app, and enabled the encryption options. I keep sensitive docs and client notes on it; whenever I need it, I open the disk image, type my passphrase and the disk pops up like any other removable media.
When I'm finished, I just eject it. How secure is this? I'm not sure what function Disk Copy uses for encryption, but it is enough that if my laptop were stolen, I'd worry about the computer, not the data.
Look at Crypt using Blowfish and all that jazz.
Running Solaris as an Admin I have crypt encrypt some docs upon .login and upon .logout for some documents. Never tried it for OSX but I don't see how it should be any different other then it's going to pop up a GUI asking for your passwd.
Following the UNIX and Perl mantra, there is always another way of doing something...
http://homepage.mac.com/hteric/FileSharing1.html Also has compression in utility. Uses built in SSL to create blowfish or triple des encrypted files. Not so elegant as the image, but more shareable.
"You never want a serious crisis to go to waste." - Rahm Emanuel
...allows encryption
Use Matt Blaze's CFS. It supports encrypted (3DES) volumes, with timeout support among others. It's NFS loopback mount, so it will work on pretty much any UNIX -- including MacOS X and *BSD. NetBSD has TCFS which is AFAIK more tightly integrated (at VFS level).
Get CFS here: http://www.crypto.com/software/
I ama homosexual. I boughtan Apple computer because of its well earned reputation for being "the" gay computer. Since I have become an Apple owner, I have been exposed to a whole new world of gay friends. It is really a pleasure to meet and compute with other homos such as myself. I plan on using my new Apple computer as a way to entice and recruit young schoolboys into the homosexual lifestyle; it would be so helpful if you could produce more software which would appeal to young boys. Thanks in advance.
with much gayness,
Father Randy "Pudge" O'Day, S.J.
Here's another vote for Disk Copy.app. Very simple and easy to use. If you need to encrypt only a few files, try Puzzle Palace.
Gabriel Ricard
i don't personally encrypt my drive, although after reading the other replies, I may tinker with that a bit.. what i've been doing with my powerbook g4 is using Open Firmware Password which prevents booting from anything except a single designated 10.x partition. If you try to boot from another partition, CD, or external drive, you're presented with a very plain password screen with no instructions. I then have the screen saver set to require my password to get back to the finder. it's not obviously quite as secure as encrypting an entire volume, but is fairly secure..
This doesn't encrypt your data - but does stop anyone booting from an external drive or CD, or booting into Single User mode.
So a thief would have to remove your laptop drive and try to mount it in another Mac to get anywhere near your data.
HTH!
Nick
Well, I like the DiskCopy solution under OS X, but my preference under 9 etc was PGPdisk. Of course who knows what is happening there (as has been discussed on /. recently). I do like it under 9 though.
http://csrc.nist.gov/encryption/aes/aesfact.html
;))
(or you could just mod up the previous guy
Including the all important "What is the Advanced Encryption Standard (AES)?"
---
Live Long & Prosper \\//_
CYA STUX =`B^) 'da Captain,
Jedi & Last *-fytr
Instead of screwing around trying to find stuff that's been out on Windows for ages?
Apple still don't have an encrypted file system? Pathetic.
use the PPC version of Windows 2000. You can just right-click (option-click for you one-button mousers :) to encrypt a file. Works on directories, too!
As others have mentioned, Disk Copy is definitely the way to go for creating a password-encrypted volume in Mac OS X. You can make the disk images as large as you want, they are functionally pretty much indistinguishable from normal volumes, and there's no reformatting involved.
I just wanted to add one point about storing your passwords that makes life even simpler. Try using Keychain Access to create a second keychain you call "secure" or something to that effect. Make this temporarily the default keychain so that when you create your disk images, you can store the passwords to this new keychain. Configure the keychain so that it will relock itself after a short period of time (say 15 minutes), then set the default back to your regular keychain.
That way, you need only enter the password once to have access to every encrypted disk image, and in my experience, by the time you're done and you unmount the volumes, everything will be locked again!
When we remove the Negro and Mestizo numbers from American crime statistics, what do we find? We find that America has the lowest crime rate in the industrialized world. It is the Negro and Mestizo which skews that crime stats. America has a Negro problem, not a crime problem. The only solution is the expulsion of the Negro and Mestizo from America. Either ship the Negro back to Africa or seek a real technological final solution for the Negro problem.
Nice to hear that fieldmouse's laptop was returned, but it begs the question: how did you get it back? Since you were successful in this, I'm interested in whatever actions you took beforehand/afterward which facilitated recovery. Or was it just dumb luck? Tips to help the rest of us prevent/deal with a theft?
For keeping your passwords safe from the average laptop thief, Disk Copy is probably fine. But for protecting your sensitive info from The Man, I'd be just a little wary of proprietary packages. Has anyone seen the source code for Disk Copy? Are you absolutely sure that there are no backdoors for law enforcement? Apple would stand up to the Feds in defense of their loyal customers, right?
Depending on the level of security you're after, I recommend open source software that's been audited by lots of paranoid geeks.
--
Design + Activism
I have been using encrypted disk images in Mac OS X for well over a year now and it works very well.
I was worried, at first, that disk images could become corrupted if something went wrong and make the entire contents unreadable. They are actually quite robust. You can even open a terminal and kill the process called hdid which will force unmount the image in the middle of a copy operation, and your data is still safe.
You can open an image from an AppleTalk server and use that to encrypt your network traffic. It works, I've checked it with a packet sniffer.
Part of the reason images are so good for backups is that they preserve the relative pointing of aliases. If you just do a finder drag-and-drop copy with a folder, any copied aliases from that folder will point to the item in the original and not the copy.
The encryption process can make use of both AltiVec (Velocity Engine) and multiple processors. With a G4, you hardly notice the processor time needed to perform the encryption/decryption.