Encrypted USB Key With TOR, Firefox

An anonymous reader writes "Gizmodo has a writeup on the new IronKey — a self-destructing, hardware-encrypted and -authenticated USB flash drive with on-board secure Firefox, high-speed TOR network, password manager, and online encrypted backup. Here is the demo page. $79 for a 1GB, $149 for 4GB." Ironkey works on XP and Vista only. Let's hope its self-destruct feature works better than Secustick's.

Comments

Re:Useless because of host security

[BlueParrot]

If you do trust the host, there is little point in hardware encryption/authentication.

It is still a good idea to have hardware that supports it. In particular, USB flash drives have a tendancy to store logical changes to data in new physical locations. They do this in order to minimise the number of writes to any one portion of the drive, and thus extend the lifetime of the flash memory. Normally this is a good thing, but for encryption purposes it is a pain since it makes it difficult to change / revoke a key without overwriting the entire drive. Of course, if you suspect a key has been compromised it is just good practise to do so anyway ( or better yet, destroy the drive).

Re:Useless because of host security

[rdl]

I agree. The best security is to have your own trusted CPU/display/input (i.e. a laptop or pda). This is getting easier all the time -- a PDA or cellphone is close to sufficient for most non-data-entry tasks.

Failing that, I'd go with something which uses commodity, standard, and commonly available technology at the lowest level possible. It's PROBABLY the case that a DVI monitor is not bugged; much less likely that a random DVI monitor at a net cafe is itself secure than that the host OS is secure.

The host OS and applications installed are by far the weakest link. I carry a laptop everywhere, but the next step down from that is a bootable USB flash drive with your choice of secured OS installation on it. It's easy enough to implement disk encryption.

It is also fairly straightforward to use "write only" public key cryptography (i.e. each time you save your work, encrypt it with a public key, the private key for which is held on trusted hardware at home).

The only customization I'd do to the USB dongle would be for protecting the keying data -- some way to mount a / partition, but have a data partition which is encrypted with PKC held on the USB device, with only the passphrase being entered into the local PC, rather than an actual key entered via the host PC. This in practice only gives you marginally better security, as if you used a hardware-trojaned PC (or vmware installation...) to boot your USB device, that trojaned machine could just copy the relevant data out of your USB key.

There are a lot of "procedural" ways to improve security with this USB boot thing. Maybe have multiple partitions, each with different keys, per project or security level. If you're at a machine belonging to client A, and need access to client A files, you can stick your USB in a client A machine, boot, and then only unlock the client A partition on the USB. Or if you just need basic secure computing, but not access to your stored files, you could just unlock the OS partitions, leaving your own data partitions encrypted. Or, just buy multiple USB keys, and stick the least important key into the machine that is needed to accomplish your task.

Bootable Debian on USB key with root encryption?

[alexandre]

http://feraga.com/node/94 - why not use this instead on any key...

This is old news..

[hacker]

I did a talk for my local LUG back in September of 2006 describing exactly how to do this using TrueCrypt for Linux and Windows

I described in detail how to install, boot and use the USB key as a bootable Linux distribution, and also how to use the USB key in Windows (or Linux) with TrueCrypt, using some fancy tricks to auto-prompt for the password upon insertion of the key, how to use a slew of PortableApps on the key, and even a launchable menu to find and access them.

This was almost a full year ago. IronKey, whatever it is, is nothing new.

I use Fearless Browser

[DisorderlyConstruct]

Instead of this, you can get Fearless Browser for free and install it on any USB drive. It is far more secure than any Windows version because it runs in a Gentoo-based virtual machine. It comes preconfigured with Tor and OpenDNS anti-phishing, and is updated frequently. I carry it around everywhere I go and use it at friend's houses and public terminals that I don't trust.

IronKey FAQ and Crypto White Paper

[IronKey Dave]

Thanks to everyone for your really interesting comments and questions. We will update our website to make it more clear that we have a FAQ section that answers many of the questions posed here on SlashDot. https://learn.ironkey.com/faqs We also have a whitepaper that describes how our hardware encryption works, the threat models, and how it is better than software encryption. https://learn.ironkey.com/docs/IronKey_Whitepaper- Benefits_of_Hardware_Encryption.pdf We released Windows versions first, as the majority of the market is using that OS. We are working on Linux and MacOS versions. Thanks, Dave Jevans @ IronKey

Re:Useless because of host security

[IronKey Dave]

Z, Unfortunately you're not correct. The flash drive firmware would have to be able to parse the FAT file system in order for this to work. USB storage media does not receive data as files, but rather as blocks, at a much lower level than the windows file system. Also, your approach basically sends your password in the clear over USB. We AES encrypt our USB traffic, protecting your password from USB level sniffers. We have IronKey working on MacOS now, and are working on Linux. Please be aware that we are more than a secure flash drive. We've got hardware encrypted password storage, strong 2-factor authentication (the firefox has a PKCS11 driver that talks to our onboard crypto). Dave @ IronKey