ShadowSurfer - being offered for free

Hi Hollywoodpc

Sorry, missed that whilst posting - and yes it does help - Thanks

Cheers

Jon

 

I just installed and hope I have no problems with this. Anyone know how long it will be for free?

 

I only been using ShadowSurfer little over a week courtesy their free offer and it does great in my opinion. I don't always use it but it starts up each boot with no issue so i leave it rest in the tray untill called on, then a restart is needed to enter ShadowMode and when finished reboot again and it drops any changes.

Pretty slick stuff coming out these days.

 

I fully agree with the privacy problem.
Between two reboots any threat can do its evil job and send personal data from your computer to an unknown person with malicious intentions, when you are in ShadowMode.

But what if your complete harddisk is WELL encrypted. There are encryption softwares, like TrueCrypt to make that possible.
The malware will still send your personal data, but the receiver won't be able to read it and that makes the data USELESS.

I even think that encrypting your harddisk should be a standard security recommendation, no matter what your security setup is.
AV/AS/AT/AK-scanners and their realtime protection, don't detect and remove every malware and therefore don't protect your privacy either.

Of course there are brilliant people in the world that are probably able to break a very difficult encryption, but only 2% of the world population has a brilliant mind.
So the receiver of your encrypted personal data has to be "EVIL and BRILLIANT and KNOWLEDGEABLE" and that combination will be very rare in the world.

I think the combination ShadowSurfer/ShadowUser and TrueCrypt for instance isn't so bad, unless some members have other arguments against this, but they better be good.

 

I use the ShadowSurfer and TrueCrypt combo and have no problems whatsoever.

So long as I remember the password, of which I remember...

 

Those, who lost their encryption password, weren't really prepared and sloppy. These people lose even serial numbers of their softwares.
I would at least print that password on PAPER and put it in my installation file.
Paper has at least no technical failures like storage media and although very old-fashioned, paper is still the safest way to store data.

That is a matter of opinion of course and I see alot of (contradictional) opinions at Wilders and I'm certainly not alone with that security setup according my readings.

My security setup isn't finished yet, I just need to find the right softwares to complete ShadowUser and softwares, based on blacklists, will be of course my very last choice.

Upto now I have :
1. Hardware Router
2. Software Firewall
3. ShadowUser
4. Encryption

I'm not saying you are wrong Peter, but Wilders would be boring if all members used the very same security setup.

 

ErikAlbert,

You can't be doing what you say you are doing with what you say you are doing it with.

1. Truecrypt is not "whole drive encryption"....It is only partition and container encryption. It cannot encrypt your entire C: drive with OS. Drivecrypt Plus Pack, WinMagic's SecureDoc, among others can do that - but that's not what TrueCrypt was designed to do. TrueCrypt cannot help with a compromised system with ShadowSurfer the way you say. The malware will still send your personal data, but the receiver won't be able to read it and that makes the data USELESS Again, that's wrong and your entire c: drive cannot be encrypted with TrueCrypt. With a TrueCrypt partition/container open, any stolen data would be sent in the clear and unencrypted.

2. I even think that encrypting your harddisk should be a standard security recommendation, no matter what your security setup is. Maybe you should explain this. If your entire hard drive is encrypted, what are you doing it with? You aren't doing it with TrueCrypt.

3. Of course there are brilliant people in the world that are probably able to break a very difficult encryption, but only 2% of the world population has a brilliant mind.
So the receiver of your encrypted personal data has to be "EVIL and BRILLIANT and KNOWLEDGEABLE" and that combination will be very rare in the world. Wrong again. With strong encryption, implemented properly and with a secure key, it cannot be broken by anyone that is known to the security community. There is not a mind "brilliant" enough to break strong encryption; the problem isn't lack of brilliance, it is simple computer processing power and time.

Could you explain your posts regarding how you believe TrueCrypt to be protecting your entire hard drive while using ShadowSurfer? I don't believe you have an understanding of TrueCrypt, whole drive vs OTF disk/device encryption and I am interested in hearing how you are doing what you claim to be doing.

 

Congrats Securityx!

I was waiting to see who would be the first to spot the nonsense that Erikalbert was posting ......

SecurityX , you don't post much here, so it's no surprise you are fooled. Erikalbert has an exceedingly bad habit of pretending that he is using setups he hasn't used before in his life , and worse he will argue like crazy for them, even though he has no idea if it works, except based on his vague and usually poor understanding of how the product works.

Typically he likes to talk about being a Shadowuser user, as far as i can tell he has being talking and defending that setup for at least a year without having tried it once yet. After the last round of discussions, where he realised his 'perfect setup' was not perfect due to keyloggers installed in session, i guess someone mentioned True crypt, and he got it into his head that true crypt is the answer.

I don't know if he has ever used truecrypt but i'm not surprised if he has never even used truecrypt before in my life....

Sometimes he will mention that it is just a proposed setup, but more often, he gets so carried away that he forgets to mention , he is talking stuff on paper. You are not the first to be fooled into thinking he is actually using the stuff he advises everyone to use and argues so strongly for!

Exactly!

In Erikalbert's defense, there is a way to use truecrypt to help supplement Shadowuser.

Basically, the idea is to encrypt sensitive documents in a seperate container.
In theory Shadowuser allows you to revert back to a known safe baseline. The user has to be careful not to open the encrypted container while doing 'unsafe activities' . But whenever he wants to access important files he has to first revert back to the safe baseline first.This defeats any temporary keyloggers that exist during the session.

Erik albert is hoping that Truecrypt can allow him to skip this step because it requires quite a bit of user discipline. That is why he harps on full disk encryption.

Full disk encryption is a tricky business, everything is encrypted even the OS!
Combine it with another complicated system like Shadowuser which tampers with the file system, and I'm not at all confident that they might both work together.

Certainly, I wouldn't dare to say they can, without having tried them out in the real world.

There are other complications that occur to me. e,g shadowuser offers to "commit certain changes only" how the heck would that work with full disk encryption? Heck even with basic disk volume encryption the idea may be unworkable.

Well in erikalbert's defense (lol) he is probably thinking of some super cyptoanalysist from NSA who knows how to break AES magnitudes faster than bruteforcing.

Erik is convinced that the 'bad guys' are smarter than the 'good guys' so he thinks this is a possibility .

 

The coupon code on their own page is no longer being accepted. It's pretty much bad hat for a company not to honor their own adverts. I'm not impressed.

 

Did you email them and ask? 9 out of 10 they will honor it and also take the ad off the page.

 

Hello,
Without quoting too many people...

About encryption and ShadowSurfer/User

Encryption of data can only be done passively. Encrypted data cannot be processed. You need to decrypt the data to a format that OS understands to use it. Therefore, encryption per se is a very difficult and dangerous procedure. Active encryption (eg. Tor) takes its toll on the speed of the process, because every call invokes decryption of data for the function to be executed and an encyption of the data back to its storage state following successful function execution.

Encrypting personal data is one thing; encryption system files is another. This is far more difficult to achieve than just encrypting packets and sending them via a long route of proxies. The packets you receive are static and unchangeable, whereas the system changes thousands of times every moment, with values being read and written to registry, memory etc.

Erik, if you want to protect your data from being read then what you suggest is ok. However, it will still be stolen regardless of the content and its readability if you allow relevant malware to reside in your os, whether in the shadow mode or not.

The most advisable course of action would be to prevent the theft of data in the first place. ShadowUser is a good way to prevent permanent changes to the system. TrueCrypt is a good way of making sure your static data (files, folders, pictures) are safe from being examined by an unwanted person. But you need other protection to make sure your data remains inaccessible from outside.

I use AxCrypt sometimes. Encrypted data is first processed back to its format, then opened by relevant programs. While you type in your password or while you browse the data (let's say CV in .doc format) using a word processor, you're vulnerable.

In another post, someone asked about using zip to save disk space. I advised him against archiving data. The same goes with encryption. If you encrypt your data, you have a power failure in your home, it's enough that one single bit of data in the large encrypted volume becomes corrupted, you lose everything. Unlike HDD damages, encryption errors are virtually irrepairable.

Achieving simplicity and great security is hard to get easily. But it can be done.

Mrk

 

My little question to all of this is why on earth does normal regular desktop users need to have some National Security Standard type security like full disc encryption? Lord knows if i had anything DIGITAL that was seriously important to protect or store it certainly wouldn't be on some source like this that has internet connection or depends on electricity for stability. LoL

 

Well i didn't know and maybe i shouldn't have asked?

I have used a really good delete program named ERASER by hedi for a long time. I might be wrong but i always believed that by erasing files with a deleter after so many are collected in the recycle bin, that instead of getting the usual one letter filename removed that is supposedly to be the way Windows handles them i think, that the erasing method also does something to the clusters? Anyway my thinking is that it improves making space on the disk.
This is definitely an area i not studied well at all so any clarifications or other comments are definitely welcome.

Thanks

There is actually been some discussion on this matter and the program ERASER Right Here as this seems to be going off-topic.

 

Three post have been removed from this thread from in between EASTER.2010's two posts above. While it might have been intended as a joke ... it was in poor taste and in violation of the TOS. Let's please refrain from any such comments in the further.

Thanks Kindly;

Steve

 

Sorry...

 

NP ... we'll just move on.