Ready, Aye, Ready

Link: http://www.wired.com/news/columns/0,72458-0.html?tw=wn_columns_securitymatters_1

Another excellent column from Bruce Schneier on security, this time on passwords and the cracking mechanisms used to break them. I read through it feeling a little smug as none of the choice flaws he mentioned are ones I do.

Then he hit me with this:

Even so, none of this might actually matter. AccessData sells another program, Forensic Toolkit, that, among other things, scans a hard drive for every printable character string. It looks in documents, in the Registry, in e-mail, in swap files, in deleted space on the hard drive ... everywhere. And it creates a dictionary from that, and feeds it into PRTK.

And PRTK breaks more than 50 percent of passwords from this dictionary alone.

What's happening is that the Windows operating system's memory management leaves data all over the place in the normal course of operations. You'll type your password into a program, and it gets stored in memory somewhere. Windows swaps the page out to disk, and it becomes the tail end of some file. It gets moved to some far out portion of your hard drive, and there it'll sit forever.

I don't know how you defeat that if someone ever gets physical access to your equipment and the time to read it. Perhaps the only choice is to make sure that your computer is filled with so many possible text strings that it becomes impossible to blow through them all within an acceptable timeframe or figure out how to make sure to regularly rewrite any area that a swapfile has used once its cleared out. Either way, it does make a mockery of the Blowfish (or Twofish) encrypted program you use to store the password collection.

The good news is that the malefactors do need access to the computer, and to do the required low level scan they need a lot of time with it. Just don't leave that laptop in the taxi or coffeeshop, eh?