Before following this guide a complete ad-ware and virus scan should be completed to verify the system you plan on using is free from viruses and other malicious software. AVG virus scan is free for personal use and is available directly from AVG here: http://free.grisoft.com/
Ad Aware & Spy-bot search and destroy are both free for personal use and will identify any malicious software that may be running on your windows based computer.
Ad aware can be downloaded here: http://www.lavasoft.de/software/adaware/
Spy-bot Search and Destroy can be downloaded here: http://www.safer-networking.org/en/download/index.html
Instant messaging
Whether you’re using Gaim, aim, Yahoo IM, or MSN there are free encryption tools available that will make it (nearly) impossible for any third party to intercept and read your conversation.
Secway’s SIMP Lite for MSN, Yahoo, and AIM are free for personal use and work transparently with Gaim, Trillian, Yahoo IM, MSN IM, and AOL IM (AIM). Provided both parties are using simp your conversation will be encrypted end to end via AES. Simp is available for download here: http://www.secway.fr/us/products/. Note that SIMP is only available for windows.
For AIM only (5.2+) AimEncrypt.com offers a certificate and instructions on how to install the certificate. The nice thing about using the certificate is that no 3rd party software is required to have a fully encrypted conversation. For more information on AIM encrypt visit http://www.AimEncrypt.com.
GAIM-Encryption For GAIM: Gaim is a cross platform instant messaging client that works with a variety of different IM protocols and services, GAIM-Encryption is a 3rd party open source encryption plugin for GAIM that offers encryption over all gaim supported protocols. Gaim encrypt is available here: http://gaim-encryption.sourceforge.net/install.php
For OSX instant messaging Adium is a GAIM based IM client (open source/free) with built in encryption, note that both parties have to be using Adium for the conversation to be encrypted Adium uses OTR or off the record based encryption more on there here: (http://www.cypherpunks.ca/otr/) for more information or to download Adium visit http://www.adiumx.com/
Email
GPG: For non-commercial based email encryption GPG (GnuPG) an open source and free offshoot of PGP. GPG uses a public key infrastructure so that any one that has your public key can send you signed/encrypted messages. To send encrypted messages you must first generate a public/private key pair, then exchange public keys with another party, once you have another parties public key you can send them encrypted or signed messages. The message can only be decrypted by the corresponding private key. More instructions, information, and downloads on GPG can be found at http://www.gnupg.org/ or http://macgpg.sourceforge.net/ for mac users
File encryption.
TrueCrypt: Most operating systems offer some form of encryption, for windows there’s EFS, for OSX there’s File Vault, for Linux kernel loop encryption. The weakest standalone encryption is windows EFS because the keys/certificates are stored and recoverable from the local windows registry (Corporate Active directory users using a CA is completely different and we won’t get into that). Instead of using EFS a much better option is TrueCrypt available at http://www.truecrypt.org/. Truecrypt uses file container based virtual disks for encryption. This means that any file name/extension can be used. Also, encrypted data contained in the container files contains no obvious markers so a party performing an analysis of your system(s) is not likely to identify the container. Truecrypt also has the ability to nest container files for plausible deniability the first nest actually doesn’t use a file, instead free space is within the first container is used making it very difficult for a 3rd party to determin there is additional encrypted data being stored.
Voice encryption
Skype: For voice based encryption Skype is your best bet as it supports windows, MacOSX and Linux. All information is encrypted end to end using AES and RSA based encryption. While Skype is not open source it is free. More information about sky available here: http://www.skype.com/download/
Zphone: Phil Zimmermann (creator of PGP) has written Zphone which sits in between voip software and the internet acting as an encrypted transport mechanism of sorts. More information about zphone can be found at http://www.philzimmermann.com/EN/zfone/index-start.html
A word about security
It’s important to note that the best encryption can be easily thwarted by a key logger or other attack. Before relying on any of the above mentioned systems, be sure that your system(s) are completely locked down, virus and parasite free, block all inbound connections locally using a local firewall. Ditch Internet Explorer and use firefox or similar, Open source browsers are far less susceptible to attack and don’t rely on activex for component installations. Don’t use wireless networks without a VPN connection. Don’t use the same password for everything, password should be random characters at least 9 characters in length with numbers, letters, and special characters. (8 character passwords can be cracked in a few days with enough resources; a 9 character password can take years to break) For more info on password security see securitystats.com http://www.securitystats.com/tools/password.php
Comments (0)
Topsight.net
http://www.topsight.net/article.php/20060620121954847