More Information :

This page provides interesting extra detail not presented on the main page. However, you may find this information useful if you have a strange use case, need more complete information, have trouble initially, or just want to learn more about the topic. The information includes:

• descriptions of alternate technologies
• extracts from and full man pages (where appropriate)
• links to papers on the topic

Jump here for the topics covered in this set of pages.

TOPICS:

Each topic listed below has extra relevant information not found on the main page. It should assist you if something goes awry while following the directions on the main page. If it does not, it should still make an interesting read.

• passwords
• ssh
• secure FTP
• secure e-mail retrieval
• encrypted e-mail (PGP)
• webmail
• tips for Windows
• tips for Linux
• web browsing
• secure file sharing (NFS, SMB/CIFS/Samba) [coming soon]

More Information on Passwords

Basic passwords are the essential basis of most security systems and software today. There are other stronger forms of authentication, and some alternative ways to store your many passwords so you do not forget them. Much research has shown how dangerous so-called 'weak' passwords are, and the remarkable number of weak passwords still chosen.

• Stronger Authentication

  The authentication process is all about identifying a subject so you can trust them with certain privilages. So, alternate forms of authentication seek to identify a subject without using a traditional password. So-called "smart cards" extend the basic authentication process by adding something you have (the card) to who you are (username) and something you know (password). Other authentication methods involve biometric identification - fingerprints, voiceprints, face recognition. Bruce Schneier points out that biometric authentication schemes have a subtle flaw (besides including some amount of uncertainty) - if compromised, the authentication cannot be changed. This means that if someone stole your thumbprint (or thumb) thumbprint identification would no longer work for you, because it could not uniquely identify you. Finally, some encrypted challenge-response protocols attempt to authenticate both the client and server to each other (rather than the usual case of client to server).

• Alternative Ways to Store Passwords (attempt at compromise)

  Users are often told to never write down their password, but to make it as convoluted as possible. It is next to impossible to immediately remember a good password. And usually, users become used to typing the password as a combination of keystrokes rather than any concious thought pattern to reproduce the password. Since good passwords are not easily remembered, it (contrary to popular advice) may be easy enough to write down your password and stick it in your wallet. You should definitly never stick it under the keyboard or on your monitor. The advantage of having it in your wallet is easily realized because wallets are seldom left unattended.

  A digital scheme similar to this "wallet-storage" method is to encrypt all your account names, passwords, and authentication tokens in some single database on your handheld device that can be examined with a single username and password pair. This is similar to the single sign on mechanism described below. Critics of this approach say that all your authentication mechanisms are then reduced to that single password. It's a tradeoff. Good luck choosing... (see http://www.zetetic.net/products.html for more information on such a system).

• Single Sign On

  Since both research and practical experience indicate that having ordinary users remember many different account names and passwords interferes with their productivity, many organizations have gone through a major effort to implement single sign-on technology, whereby one system-wide username and password grant the user access to all the systems the user needs to access. Some application servers (e.g., Tomcat) also implement an optional single-sign on mechanism.

• Research on Passwords

  Passwords are unequivocally the most pervasive authentication mechanism in use. The subject of password choosing and guessing has been the focus of a number of research projects. Most notably, in 1979, Morris and Thompson found that about 86% of the passwords they surveyed could be guessed in a week's worth of computer time. More recently, Klein (1990) found that 21% could be guessed in a week. Spafford (1992) found that the average length of a password was 6.8 characters and about 30% were all lowercase. These results indicate that passwords, as currently used, provide a very false sense of security. All an attacker needs is one account.

  The New Security Paradigms Workshop last year included several papers and studies that focused on current password trends and proposed new mechanisms for passwords. The website is here and you can find the papers in the conference journal at the ACM digital library (linked from this page).

SSH

NAME
     ssh - OpenSSH SSH client (remote login program)

SYNOPSIS
     ssh [-l login_name] hostname | user@hostname [command]

     ssh [-afgknqstvxACNPTX1246] [-b bind_address] [-c cipher_spec]
         [-e escape_char] [-i identity_file] [-l login_name] [-m mac_spec]
         [-o option] [-p port] [-F configfile] [-L port:host:hostport] [-R
         port:host:hostport] [-D port] hostname | user@hostname [command]

DESCRIPTION
     ssh (SSH client) is a program for logging into a remote machine and for
     executing commands on a remote machine.  It is intended to replace rlogin
     and rsh, and provide secure encrypted communications between two
     untrusted hosts over an insecure network.  X11 connections and arbitrary
     TCP/IP ports can also be forwarded over the secure channel.

     ssh connects and logs into the specified hostname.  The user must prove
     his/her identity to the remote machine using one of several methods
     depending on the protocol version used... <snip/>

SFTP

NAME
     sftp - Secure file transfer program

SYNOPSIS
     sftp [-vC1] [-b batchfile] [-o ssh_option] [-s subsystem | sftp_server]
          [-B buffer_size] [-F ssh_config] [-P sftp_server path]
          [-R num_requests] [-S program] host
     sftp [[user@]host[:file [file]]]
     sftp [[user@]host[:dir[/]]]

DESCRIPTION
     sftp is an interactive file transfer program, similar to ftp(1), which
     performs all operations over an encrypted ssh(1) transport.  It may also
     use many features of ssh, such as public key authentication and compres-
     sion.  sftp connects and logs into the specified host, then enters an
     interactive command mode... <snip/>

E-mail Port Forwarding

PGP

Webmail

Windows

Linux

Secure Web Browsing

You have to assess the risks to your privacy and balance them against your needs to enjoy the web, use it for work, use it for family, or use it for research.