Protecting data on a laptop with linux

Question

I'd like to keep some private data (photos, notes, ...) and my browsing data hidden. The rest is not so important. Most of the time I just put the laptop to sleep and don't shut it down often, making disk encyption a lot less usefull. The laptop is typically used at home where it is relatively safe and only sometimes taken into public places, therefore I don't want to bother with auto screen locking all the time.

The laptop could get stolen and my private stuff published. Or my "friends" could have a laugh at my photos when I go away for 5 minutes and forget to lock the screen.

My ideas so far:

• encrypting a separate partition or folder with private data that are not accessed very often and don't need to be decrypted on startup. I would always be asked for a password (and again every few minutes).
• an applet that would switch between home and outdoor mode. Auto screen locking would be active during outdoor mode. Maybe it could recognize that it isn't at the usual place (connected to a different wifi network than most of the time, not on AC power, and similar).

Are there some other things I should be aware of? Which scenarios are the most probable? How to protect firefox browsing data? How vulnerable is a locked screen? Any tips on how to implement all this?

Those files are not extremely sensitive and the protection should be aimed only at a regular thief or a friend pulling a prank. However, most of my friends are programmers, CS students and sometimes IT security students. With a bad sense of humor. I'm currently using a fresh install of Fedora 15.

Answer 1

Truecrypt, gpg or pgp would seem to do the job for you.

Encrypted files, folders or separate filesystems - piece of cake. You can configure how long you want them to cache your passphrase before requiring it again.

I would however recommend screen locking every time - it does a lot of good, and in your particular scenario it would definitely help you minimise the threat from your friends.

Answer 2

If you rarely need the sensative data, the answer is obvious: an external drive that you leave at home. This way when you take your laptop away from home you are leaving the sensative data where you believe you have relativly good physical security. As long as the disk is strictly external an not a NAS (network attached storage) device the data exposure when you take your laptop with you is only subject to physical theft. This approach requires no additional security for your laptop.

On the other hand if you need regular access to the files it depends on the total size. For a collection of files less than 16 GB I suggest a encrypted USB flash drive. The size constraint is based on the cost of the USB flash drive. Any commodity USB flash drive of sufficient size will do. You can use free tools like Truecrypt GPG or PGP to make the drive encrypted. You will need a second USB flash drive of the same size to act as a backup. This solution allows you to take the data with you but allows you to separate the data from the laptop at any time.

If you need regular access to your sensative files but the total size exceeds 16 GB (or your cost threshold for two USB flash drives), then I recomment a encrypted partition of your internal laptop hard drive. You could go with an external hard drive, but you would need to buy one that could stand up to the riggors to transport and those are expensive. To me it makes no sense to have a portable hard drive that might fail if it gets bumped too often.

Are there some other things I should be aware of?

Yes, if your friends are computer savy and fond of playing pranks they could do odd things to your configuration files. One possibility would be remapping your keyboard so when you press a key the output is not the character printed on the key. If you are not protecting your system you should at least be able to detect if it has been modified. To do this you need to make a hash database of your configuration files. There are several free tools to do this: AIDE, Tripwire (free version), SAMHAIN, etc. Note however that you will need to keep a database copy offline, as if someone has access to your computer they may modify the integrity database. To combat configuration changes it would be useful to have a live CD/DVD/USB flash drive to be able to boot from and a configuration backup file on the same media to allow you to quickly restore your system.

Backups, especially when you computer is at risk ob being modified are critical. Have scheduled backups to a networked device or an external drive. You can suplement scheduled backups with a confguration backup that is activated every time your computer is put to sleep.

Which scenarios are the most probable?

You know your own threat environment best. That is what people are most likely to damage the assets you have (laptop and data) and what types of things they may do to them. Laptop theft from home burglary rates vary in different parts of the world and from city to city, but your laptop is a very tempting target if your home is burglarized.

How to protect firefox browsing data?

There are several information stores in firefox browsing history, cookies, passwords, form history, and cache. Most ot those have pretty good settings under the Preferences control panel. If you rarely or never use any of the features then turn them off. If you use Firefox to remember passwords use a master password to protect them. You can have Firefox clear your browsing history and form history every time you close it.

How vulnerable is a locked screen?

It is usually as good as the password you use to lock it. However if your friends are sophisticated and you have rhost, rcp, rsh, ssh, ftp, or some other remote access protocol running on your system, they may be able to access your system using WiFi or Ethernet. Disable your ethernet port when you are not using it (i.e. before leaving home). And disable your WiFi if you are going to be away for a while.