I have put together a portable apps USB stick for when I need to use random site computers, I also threw truecrypt on with an encrypted volume for some word documents.

The password I am using is much weaker than what is recommended (just a 4 digit number). The way I was thinking about it is this is still at least as secure as the windows xp laptop I cart around anyway, which has the same documents on it. My aim was to make it at least a little wrong for someone to access the documents, sort of like a padlock to keep out the honest criminals.

Is my logic flawed here?

  • 3
    The simple fact that you have a password makes your usb stick orders or magnitude more secure than not having a password at all.
    – WalterJ89
    Feb 27, 2012 at 4:07
  • Hi @daniel, welcome to Information Security! It seems like you're implying that your laptop also has a 4 digit password? If that's not the case, why do you assume that that would be as secure as the laptop? And if it is - really?
    – AviD
    Feb 27, 2012 at 21:03
  • I was more thinking along the lines of my laptop being completely not secure. I does have a domain login password, but really running XP with no full drive encryption doesn't fill me with confidence. If someone had the need they could easily steal the laptop any documents on it, with some time (windows exploits, hardware mods). But doing so would be wrong or illegal. Picking up a USB and having a look at whats lying around doesn't seem to me as wrong.
    – daniel
    Feb 27, 2012 at 21:45
  • 2
    If I found a random USB stick, I may look at it just to find out who lost it; if it was encrypted I would probably not bother testing further. However, for the unencrypted case, I'd be pretty paranoid about potential malware on the usb stick; so would only check from a non-production linux machine as a non-root user (and still not run any scripts/executables/document macros).
    – dr jimbob
    Feb 27, 2012 at 22:37

5 Answers 5


This states truecrypt uses a hash-function like SHA-1 and keystrengthen it by a factor of ~2000 times. So if your attacker knew it was a four digit number; it would take your attacker under 10000 tries to crack, which means they would need about 2000×10000=20 million sha1 hashes. A GPU can generate sha1 hashes at about a billion per second; so your solution would not survive the most basic password cracking attempt.

If security of your data is a requirement, I'd recommend that instead of a four-digit number (13 bits of entropy: 213.3 ≅ 10000); using a four-word (or longer) random diceware passphrase (~52 bits: 252 ≅ (65)4 ≅ 4×1015). Instead of surviving for ~1/50th of a second, your passphrase would survive for about ~200 years of a dedicated GPU attack. This is in the realm of breakable in months by very large organizations that are very interested in getting your data (think NSA with a server farm of thousands of GPUs dedicated to cracking your encryption), but protected against all lesser brute-force threats (and adding a couple more words to the passphrase would protect against very large organizations). (EDIT: There are other methods that could be used; e.g., covert keyloggers to steal your passphrase).

As the preface to Applied Cryptography puts it:

There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files.

Your current solution prevents against the "kid sister" attacks of the world, but would not be much more difficult to upgrade to the "major government" kind if desired.

  • I think this answers the technical side of the question. I wasn't sure of the math on just how much easier it would be to brute force a short password compared to a longer one or a key file. I also like the last line as it describes what my sort of ethical question was better than my attempt.
    – daniel
    Feb 27, 2012 at 22:06
  • Ultimately the question "do you need strong security" boils down to would you care if the data was compromised (e.g., passwords to online bank accounts, servers, credit card numbers, information that could be used for identity theft, evidence of illegal/unethical activity etc). In other cases, I use little to no security. E.g., my usb drives have only non-confidential documents (harmless photos from family stuff, legally obtained ebooks/music/non-confidential source code), so I don't bother with encrypting it.
    – dr jimbob
    Feb 27, 2012 at 22:33

Formally, yes. You have identified a level of residual risk you are prepared to accept, based on a threat analysis, and have implemented controls to manage the risk down to this level.

Informally, as others have pointed out, if a control can be made very much stronger with very little cost, then you should do it anyway. Risk analysis and threat modelling are not very precise sciences.

Something like Courage8366gapor is not hugely more difficult to remember or type compared to a 4 digit PIN code, but the PIN takes under a second to brute force and the passphrase would take somewhere between 2 days and ten times the age of the Earth.


One argument against this is that you should not get into the habit (whether or not the risk tradeoff is acceptable) of choosing weak passwords. Since you're security-aware enough to use Truecrypt, it seems the marginal cost of using a decent passphrase would be just about zero.


In general, I think that having little security is worst than having no security at all.

Because when you have no security, you know that you have no security, and wouldn't trust it to store important things. When you have little security, you might ending up having to draw the line between important stuff vs. not-so-important-stuff vs. just-keep-curious-away. And if you fail to determine the exact point of that, you can "leak" information that you wouldn't want, really.

So, if you want to go secure, make sure you go secure, and choose a good password.

  • I disagree: weak security is often better in practice than none; you just have to not trust weak security with anything of value. As an analogy, any thief with proper tools can easily get into my locked car, but I lock the car doors to restrict any passerby from easily doing it as well. More importantly, in the first place I'll keep nothing worth stealing in my car like a phone/laptop/ipod (esp in plain-sight). Back to IT, sometimes I'll wrap a simple shared password on say an intranet-only internal resource (network printer) that contains nothing of value, but I don't want everyone to use.
    – dr jimbob
    Feb 28, 2012 at 16:46
  • 1
    @drjimbob : I agree with you, if you know about security. For any person that who knows about security and how to deal with it, the more security you have, the better, and 0,5 is more than 0. I just got tired of finding people using a login password in the Windows and thinking that the computer was secure, just to show them that with a linux boot cd I could copy any file I wanted. User's fault? Maybe, but no message warns that it just provides a very weak protection. And, as I said, in general we deal with users, and users... are users. Feb 28, 2012 at 18:12

My aim was to make it at least a little wrong for someone to access the documents, sort of like a padlock to keep out the honest criminals.

Firstly honest criminals are quite a rare breed and on the balance of probabilities you are more likely than not to meet the other more common variant, the dishonest variety.

Secondly it is much easier to lose a USB stick than a laptop due to its size and portability by either accidentally leaving it in a cyber cafe computer or just straight having it stolen from you.

So on the balance of probabilities again there is a high chance of your USB stick ending up in the hands of someone who is not an honest criminal than say a laptop so the security level must be higher.

As a general rule though you need to use a strong password on both your laptop and USB stick as good security is not based on whether or not your computer has been stolen yet, if its portable and you move it around, then it is more at risk than a stationary desktop computer.

  • Non technology savvy thiefs are probably not that uncommon. Feb 27, 2012 at 19:09
  • I think I butchered that old saying, locks keep out only the honest. If I found a USB key I might have a look at the contents, but if it came to trying to brute force an encrypted file I'd probably just wipe it. That is if i couldn't return the key to it's owner (Does anyone else put a .txt with their email address on USB keys? I know about the risk of attacks from people leaving infected USB sticks outside of interesting workplaces, but people still must get curious)
    – daniel
    Feb 27, 2012 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .