2

In my college computer that runs Windows 7 Professional SP1 I have an administrator account. I have full access to the entire computer and the files of every other account that's signed up.

The problem is: I'm not the only administrator, and they have the same access level as I do. Every time after I'm done using the computer I have to clear my browser history, sign off of every application I was using and place my files in a password protected compacted file. All this process is really inconvenient and bothersome. I've been looking after a solution to this issue for a while now, and already considered:

  • Creating a VM, using full-disk encryption. This obviously works but I'd like to avoid this.

  • Creating an encrypted volume with something like Veracrypt, the problem is that I could only install portable applications there (I think).

  • Encrypt my user folder. This would be a great solution that is available on Linux through eCryptfs, but I don't know if it's possible in Windows.

All the solutions I found online do not consider a shared computer and multiple system admins.

I hope one of you has an answer to this.

  • 1
    Are you sure that there is no key logger installed? – kelalaka Mar 26 at 19:17
  • @kelalaka no keylogger – alwaysNever Mar 26 at 19:31
4

No it's not!

The closest you can come is your own bootable drive and reboot the computer to run from your drive. In that case it's not a public computer, it's just yours with their hardware.

Even an encrypted VM would not work, as the running decrypted VM image is fully accessible from the underlying host system, albeit with some work.

You can protect individual files and directories via encryption, but that protection is for "dead files". When opened, the keys and accesses are in running memory.

Bottom line is, if you are running someone else's operating system controls, they have access.

  • There is still an issue with the hardware. The keyboard may transmit your keystrokes. And, This is not limited to the keyboard. – kelalaka Mar 26 at 19:16
  • Well isn't Windows awesome... I currently don't have acess to an external hard drive so RIP me I guess. Do you think my second considered solution (Creating a encrypted volume with something like Veracrypt) is good enough? Keep in mind I'm just trying to keep the other admins out and not the NSA lol – alwaysNever Mar 26 at 19:25
  • Why not just boot off of a live linux USB stick, and keep all files in the cloud? There's many options for this: techradar.com/news/best-linux-distro-privacy-security – Steve Sether Mar 26 at 21:46
  • @SteveSether Compromised hardware, option ROMs, EC (in laptops), or BIOS/UEFI can all negate the benefits of booting from a live USB stick. – forest Apr 30 at 5:56
  • @forest This is a college computer, and the threat is more college students or administrators. It seems unlikely those threats are real in this case. You're also vulnerable to being hit with a large wrench by Tony Soprano. – Steve Sether Apr 30 at 16:15
1

This is not possible! There are a number of technical reasons for why (user10216038 covers this quite comprehensively), but I think the strongest reason here is the simplest and least technical. Because it is a shared machine, you’ll never be able to eliminate the possibility of tampering in some form or other.

Sure, you can use file system protections. But will you know the other admins haven’t utilized some cool 0day to undermine that? Do you know the hardware itself hasn’t been touched? Do you scan for spyware and keystroke loggers and rootkits and Trojans every time you use your machine?

With other people having access to this computer, your level of certainty about its state and security is low. Never assume a shared computer is clean.

-1

Friend, I use a 16 GB USB with the latest bootable Kali Linux in my pocket so I don't even think about to clear the data created by the browsers I've used and things like that. Just Plug and boot. As simple as that.

-4

It is very easy and possible. All you need is software that resets the hard drive when you reboot and there is plenty of it available commercially. https://www.faronics.com/products/deep-freeze

Contrary to the answer below, this software works and is used in colleges for the exact purpose you describe. You can select certain files that won't be erased during a reboot so you can save work.

  • I don't think he has permission to install something like that. Sounded like he was only allowed to install portable applications. – Daisetsu Mar 26 at 18:46
  • [I can install stuff] This isn't what I was specifically looking after, which is being able to just leave my stuff there without the worries of having people mess with it, like a private computer, BUT this helps me do what I was currently doing (deleting and logging off of everything after each use) in an easier and faster way, so thanks for your input! – alwaysNever Mar 26 at 19:12
  • It allows you to stop people from messing with stuff in conjunction with encrypting like you said in your comment in the other answer. – user202894 Mar 26 at 20:06
  • Resetting the hard drive isn't a "fix all" solution to things like man in the middle attacks or hardware keyloggers etc. – Kevin Voorn Mar 27 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.