If you don't know what it is, why the eff are you defending it so vehemently?
Try cutting the length of your password in half and see what you get in Password Haystacks. Try cutting it down to seven characters.
How about: first an attacker hits you with a wrench to get the password to your Mt. Gox account, then she hits you again to get the password to your IronKey, then she takes all your Bitcoinage! Seems like it would work to me. BTW, do you memorize your 20-char random Mt. Gox password? Or do you use a password manager or write it down or something?
I just don't trust Mt. Gox's security and I'm not sure I'd personally want to become dependent on an expensive flash drive, especially when there are free tools that are just as (if not more) secure.
No, actually they aren't; I made an account the other day as a test with the word "feline" for a password (!). My guess is they will be hacked again. They haven't talked about having an audit done for additional SQL injection vulnerabilities, have they?
Quote
Truecrypt is susceptible to a memory dump attack.. whether container or drive, it doesn't matter.
So is the data on your IronKey once you start using it.
Quote
I think truecrypt is a decent solution, and I have had experience with it all the way back to its roots in the scramdisk... The biggest killer for me is the inability to use it on a computer that is properly secured without specific preinstallation of truecrypt by a system administrator.
Yeah, well, if you're really security conscious, you 1) shouldn't use Windows and 2) shouldn't use any machine you don't have admin rights to.
But I agree that is a nice feature the IronKey has over TrueCrypt.
Quote
The wrench attack is far fetched.. and the likelihood of its occurrence is low.. Its much more likely that small devices like this could be misplaced.
Yes, it is, for now, but as crypto-money gets more popular and widely used and understood, the $5 wrench attack becomes more likely. I predict we'll see it happen.
Quote
I greatly simplified my password example to "123.Bitcoin.456" and assuming it was attacked at the rate of 100,000,000,000,000 guesses per second, it would still take nearly 1.5 million centuries to perform an exhaustive search, a secure password does not preclude the ability to be memorized.
[/qoute]
Okay, so you have reduced it to 15 characters. That's a good length for a password (for now). Congratulations, you're safe from brute-force keyspace searching. (Again, most people don't bother to make a password that long so this doesn't have anything to do with Mt. Gox's secruity.) However, that particular password is actually relatively weak because it's very susceptible to a dictionary attack. I'd guess it'd probably take more like 1.5 hours than 1.5 million centuries to crack.
[/qoute]
Okay, so you have reduced it to 15 characters. That's a good length for a password (for now). Congratulations, you're safe from brute-force keyspace searching. (Again, most people don't bother to make a password that long so this doesn't have anything to do with Mt. Gox's secruity.) However, that particular password is actually relatively weak because it's very susceptible to a dictionary attack. I'd guess it'd probably take more like 1.5 hours than 1.5 million centuries to crack.
Thats kind of the point, 123.Bitcoin.456, is NOT vulnerable to a dictionary attack... since its padded.. I'll concede that 1.5 million centuries was to perform an exhaustive search of the whole character space that password occupies, but since the password begins with the "1" character, you could divide 1.5 million centuries by the 95 which represents the number of character alphabet you would need to search, and you are down to (approximately) 150,000 Centuries... but that still assumes you would be brute forcing the password at 100trillion guesses per second. 100 trillion guesses per second would require a distributed attack of 10x the size of the total computational power of the bitcoin network as it stands today. 1.5 hours. well.. come on. do you believe that? You do understand that to perform a "Dictionary Attack" that the exact string "123.Bitcoin.456" would have to pre-exist in the dictionary you are using to brute force with, substrings are useless... I'm not sure Moore's Law still even applies in todays world, but if it does, it would still take 500 years for technology to be 150,000 times more powerful than it is today.. and that still would take that massive password cracking array a whole century... The user of that password would be DEAD before it is cracked.
As far as the comments on having the data unencrypted in memory once any storage device is unlocked.. yes, of course, there is absolutely no way to avoid something that is software from being present in your computers memory.. thats the risk no matter what. I was referring to the encryption keys that secure the data itself inside of the truecrypt container. Whats really cool about the Ironkey, is the fact that the encryption keys are located in hardware, and the application that accepts the password, communicates directly to that chip.. the password you enter, the encryption keys, etc. Never enter the system ram, can never be copied into the hibernation file, or page/swap files of the computer you are using. A lost ironkey can't even have its data copied in the encrypted form from the drive... its safe. The comment that truecrypt is just as secure, if not more secure is just wrong. I hope you see that. Its very secure, but just as secure... or more secure isn't correct.
Of course Windows isn't secure, lol.. especially when it has been used by people who are not security aware.. and sometimes not even secure when used by those kind of people... Windows is a toy. Doesn't mean I don't use it... but I also have specific computers for specific purposes. A couple linux systems and a couple of macs... I tend not to discriminate...
I 100% agree with your comments of the safest computers are those you administer.. but the fact remains that there will be times it is nice to just hop on a computer and send some bitcoins and do some trades... as safely as possible... The safest way would be the Live BootCD techniques mentioned by other posts.. Another smart thing would be to not put all of your eggs in one basket, especially with bitcoins.
Hey... I hope you aren't taking any of this personal.. I just enjoy having these kind of technology / security discussions, as I'm sure you do too..
