Monday, June 3, 2002
Keep your private data private
Posted by Ed Hansberry in "ARTICLE" @ 04:00 AM
http://www.theregister.co.uk/content/54/25478.html
It amazes me that approximately 10% of people with PDA's would have confidential banking information on their device unprotected. I guess these are the same people who write their PIN number on their ATM card so they don't forget it.
Or the 25% of those who store passwords and PIN's on their PDA and don't bother password protecting that data. Even worse, of the 6% of people that have lost their PDA's with sensitive information on it, about 33% of those do the same thing when they get a new PDA - store sensitive data unprotected!
There is no question that you can keep confidential information on your Pocket PC, but you must take a few simple precautions to make sure that the data remains confidential and unreachable if your Pocket PC is lost or stolen. <!>
First, password protect your Pocket PC. Start|Settings|Password. For Pocket PC 2000 users (Usually Jornada 52x, 54x, Casio E-1xx, EM-50x and non-upgraded iPAQ's or @migo's) you only get once choice. A 4 digit PIN at every power on. HP has a custom security feature on Jornada 52x and 54x devices that allow it to come on after the device has been off for a preset time. 4 digits gives you 10,000 possible combinations which is plenty. Why? Because, according to this article, "should the password be entered incorrectly, the user is required to wait before trying again. The delay imposed between attempts rises exponentially, effectively locking the device after several attempts, but protecting the information within." So, as long as you don't use something obvious, like the last 4 digits of your phone number, your data is pretty safe, or the thief is going to have to be very patient. Pocket PC 2002 owners, or Pocket PC 2000 owners who install the Microsoft Password for Pocket PC Powertoy wanting even more security can use a password of any reasonable length using letters, numbers and symbols.
Second, the above only protects data in RAM. The logic in this is if someone just wants your device, they can do a hard reset to clear the password, but this also clears all data on the device. So never ever store any data on a storage card or in the Flash ROM, like the iPAQ File Store or HP Safe Store that isn't encrypted by some other means. The Pocket PC's password cannot protect these non-RAM storage areas.
Third, encrypt data that is really sensitive. I personally use Ilium Software's eWallet, but there are others like Developer One's CodeWallet Pro. Before you buy any of these, check your Pocket PC's companion CD. Many HP Jornada's come with CodeWallet and iPAQ's come with eWallet. I have my Pocket PC set to use the power-on password after one hour of being off. I find it too annoying to use the password every time I turn it on. Having that encrypted ensures that even if a thief gets my Pocket PC before the password has activated, they won't have access to sensitive data. With eWallet you can configure the eWallet file so that after X failed tries, it cannot be opened for X minutes. I like these types of programs because they are designed to arrange your data in a small database. These apps have several "cards" that have fields for the most common types of info you would want to store. Bank accounts, credit cards, system passwords, padlock combinations, etc. eWallet is so useful I can store non-sensitive data, such as air filter sizes or software registration keys in unencrypted folders in the database allowing quick access.
You can also encrypt any file on your system with programs like F-Secure's FileCrypto. These applications will encrypt Word documents, Excel files, email, entire folders or entire file systems. These types of applications are a must if you plan on storing large amounts of sensitive data on storage cards.
If you are interested in learning more about Pocket PC security and other applications available, Microsoft has more information here.
It amazes me that approximately 10% of people with PDA's would have confidential banking information on their device unprotected. I guess these are the same people who write their PIN number on their ATM card so they don't forget it.
Or the 25% of those who store passwords and PIN's on their PDA and don't bother password protecting that data. Even worse, of the 6% of people that have lost their PDA's with sensitive information on it, about 33% of those do the same thing when they get a new PDA - store sensitive data unprotected!There is no question that you can keep confidential information on your Pocket PC, but you must take a few simple precautions to make sure that the data remains confidential and unreachable if your Pocket PC is lost or stolen. <!>
First, password protect your Pocket PC. Start|Settings|Password. For Pocket PC 2000 users (Usually Jornada 52x, 54x, Casio E-1xx, EM-50x and non-upgraded iPAQ's or @migo's) you only get once choice. A 4 digit PIN at every power on. HP has a custom security feature on Jornada 52x and 54x devices that allow it to come on after the device has been off for a preset time. 4 digits gives you 10,000 possible combinations which is plenty. Why? Because, according to this article, "should the password be entered incorrectly, the user is required to wait before trying again. The delay imposed between attempts rises exponentially, effectively locking the device after several attempts, but protecting the information within." So, as long as you don't use something obvious, like the last 4 digits of your phone number, your data is pretty safe, or the thief is going to have to be very patient. Pocket PC 2002 owners, or Pocket PC 2000 owners who install the Microsoft Password for Pocket PC Powertoy wanting even more security can use a password of any reasonable length using letters, numbers and symbols.
Second, the above only protects data in RAM. The logic in this is if someone just wants your device, they can do a hard reset to clear the password, but this also clears all data on the device. So never ever store any data on a storage card or in the Flash ROM, like the iPAQ File Store or HP Safe Store that isn't encrypted by some other means. The Pocket PC's password cannot protect these non-RAM storage areas.
Third, encrypt data that is really sensitive. I personally use Ilium Software's eWallet, but there are others like Developer One's CodeWallet Pro. Before you buy any of these, check your Pocket PC's companion CD. Many HP Jornada's come with CodeWallet and iPAQ's come with eWallet. I have my Pocket PC set to use the power-on password after one hour of being off. I find it too annoying to use the password every time I turn it on. Having that encrypted ensures that even if a thief gets my Pocket PC before the password has activated, they won't have access to sensitive data. With eWallet you can configure the eWallet file so that after X failed tries, it cannot be opened for X minutes. I like these types of programs because they are designed to arrange your data in a small database. These apps have several "cards" that have fields for the most common types of info you would want to store. Bank accounts, credit cards, system passwords, padlock combinations, etc. eWallet is so useful I can store non-sensitive data, such as air filter sizes or software registration keys in unencrypted folders in the database allowing quick access.
You can also encrypt any file on your system with programs like F-Secure's FileCrypto. These applications will encrypt Word documents, Excel files, email, entire folders or entire file systems. These types of applications are a must if you plan on storing large amounts of sensitive data on storage cards.
If you are interested in learning more about Pocket PC security and other applications available, Microsoft has more information here.
