Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Would it be possible to ensure that documents used on a personal PC connected to the internet, could be used securely without the danger of an eavesdropper obtaining access to the file or the danger of files being created in the temp folder and being accessible to someone else who logs in later?

I've considered keeping the files in a Truecrypt container and using a virtual keyboard to enter the password. But if I access a Word file in the container, won't temporary files be created in the temp directory? Would using a sandbox help in this case?
What if I access the file from a Truecrypt container in Linux instead?

In short, what would be a good way to ensure that any confidential files will be secure even if the system is compromised?

share|improve this question
1  
if you find it an option, use SSH to connect to your computer at the company and VNC itself so you can work on it as if you were there. SSH connections are encrypted. –  Lorenzo Von Matterhorn Sep 26 '13 at 10:19
    
Ok, but I'm considering a situation where the file is on the home disk as a Truecrypt container or a password protected RAR. What would be a secure way of using the file in such a situation? Let's say VNC or VPN can't be used because of poor network connectivity (I really wouldn't want to bring in use of files across a network into this question, as that's not really the question I'm asking) –  Nav Sep 26 '13 at 10:29
    
added comments as answer. –  Lorenzo Von Matterhorn Sep 26 '13 at 10:56
3  
An eavesdropper where? Are you worried about someone listening in on your IP packets, someone gaining the ability to listen in on your keystrokes (and mouse movements), someone being able to look at temporary files, or what? A proper SSH tunnel or a proper VPN will protect against IP packet eavesdropping, but won't do anything against someone who manages to plant spyware on your client host, for example. "The system is compromised" is extremely broad; please specify the threat model you are trying to protect against. –  Michael Kjörling Sep 26 '13 at 11:12
    
@Michael: I'm talking of a situation where I cannot be sure of whether a person using a document at a PC at home is aware/ignorant that their system has been compromised by spyware/malware/rootkit or maybe (if possible) a person who can remotely access their filesystem without their knowledge (maybe while they're not at their system). I'm considering any threat model, except packet sniffing. And yes, since you asked, I'm considering the possibility of someone having physical access to the system (being able to view temp files) –  Nav Sep 26 '13 at 13:02

2 Answers 2

up vote 1 down vote accepted

Use an encrypted home folder/Truecrypt and keep your files there. Using compression inside TrueCrypt has slight to none impact on security, so yes, the extra password and protection layer would be of no harm.

Do not forget data is still accessible when on RAM (in process of being encrypted or decrypted). still, Linux has a kernel feature that only allows a small portion (1MB) of RAM to be read for security reasons... so yes, I believe you will be safe.

If you find it an option (which you said not to be in comments) , use SSH to connect to your computer at the company and VNC 127.0.0.1 (your company pc itself) so you can work on it as if you were there. SSH connections are encrypted.

will Truecrypt ensure that the data is not stored temporarily anywhere else other than in the RAM (Windows and Linux)

the answer is no, it won't ensure. programs that require to store stuff in /tmp will do so. so, unless your root partition (assuming you mount /tmp in same partition) is TrueCrypted it will be accessible without encryption.

regarding windows, same applies to your %temp% folder.

share|improve this answer
    
I wasn't actually talking of compression in Truecrypt. I was asking if I access a Word file or maybe source code in a Truecrypt volume using Netbeans on my system, isn't there a possibility that Netbeans or Word would store temporary files in the temp folder? Or does all information being decrypted by Truecrypt stay only in the RAM and nothing goes into any temporary folder? Will there be any security difference in temporary file creation of this type if I'm working on Windows or Linux? –  Nav Sep 26 '13 at 13:09
    
you did speak of RAR files while encrypting. information goes to RAM but returns to disk. but aamof dont worry about this in linux . –  Lorenzo Von Matterhorn Sep 26 '13 at 14:00
    
I had intended to mention either using Truecrypt or a password protected RAR. As of now, I'm considering Truecrypt as a better option than RAR. So the question still is, as per my above comment: will Truecrypt ensure that the data is not stored temporarily anywhere else other than in the RAM (Windows and Linux)? –  Nav Sep 26 '13 at 14:14
    
@Nav answer updated –  Lorenzo Von Matterhorn Sep 26 '13 at 14:41

Your question actually contains three questions:

1 Protecting local files

To protect your files from others using the same computer, create use a different user account than them and protect it with a password. Windows will by default deny them access to your user folders.

To protect your files from users with administrative privileges or physical access to the disk you also need to encrypt them. The most simple way would be the Encrypting Filesystem options of NTFS (screencast tutorial).

2 Protecting network traffic

Encrypt your files and data before sending them over the wire. The easiest way would be a file archive program like 7-zip or WinRAR, because they support symmetric encryption with a password.

3 Protecting your computer from malicious programs

Even if you do 1 and 2 correctly, an attacker may still run a malicious program on your computer, which can circumvent the above security measures. Keep your software (operating system, browser, browser plug-ins, document reader) up to date and don't open programs or documents from unknown or shady sources. Use an anti-virus program.

share|improve this answer
    
For 1, isn't it possible to access those files from Linux if you access the filesystem when on a dual boot machine? For 2, I think it's possible to crack those passwords by brute force. For 3, not all antiviruses can find all malicious programs. Need a more generic solution, but thanks :) –  Nav Sep 26 '13 at 13:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.