nemo_outis wrote:
> Jane_G <janes_email@optusnet.com.au> wrote in
> news:cii4jiyaflyn.1teukog10u1f2.dlg@40tude.net:
>
>> What is a good filespec to hold an encrypted volume on WinXP?
>>
>> Based on extensive googling, I installed the TrueCrypt freeware disk
>> encryption to safeguard my private files on a rather public computer.
>>
>> TrueCrypt requires a file name to contain the rather large encrypted
>> volume file even if a hidden volume is used inside the regular
>> encrypted volume. For example, the file name containing the encrypted
>> volume could be C:\Documents and Settings\Administrator\My TrueCrypt
>> Encrypted Volume.bin
>>
>> To contain the TrueCrypt encrypted volume, I can choose any file name
>> and location that doesn't already exist. But, my question is what file
>> name and location would arouse the least suspicion were a coworker to
>> be snooping around looking for my personal data on my WinXP computer?
>>
>> Specifically what binary file could reasonable be expected to be a few
>> megabytes in size, yet have a normal sounding name in a normal
>> sounding location containing "gibberish" (ie encrypted data) that
>> would not arouse suspicions that it is actually a TrueCrypt encrypted
>> volume?
>>
>
>
>
> The following will not fool a sysadmin (well, not a good one) but it works
> very well against casual or inept snoops.
>
> Hide the Truecrypt file as an "alternate file stream" attached to some
> other file (which could itself be perfectly functional, such as an Excel
> file). The hidden stream will not show in any normal system operation
> (directory listings, etc.) although some (by no means all) antivirus
> software may report it.
>
> If the ordinary file you wish to use is, say, C:\directorypath\somefile.xls
> then create (and subsequently mount and use) the Truecrypt file as, say, C:
> \directorypath\somefile.xls:tc (i.e., the alternate file name - extent,
> really - is defined as prefixed by the regular file name and a colon)
>
> Regards,
>
>
>
So, your saying it is OK that your security is not based on a
mathematical proof or a conjecture of the computational bounds of an
adversary, but rather based on the hope that the adversary is incompetent.

Do you see anything wrong with that?