Location-Based Encryption

davidwr writes "Eweek reports Apple co-founder Steve Wozniak has a new way to prevent theft of company secrets on stolen laptops: 'Wozniak offered a peek into his vision for the company on Ziff Davis Media's Security Virtual Tradeshow, where he introduced "wOz Location-Based Encryption," an application that uses GPS tracking within a wireless hub to encrypt and decrypt sensitive data for large businesses.' Today's encryption is good enough but I do like the tracking capability. Imagine your laptop screaming 'I'm being stolen! I'm being stolen!' and paging security as the janitor walks out the door with it."

Does not work for cars too well

[mi]

Automobiles had various "I'm being stolen" devices for years. From overt obnoxious sirens, that wake up the neighborhoods in the middle of the night to covert "Lo-Jack" and others. Does not help as much as was, I bet, expected.

Or does it?

This could be applied to other things as well

[uid100]

Some though would have to be applied to this, but a GPS system in your car that alerts you if some operational parameters are crossed would be nice.

"Hey, I'm being towed away from the parking garage, even though my keys are more than 100 yards from me"

In other news...

[al_fruitbat]

...thieves put stolen laptops in bags lined with aluminium foil. (can also be used for hats)

Re:Not totally secure?

[jmcmunn]

Better yet, my portable GPS device allows me to "set my location" temporarily in case the signal is not strong enough. This allows the device to at least estimate where I am if it has a weak signal somehow. I don't really get all the details...but it works so I don't complain.

So what's to stop someone from doing essentially the same thing with the laptop? Just tell it "you're still in the building" and you'd be all good. I think this is a pretty cheesy idea for security, you can always figure out a way to lie to a machine, regardless of what lie you're telling. This is less secure than a well-encrypted password if you ask me, or course I assume that the machine would still have the password as added security, so I guess that argument shouldn't carry any weight.

Re:w0z is a nutjob at best...

[erikharrison]

Wozniac is a nutjob no doubt about it. He'd still be a legend, though, even if it weren't for Apple. He was an early phreaker, and a good friend of John Draper - Cap'n Crunch for gods sake! He was an important figure in the Silicon Valley hobbyist community, and even if he hadn't done either Apple or phreaking he'd still be a footnote in the big book of commodity PCs because of that. Certainly more than you or I can claim.

He and Jobs didn't start their relationship selling computers together - they originally sold blue boxes. Woz still works for Apple, mostly as a consultant, and he and Jobs still collaborate (though Woz has claimed that on many occasions Jobs credits him with ideas that he had minimal participation in).

Since leaving Apple he's been as much a humanitarian with his skills and money as Bill Gates (though in smaller absolute amounts). He personally provides free tech support for the local school system, and (at least when System 8 was still cutting edge) held computer classes for preschool and elementary school kids. He's sponsered charity concerts, and more.

Problem with Wozniak is he has a great technical mind, a wonderful sense of playfulness, and even a good sense of what users want in products, but his business sense is poor. That's why there hasn't been as much output from Woz since leaving Apple - their hasn't been a Steve Jobs. Wozniak was the Paul Allen to Job's Bill Gates, and much like Allen, Wozniak has dabbled here and their, with no truly successful financial venture yet. That doesn't mean he's worthless

good against wardriving

[spectrokid]

Imagine that your WEP gets encrypted with a key dependent on your location. A large company could enable campus-wide WIFI, but you would only be able to get on the network if you are inside one of the buildings. Not the ultimate protection, but one extra barrier.

Re:Not totally secure?

[Psiolent]

I work for a company that makes it so you CAN hear it. It doesn't use GPS, but instead proprietary wireless receivers placed throughout a facility. If a marked asset (such as a laptop) leaves a predefined area, it initiates an alarm. Our software does, in fact, scream "I'm being stolen", or whatever you want, via text-to-speech over the facility's walkie-talkies.

We don't do location based encryption, like Woz, but we will scream at you if your laptop is being stolen.

See our asset theft detection here. [ciscor.com]

Re:Why must it always be "the janitor"??

[Inda]

In my place the high paid engineers do all the stealing of laptops. The rest of us don't have access to them...

They take them home to do work in the evenings. They dial into the network for free internet. Their kids download Britney. Their begged CD burner is constantly burning audio CDs - they have to beg because there is no real reason for laptops having burners...

...they find out that they are unable to install latest_spyware_infested_program. They wipe the hard drive, install their own software (disabling dial-in in the process) and the laptop never sees the office again. They know they'll have a lot of explaining to do if the laptop ever needs rebuilding.

They see it as one of the perks of the job.

Better idea - wireless hardware key-pair

[Se7enLC]

I have a better idea - you build a pair of hardware keys that operate like rfid ID tags, sort of (except that the key would be battery powered and generate different keys based on what it was given for a timestamp - like a secureID card for a vpn).

You'd hang one of these little devices off your belt or on your keys or something. When the laptop is within a few feet of you, you can access the encrypted data. When it's not, you can't. Seems simple enough....now we just have to make sure that nobody gets smart and tapes the device to the laptop (or packs it in their laptop bag).

Stop!

[buss_error]

'I'm being stolen! I'm being stolen!' and paging security as the janitor walks out the door with it."

I've been in offices for many many years. There has been only one time the Janitor Did It, and it was a case of they put it somewhere we wern't expecting.

Can we stop with the steriotype? All of the janitors I have known have been honest, hardworking people that are just trying to make a living. While I a sure there are dishonest janitors around, I sure that like anywhere else the vast majority are not crooks.

Re:Alarms

[Anonymous Coward]

This system has been in use for years in Belgium which is notoriously known for its high "car-jacking" rate.

When I've got the system installed on my car, the guy told me that they did not install a microphone in the trunk. I asked him why he would do that. He explained that car-jacker are now taking the owner with them and usually put them in the trunk and mine was too small. With the microphone, you can basically call the police and explain them not to shoot in the car.

After having been car-jacked anyway, I moved to Switzerland!

Re:Stop!

[rthille]

I don't know that the use of the janitor is meant as an inditement of janitors and their honesty, but rather of society. The reason that janitors are used is because they have opportunity (because they have to to clean) and and due to the inequity in society they can be said to have motive. After all, when you're working around equipment that costs as much as you make in a year, there's more temptation to steal it than if you work around stuff that costs what you make in a day. It's the same reason why people who drive expensive cars don't feel comfortable parking their car in a poor neighborhood.
But you're right, statistically, it's the employee making $80k who thinks he should be making $120k, rather than the janitor making $10k