True Crypt for n00bs.

http://www.truecrypt.org/
The truecrypt install is straight foreword and similar to the install of most other applications. The first install screen will ask whether to install or extract, and the default which is install is fine. Again on the next page most likely the defaults are fine and then click install. It will ask if you want to see the release notes, click no. Then click finish. Now to open truecrypt. Double click on the true crypt icon on your desktop.


Click create volume. Now for this tutorial we will choose to create a file container then click next and then click create a standard true crypt volume.

Choose where to save your encrypted file volume. The default of AES and RIPEMD-160 are sufficient. You will need to remember what encryption scheme you used so either make a mental note or write it down. I like to make my truecrypt file 600 megs, so if I need to archive it or send it somewhere to be archived(like a lawyer), then it will fit on a cd.

Your password is important and you must remember it, it needs to be a strong password. Strong passwords are denoted by five characteristics. They need to have Upper Case and Lower Case letters and Symbols and numbers. Length is the other factor. Ie@Tpietw1ce@d4Y, is a strong password. You can use a key file if you want but it will complicate things if you want to use your encrypted file on another computer or if that keyfile is corrupted. As far as volume format the defaults are fine. Now to mount your file as a volume go to the main truecrypt screen.


Choose a drive letter like H: . Hit the select file button. Choose your file. Hit the mount button. You will be prompted for your password. Your file will be mounted as the h: drive and anything you put in it will be encrypted. Remember to dismount the drive with the dismount all button whenever you are not using it.

Facebook passwords?

When logging into facebook your login account name/email address is passed of in login_x, there are the three more variables. One of them is most likely the password. c_user appears to be your facebook user id number. h_user and xs are unknown. I believe one of them is an encrypted version of the password and I don't know about the other.

I made a fake account with these user credentials.
login:bsdpunk@gmail.com
Password:Mosssalad

These are the returns
login_x=bsdpunk%40gmail.com
c_user=1089782116
h_user=9856f1ae07ca
xs=d771ba051a12a4ad7c5f898d71a1482a

So if you want more info to deal with here is how you capture your own stuff. Open wireshark, and start sniffing. Login to facebook. Once you are done stop sniffing. Right click on your first http packet, probably coming from a 204.x.x.x click follow tcp stream. If you make a fake facebook account to do this, and you feel like sharing please send me the same variable information I have provided here. The c_user and h_user stay the same, the xs is different.


This post would have been more thorough but, work calls, and I just got my eeePC. Bleh. Maybe more tommorrow.


EDIT so I looked at the source and it looks like it's passing some

EDIT login stuff to ssl and there is a shit ton of Javascript

EDIT that I didn't go through, so in closing I would like to say

EDIT that I feel unqualified to talk about this subject.