A HDD password experience which might be of value

Message

ATJ · #1 Post by **ATJ** » Sun Mar 30, 2008 4:25 pm

G'day.

I use a power-on and HDD password for my Thinkpads and have done since my very first Thinkpad, a 760CD in 1996. I have used the exact same password for all this time. The password has a number in it. Because I have used it for some time, I can type it without thinking.

Last year, just before I went off on a diving trip, I put a 40GB HDD in the ultrabay of my T43 to use for backing up photographs that I would be taking. I decided to put a HDD password on the drive as we'd be staying in a house with no security. I went into the BIOS setup and added the password, typing my same old password. I did it pretty quickly as I was in a hurry. When I rebooted, I typed in the power-on password which unlocked the Thinkpad and HDD1, but it didn't unlock HDD2. No matter what I did, I couldn't unlock HDD2. It was only an old 40GB drive so I didn't worry too much and I just left it in a draw and took another drive and didn't password protect it.

Fast forward to last week. I have a 120GB drive to which I had added the same password. This worked fine but I wanted to remove the password. I went into the BIOS setup and went to remove the password. I had to type the current password in. The problem was, I couldn't type the number in. It would just beep and I wouldn't get a "square" in the password field for that character. I powered off the ThinkPad and powered it on again and back into the BIOS setup. This time I was able to type the full password and remove it from the HDD.

Yesterday morning I was thinking about that experience and thought, "What if I had the number problem when adding the password to the 40GB HDD last year?". Well, sure enough, if I typed the password without the number it worked. I have now removed the password from that drive.

What is weird, though, is that this was actually 2 different T43 Thinkpad. The one from last year is my work T43 and the one that wouldn't let me remove the password from the 120GB drive is my home one. It appears this might be a common occurrence with the T43 (maybe other models) and might explain why some people set a password that doesn't work.

mgo · #2 Post by **mgo** » Sun Mar 30, 2008 4:37 pm

ATJ wrote:What is weird, though, is that this was actually 2 different T43 Thinkpad. The one from last year is my work T43 and the one that wouldn't let me remove the password from the 120GB drive is my home one. It appears this might be a common occurrence with the T43 (maybe other models) and might explain why some people set a password that doesn't work.

That's a little strange, but if you're getting into your system now, I guess you're fine. I use HDD passwords and they are always a mix of numbers and letters. There has never been a problem with that sort of mix.

For a while I used a power on password as well as a HDD password, but my security needs are modest, so I dropped the power on password idea. For one thing, if I forget the power on password my ThinkPad becomes an "instant doorstop" but with a HDD password I can just plug in another drive.

ATJ · #3 Post by **ATJ** » Sun Mar 30, 2008 4:43 pm

Just to clarify, the problem of the number not working only happened in BIOS Setup. It has never, ever happened on power up on any Thinkpad I have used in the last 12 years. In the BIOS setup, I have only had it happen twice (that I can remember) but it did happen on 2 different machines.

mgo wrote:For one thing, if I forget the power on password my ThinkPad becomes an "instant doorstop" but with a HDD password I can just plug in another drive.

The power-on password can be easily removed by an IBM/Lenovo technician. A HDD password can't.

sojourner · #4 Post by **sojourner** » Mon Mar 31, 2008 7:40 am

I've tried using a HDD password ONE time and the experience was not good. That was a while ago so I don't remember all the details. Essentially though, what I wanted to do is this:

(2) T41's (BIOS setup identical except for S/N's)
(2) HDD's (cloned to be identical except for boot sectors)

wanted to swap either HDD into either notebook and have HDD security via PW

Got into trouble somewhere when I tried doing this (PW would not take, could not access drive), don't remember how or why but it felt real good when SOMEHOW I was able to eliminate the password routine and have everything work interchangably again.

Is there any reason why setting up two notebooks and two HDD's all with the same PW's, so all are interchangable, will *not* work? Should I be able to make a setup like this work?

fredstev · #5 Post by **fredstev** » Mon Mar 31, 2008 9:23 am

I've had a couple of bad experiences with bios passwords also. I have always used a password with both numbers and letters. First time I managed to shoot myself in the foot was with a REALLY old gateway. Problem seemed to be related to the numlock key and the way the bios saw ascii character input. I was sweating blood when I figured that one out.

Second experience was with a T40. I figured that one out pretty quick, I had managed to hit the spacebar with my thumb after entering a password. I'm pretty leery of bios and HD passwords now, and tend to use a usb stick with Roboform portable on it.

Fred

Robbyrobot · #6 Post by **Robbyrobot** » Mon Mar 31, 2008 1:27 pm

fredstev wrote:I'm pretty leery of bios and HD passwords now, and tend to use a usb stick with Roboform portable on it.

To this day I don't understand why anyone would risk passwording a laptop. Power on passwords are worthless as protection, since they're too easy to remove. Same for SVPs. What's supposed to be accomplished? As for HDD passwords, they will certainly protect your data, but God help you if you ever forget one. Except for the HDD passwords, I see no real advantage and a lot of possible disadvantages to such passwords, and have never used any myself.

ATJ · #7 Post by **ATJ** » Mon Mar 31, 2008 4:20 pm

sojourner wrote:Is there any reason why setting up two notebooks and two HDD's all with the same PW's, so all are interchangable, will *not* work? Should I be able to make a setup like this work?

Works for me. As above, I have 2 T43 Thinkpads which have the same passwords and I can use the drives in either machine.

#8 Post by **carbon_unit** » Mon Mar 31, 2008 6:42 pm

Robbyrobot wrote:
fredstev wrote:I'm pretty leery of bios and HD passwords now, and tend to use a usb stick with Roboform portable on it.
To this day I don't understand why anyone would risk passwording a laptop. Power on passwords are worthless as protection, since they're too easy to remove. Same for SVPs. What's supposed to be accomplished? As for HDD passwords, they will certainly protect your data, but God help you if you ever forget one. Except for the HDD passwords, I see no real advantage and a lot of possible disadvantages to such passwords, and have never used any myself.

Wait until someone "pranks" a supervisor or hard drive password on your Thinkpad and then can't remember it. Then you will see the beauty of knowing your password. It has happened before and it will happen again.

Robbyrobot · #9 Post by **Robbyrobot** » Tue Apr 01, 2008 3:36 am

carbon_unit wrote:Wait until someone "pranks" a supervisor or hard drive password on your Thinkpad and then can't remember it. Then you will see the beauty of knowing your password. It has happened before and it will happen again.

Remember I wrote that SVPs are also easy to remove? As for someone setting a HDD password as a "joke"... I think that might be considered "extenuating circumstances" for assault and battery

#10 Post by **carbon_unit** » Tue Apr 01, 2008 5:23 am

Robbyrobot wrote: Remember I wrote that SVPs are also easy to remove?

May be for you but not for everyone and that subject is not to be discussed on this forum.

Robbyrobot wrote: As for someone setting a HDD password as a "joke"... I think that might be considered "extenuating circumstances" for assault and battery

I agree with you on that but prevention is better than retaliation.

sojourner · #11 Post by **sojourner** » Tue Apr 01, 2008 7:53 am

Question on HDD passwords:

Does setting this PW simply make the drive not bootable or does it scramble all data so nothing on the drive is understandable, even if installed as a slave on another machine?

#12 Post by **carbon_unit** » Tue Apr 01, 2008 8:25 am

It is not scrambled, just inaccessible. You can't access the drive until you supply the password.
If you are going to use the hard drive in a different machine, remove the password first.

Robbyrobot · #13 Post by **Robbyrobot** » Tue Apr 01, 2008 8:26 am

sojourner wrote:Does setting this PW simply make the drive not bootable or does it scramble all data so nothing on the drive is understandable, even if installed as a slave on another machine?

The drive can't be accessed without the password, regardless of what computer it's installed in. Forget the password and you can throw the drive away - or pay a great deal of money for a professional service to access the data if they are very valuable indeed. Setting a HDD password doesn't merely scramble the contents - there are programs that will do this - it mkes the drive totally useless.

davidspalding · #14 Post by **davidspalding** » Tue Apr 01, 2008 9:46 am

I've said it before, I'll say it again. Keep critical passwords written down in a locked firebox. Safe deposit box if available. DO NOT just presume you "know" it. I learned this in the intelligence biz where you have a gazillion passwords and lock combos to keep track of, and one very secure, fireproof safe.

... I've used a Power-on Password from day one on my T43 ... I found that with the Fingerprint Software (IF you have the reader), you can use a fingerprint for the power-on password. This also logs you into the user session if the same fingerprint is for that userid. (Doesn't work if you type in your power-on password, which I have to do every month or so.) So instead of booting up and then having to type a password, I type my master password on power-on, then walk away. 3 minutes later, the system is up, logged, and ready to use. It's relatively secure, and also convenient for a single-user system (e.g. laptop).

Okay, some may complain that it doesn't "secure" your system, but anyone who's worked with trusted systems will tell you (not in so many words), "the only secure system is a machine turned-off, unplugged, wrapped in a sealed plastic bag, with a signed evidence sticker on the bag closure." The idea of these measures is to be a deterrent to unauthorized access. Just as you can boot into Linux as root without a password, there are ways around things with Windows, but that doesn't invalidate the preventative measures' value.

ATJ · #15 Post by **ATJ** » Tue Apr 01, 2008 3:17 pm

carbon_unit wrote:If you are going to use the hard drive in a different machine, remove the password first.

Not necessarily true. The password goes with the HDD not the machine. You can certainly use a password protected HDD in multiple Thinkpads. I do it all the time. It may be possible to use it in other brands but I don't have any experience with other brands.

ATJ · #16 Post by **ATJ** » Tue Apr 01, 2008 3:19 pm

davidspalding wrote:Okay, some may complain that it doesn't "secure" your system, but anyone who's worked with trusted systems will tell you (not in so many words), "the only secure system is a machine turned-off, unplugged, wrapped in a sealed plastic bag, with a signed evidence sticker on the bag closure." The idea of these measures is to be a deterrent to unauthorized access. Just as you can boot into Linux as root without a password, there are ways around things with Windows, but that doesn't invalidate the preventative measures' value.

Hear, hear!

I wonder how many of the people complaining also lock their houses when they go out or there cars when they walk away from them, even though it is fairly easy for someone to break in if they are serious about it.

#17 Post by **carbon_unit** » Tue Apr 01, 2008 6:26 pm

ATJ wrote: Not necessarily true. The password goes with the HDD not the machine. You can certainly use a password protected HDD in multiple Thinkpads. I do it all the time. It may be possible to use it in other brands but I don't have any experience with other brands.

You are correct, but for the majority of the people in this forum they will avoid many headaches by removing the password before they put the drive in a different machine.

o1001010 · #18 Post by **o1001010** » Tue Apr 01, 2008 11:20 pm

as i have posted my reasoning in terms of security.

power on password can be easily removed by cutting battery off and remove the bios battery.

hard drive password xxxxxxxxxxxxxxxxxxxxxxxxxxx

supervisor password xxxxxxxxxxxxxxxxxxxxxxxxxx

there is no security that is safe, it is just more of an annoyince and time it take for the data to be available. right now to be the best thing is aes (rinjindale) in 256 bit with a passphrase 32 characters or longer. PASSPHRASE is the key.

edited by carbon_unit

#19 Post by **carbon_unit** » Wed Apr 02, 2008 6:10 am

o1001010 wrote:as i have posted my reasoning in terms of security.

power on password can be easily removed by cutting battery off and remove the bios battery.

hard drive password xxxxxxxxxxxxxxxxxxxxxxxxxxx

supervisor password xxxxxxxxxxxxxxxxxxxxxxxxxx

there is no security that is safe, it is just more of an annoyince and time it take for the data to be available. right now to be the best thing is aes (rinjindale) in 256 bit with a passphrase 32 characters or longer. PASSPHRASE is the key.

Didn't you read my above post?

carbon_unit wrote:
Robbyrobot wrote: Remember I wrote that SVPs are also easy to remove?
May be for you but not for everyone and that subject is not to be discussed on this forum.

Do not discuss methods to bypass HD and Supervisor passwords.

sojourner · #20 Post by **sojourner** » Wed Apr 02, 2008 6:49 am

Regarding HDD P/W's:

If HDD 0 (zero) is setup with a P/W, removed and installed in a USB enclosure, another drive installed as drive 0 (zero), will the TP prompt for the USB enclosure P/W at boot?

davidspalding · #21 Post by **davidspalding** » Wed Apr 02, 2008 9:45 am

o1001010 wrote:as i have posted my reasoning in terms of security.

power on password [blah blah blah]
...

I'd prefer that this was deleted as well. I use Power-on password as a first line of defense to my data, and DO NOT appreciate posts which offer information to bypass it.

In Mod We Trust.

#22 Post by **carbon_unit** » Wed Apr 02, 2008 10:54 am

Sorry Dave, The Power On Password is fair game since it is explained in the Hardware Maintenance Manual how to remove it. IBM/Lenovo allows it and we do too.

#23 Post by **carbon_unit** » Wed Apr 02, 2008 10:56 am

sojourner wrote:Regarding HDD P/W's:

If HDD 0 (zero) is setup with a P/W, removed and installed in a USB enclosure, another drive installed as drive 0 (zero), will the TP prompt for the USB enclosure P/W at boot?

I think it has to be mounted either internally or in the ultrabay for the password to work. Not USB.

Robbyrobot · #24 Post by **Robbyrobot** » Sat Apr 05, 2008 2:19 am

carbon_unit wrote:
ATJ wrote: Not necessarily true. The password goes with the HDD not the machine. You can certainly use a password protected HDD in multiple Thinkpads. I do it all the time. It may be possible to use it in other brands but I don't have any experience with other brands.
You are correct, but for the majority of the people in this forum they will avoid many headaches by removing the password before they put the drive in a different machine.

One further thing to consider is that in some earlier Thinkpads, putting in a passworded HDD will automatically set the SVP to the same password. This is no longer the case in the newer Thinkpads (at least I've read that), but it's something to consider.

Robbyrobot · #25 Post by **Robbyrobot** » Sat Apr 05, 2008 2:31 am

davidspalding wrote:I'd prefer that this was deleted as well. I use Power-on password as a first line of defense to my data, and DO NOT appreciate posts which offer information to bypass it.

Then you'd btter talk to IBM/Lemovo, since removal of POPs is described in the HMMs that are available to anyone with Internet access - and that fact is explicitly not included in the prohibition of password discussions in the forum.

I personally think the paranoia on this subject can be taken too far.

davidspalding · #26 Post by **davidspalding** » Sat Apr 05, 2008 9:13 am

Let's get back to the topic, and stop jousting with users over security concerns. Offline discussion has already concluded satisfactorily. If you can't convince someone of your POV, applying labels to them isn't any more effective.

o1001010 · #27 Post by **o1001010** » Sat Apr 05, 2008 4:03 pm

a little comment.
i think that the current rules about the bios and hd password is a little oximoron. when there is a weakness instead of discussing it openly like any open commnunity i do not understand why it is prohibited. if there is something wrong people should know about it and learn how to address it instead of being an ostrich and hide its head in the sand and pretend it is safe.

ps, the solution can be easily found with google.

sincerely,
o1001010

ATJ · #28 Post by **ATJ** » Sat Apr 05, 2008 4:33 pm

davidspalding wrote:Let's get back to the topic...

Well, yes...

I'm kind of sorry for posting what I thought my be useful information for anyone that might have set a HDD password and have it not work from them form the get go. It might have been the BIOS setup not accepting numbers at the time you set the password.

davidspalding · #29 Post by **davidspalding** » Sun Apr 06, 2008 10:13 am

Your post was helpful and informative, nothing to be sorry about.

XCoalMiner · #30 Post by **XCoalMiner** » Sat Apr 12, 2008 12:44 am

carbon_unit wrote:
sojourner wrote:Regarding HDD P/W's:

If HDD 0 (zero) is setup with a P/W, removed and installed in a USB enclosure, another drive installed as drive 0 (zero), will the TP prompt for the USB enclosure P/W at boot?
I think it has to be mounted either internally or in the ultrabay for the password to work. Not USB.

I'd like to ask a slight variation of this question: If HDD 0 (zero) is setup with a P/W, then is removed and installed in a USB enclosure, and the machine is booted up with a different HDD... will the USB Driver prompt for P/W when the P/W protected HDD is plugged into a booted and running system?

I've never seen an option in external USB HDDs to set the password (not even in Control Panel > Computer Management > Storage > Disk Management, which is where you can format and partition a USB HDD). Can a HD with a password even be used in a USB enclosure?

A HDD password experience which might be of value

A HDD password experience which might be of value

Re: A HDD password experience which might be of value

one convenient reason to use a power-on password

Re: one convenient reason to use a power-on password

Who is online