Hi,

Let's assume for a second I'm really paranoid. Now I'm thinking the best option to keeping everything private is to encrypt the whole hard drive. But let's just say that wasn't an option for now.. I'm looking to see what traces I leave behind and want to clean that up, to avoid prying eyes from stumbling across some personal information (think shared computer).

I'll list a few of the things I know about now, and have a few questions about them:

Command history - history -c - is it really secure, or am I better to track down the file and shred -zu it?

Clipboard contents - where do I access and delete?

Recent documents list - can I shred -zu it? Is it .recently-used? how can I refresh GNOME so the update takes effect immediately? then do a > .recently_used to create a new file?

Where is the recent applications list stored?

Where is the thumbnail cache stored? .thumbnails?

And I've got Firefox do an auto-clean to clear all the private data.. but is that enough? Is there still remaining files in /tmp that I'll need to clear?

Also I use Truecrypt to keep my files secure. But what about the records from other programs that open up those files? Will they be cleared in the .recently-used?

Maybe I've missed something? Lot's of q's I know

I did track down a program called Sweeper that should take care of it? But I'd also like to understand also.

Maybe there's a better program. There was a program called CCleaner for Windows XP I used to use which was great...

Appreciate it

If the decision was made knowing the caveats then "not an option" should be the trade-off between "keeping things private" and usability tipping towards usability. But if you haven't researched and understood what it takes then "not an option" is founded in lack of information, not true paranoia.


You might also want to read this recent thread because it gives you the means to find out file locations yourself.


"Secure" how?


Post the URI?


"Great" as in it provided you with a soothing, easy interface or "great" because you actually checked things where irrecoverable?

Why can't you just create a separate account for the other user(s)?

Ok, so by the response, and yes, I confess, I should have researched it more thoroughly before asking the questions, I should encrypt the whole filesystem as that will give me a much higher level of security (relatively speaking).

I was looking to find out what kind of traces I left, and then attempt to clear these before I logged out, but it appears that it can be extensive and better not to take that chance and just encrypt the whole filesystem.

With history -c "secure how" what I meant was, can someone just run a quick undelete program on .bash_history or similar and quickly gain access to it. Or does it actually overwrite with random data making it very hard to recover.

Sweeper is a tool that is KDE based and can be found here: http://utils.kde.org/projects/sweeper

I thought CCleaner was great because I could get it to overwrite the data 35 times, and I thought it was quite thorough to go through everything (maybe this is unfounded) It did have a nice easy interface, with a one button operation. I did like that, but part of switching to Linux is to understand a bit more about the system I'm using too. I guess I'm still in a transitional period right now.

I do appreciate your response. I'll read up more on it, and probably go with the "encrypt it all" option

What I mean is that encryption, while good, can only be a solution if it fits whatever you define as "keeping things private". For instance encrypting /home will not cover KDE/apps tempfiles in /tmp and /var. Encrypting the whole filesystem might exclude swap. Encrypting the whole filesystem including swap might exclude plaintext comms with the outside world, backups, removable media et cetera. As you widen your scope of what you define as "keeping things private" you'll want to talk about the traces you leave behind elsewhere, like what others know of you by you enabling Java, java/ecmascript, plugins, your browsing behaviour, using proxies, submitting personal and financial details, purchases, et cetera.

I'm not trying to spread FUD just trying to make you aware of some of the aspects that could help define "keeping things private".

Link any of your history files to /dev/null (.bash_history, .viminfo, etc, etc, etc)... or turn off all history to begin with.

Deleted files are recoverable from any file system (including ext2, ext3, ntfs, cifs, hfs, etc) unless the entire file, its inodes, blocks, and the journal are zeroed completely (not just unlinked). There is typically a trail of breadcrumbs through the file system information you can follow to recreate the file entirely. It's just not something that is easy to automate in some cases... and even drives that have had their platters shattered, burned, and magnetically erased can have some data recovered from them if the interested party is willing to spend the money.

Even memory is a potential location that information can be pulled from.

Basically what I'm telling you is- All you can do is apply best practices in any given environment, if you are truly concerned about your security footprint, even whole disk encryption isn't necessarily enough.

DNS queries generate a trail.
Web queries generate a trail.
Every packet you send off the computer generates a trail.
Every byte of data on the computer generates a trail.

It is absolutely impossible to truly "hide" everything.

Computers weren't designed with security in mind quickly becomes obvious when you take a serious look at potential avenues for data retrieval... and doesn't even consider basic things like physical keystroke loggers, remote monitor display, full session recording, micro camera viewing your keyboard, etc, etc, etc... there's a never ending list.

One of the things that you can do is to set permissions on the worrisome files to 600 or 700 so that only you can read the files.

--------------------------
Steve Stites