Latest Publications

iPhone 3GS camera

How better is the 3GS camera compared to 3G? This better:

3G vs 3GS camera

I have kept the proportions to take in account the different resolutions.

I now have a 3G and a 3GS which are a copy of each other (after restoring the 3G backup on the 3GS), so I will be able to publish some more tests soon. The first impressions match the expectations: the overall experience is much improved, and all operations feel very snappy.


  • Share/Bookmark

3GS or not 3GS?

I am using an iPhone 3G since the day it was launched, in July 2008, and I am still completely satisfied with the device. So, why update? Not for the new gadgets, which are secondary for my use (camera, video, voice control, etc.), but simply for the speed and the memory increase. The iPhone 3G can run all applications in the App Store, but for the most complex ones it feels somewhat sluggish (this has improved a lot with the OS 3.0, but still, some applications are quite slow). A simple example that I use very often is OmniFocus: the application is stable and perfectly usable, but it does not feel “reactive”. I am sure these applications can run like a breeze on the new terminal, and I am also sure that all applications will do so for a long time.

The reason is simple: there is a huge number of iPhones 3G out there, and Apple cannot afford to accept applications only running on 3GS. Now, whatever application runs on the 3G, will run faster on a 3GS, mainly because of the double RAM available.

The conclusion is that I will upgrade as soon as I manage to find a 3GS without having to subscribe to a 2 years contract.

Update: Orange in France sells the 3GS with no contract, just got one. I will probably post more on the subject soon.


  • Share/Bookmark

PGP WDE Performance Analysis

After posting the previous article, I have done some tests on a disk encrypted with PGP WDE, and benchmarks show that the performance hit is quite big. Strangely, there is no visible difference during the normal use.

Test Conditions

The test has been run on two identical Macbook Pro C2D 2.4GHz machines, with Mac OS X10 .5.7. Both machines use the same internal hard disk: Western Digital Scorpio Black  320 GB 7.2k RPM (WD3200BEKT). One of the machines has the internal disk fully encrypted with WDE.

The test has been conducted using QuickBench by Intech Software; this application runs the same tests using blocks of different sizes, I am reporting the average over all block sizes.

PGP WDE Benchmark

Looking at the average over the difference tests, the performance hit of WDE is roughly 34%. As mentioned above, I am surprised by these figures: I have used WDE for some time, and there is no perceptible difference in performance.

Update (July 6, 2009)

You might want to look at this thread on the official PGP forums:

… I can only conclude that disk benchmarks are not a good performance measure, as they do not reflect typical disk usage.

Reply from PGP: Your conclusion is fundamentally correct. XBench is designed to test disk performance. As such it bypasses the internal file system level buffers that provide much of the performance improvements that you see when using your Macintosh. XBench is a good measure of raw disk performance, but not of typical file system usage.

  • Share/Bookmark

Securing Data on a Mac

iStock_000000407887Small1.pngIntroduction

This article covers the different options available on the Mac to secure confidential data.

The only way to secure data is encryption: I will not discuss the options available to hide files and folders in an insecure way.

Apple FileVault

This is probably the easiest solution, as the FileVault technology comes with OS X. You activate FileVault at the user level: if a user enables this option, all data in that user’s home folder are stored in an encrypted disk image. As long as the user is not logged in, the data are secure and there is no way to get access to it without the user’s password, or the administrator master password (OS X allows you to set a master password at system level, to recover encrypted data if users forget their password). As all the data are stored into a disk image bundle, this technology adds some overhead and the system performance takes a noticeable hit. Another drawback is an increased difficulty to back up data: if you use Time Machine, encrypted data are backed up only when the user is not logged in (the backup itself is encrypted). Last, there is a risk of corrupting the file-system on the disk image if the system crashes while the user is logged in. If you use FileVault, it is important to do periodic maintenance and to backup regularly.

Encrypting specific folders

If FileVault’s overhead is not acceptable for you, a simpler solution consists in encrypting only the sensitive data. This can be achieved using the tools provided by the OS (i.e. Disk Utility), creating encrypted disk images. Another option is to use an external tool, like Espionage from Tao Effect: this application makes it very easy and transparent to the user to encrypt single folders. With this utility, you can encrypt a folder in a transparent way: the tool takes care of mounting the disk image and creating a symbolic link in the place of the original folder. Espionage also installs a kernel extension which intercepts all access to the encrypted folders, and prompts the user for the password to access the data. This is a good option, but the security is not as good as with FileVault: most temporary data used by applications are stored in other folders (Caches, Application Support, etc.), and these are not encrypted. If you want to encrypt these folders as well, FileVault is a better option.

Full Disk Encryption

This is the most radical solution: the disk is totally encrypted, data as well as free space. There are two options for the Mac presently:

I haven’t tried Check Point’s solution, as the company targets corporate users only, but I use PGP WDE (it is possible to get a single user license for this product). WDE encrypts every sector of the hard disk, all partitions included. The process takes a considerable amount of time for a big disk, but a positive point is that the system is perfectly usable during the process. You can work, shutdown and restart the machine, even use the energy saving functions (i.e. sleep). This solution has a few drawbacks:

  • If the system is booted, data are accessible (you need to lock the screen to avoid unwanted access);
  • You lose the hibernation function (hard sleep): Mac OS X stores the memory image in the filesystem, but the file-system is encrypted and not accessible when you turn the machine on. The “normal sleep” still works, as the memory is maintained;
  • No selective protection of data, if somebody has your password, they have access to everything. This is not a real limitation, as this solution does not preempt the use File Vault or encrypted images. You can use the solutions described above in addition to WDE.

The hit on performance of WDE is quite limited, mainly because the only overhead is the encryption, and the OS does not have to manage a disk image. Another interesting point is that all maintenance utility can be used on an encrypted disk, as long as WDE is installed on the boot disk (if you boot from an external disk with maintenance utility, you need to install WDE on that disk as well). WDE can be used not only on the boot disk, but also other disks, like backup destination of Time Machine.

Conclusion

I have used extensively the three solutions described above, and I am now using WDE only. My main system is a laptop, I am the only user, and my main concern is to protect data if the laptop is stolen, so I do not need additional levels of protection for some particular data. If you do need additional layers but still want a good protection in case somebody gains physical access to the machine, you can use a combination of WDE and File Vault, or encryption of selected files and folders.

If you need more advanced options, like plausible deniability, other tools are available. An example, available for the Mac platform, is TrueCrypt, an Open Source framework. Important note: currently, TrueCrypt does not allow you to encrypt a boot volume on the Mac. I will not cover these tools, as I have never used them on the Mac.

  • Share/Bookmark