Helping people with computers... one answer at a time.
Write protected USB and other devices will prevent certain types of malicious behaviour, but they will not keep you safe at a public computer.
I came across a USB flash drive with a write-protect switch on a website and placed an order. How does write protect in a flash drive work anyway? Does this not solve the problem of spyware on public computers, especially if you could run Roboform and portable Firefox off the flash drive? However because I have not yet received the thumb drive, I tried running portable Firefox off my hard disk with the folder's attributes changed to read only, and it doesn't seem to work.
No, it won't keep you safe. Not at all.
I'll explain just what that "write protect" means, why it's useful, and why it still doesn't help you at public computers at all.
To be honest, I'm surprised that more USB devices don't have this switch.
The concept is very simple: if the switch is set you are prevented from writing ANY data to the device; not one bit.
Typically, this works at the hardware level - the switch actually disables the electronic circuitry that is used to perform writes. Without that circuitry working you simply cannot write data to the device - you can only read.
If you cannot write to the device then you know, beyond a shadow of a doubt, that it cannot be tampered with. What that means is that it cannot be infected with a virus, for example.
That's a good thing.
It also means that if some software you're running from the device saves settings or somehow updates its own status on files kept on the device, it cannot make those changes or updates.
That could be a good thing - you know your application settings are never tampered with, and anything it might normally keep like history cannot be updated on the device. It could also be a bad thing - the application may fail to run at all.
Typically, what you want to look for when choosing applications to run from a read-only USB drive are "portable" applications which do not require installation, and even then, portable applications that do not require the ability to write or save data. Some may call that out as a feature, others you may have to experiment with.
If the public machine you're using has malware on it - say a key, screen or activity logger - your read-only device doesn't protect you at all. If you login to some service, even using your USB key as the source of your login information, it can still be captured.
Your account can still be stolen.
Since you had to enter that information somehow, i.e. it had to pass through this un-trusted public computer, you've made it visible and available to any and all malware that's installed on that machine.
Write protected or not.
You may not walk away with malware on your device, but it doesn't matter. You may have already given your information to malware on the public computer you used.
Just ... don't.
Public computers simply cannot be trusted. Period.
Comments on this entry are closed.
If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.
If you don't find your answer, head out to http://askleo.com/ask to ask your question.