Mossberg Report
Lock Your Windows
Keep your PC safe from prying eyes with the latest in desktop security.
By Walter S. Mossberg

MAY 2004, SmartMoney Magazine

IF YOU LOST your laptop, whether to carelessness or theft, your biggest concern likely wouldn't be the machine itself, but the private data inside. Even if you had all the key files backed up, exposing their contents to a stranger could be disastrous, raising the risk of embarrassment, business problems or, worse, the nightmare of identity theft

You may have a password on your laptop, but clever hackers can sometimes get around that. At the office, there are many opportunities for coworkers, visitors, or cleaning and maintenance people to pore through the data on your PC if you're away from your desk. Even at home, kids can get into sensitive financial or other files, wittingly or not.

But I've been testing a $129 product that aims to prevent these scenarios by adding a hardware lock to a Windows PC, whether a laptop or a desktop. It's called SecuriKey Personal Edition and is from Griffin Technologies, a small Kansas company. It works with Windows 2000 and Windows XP, and can be purchased at www.securikey.com.

SecuriKey consists of a small key, or "token," that you insert in a PC's USB port, plus security software that runs in the background and interacts with the token. Once SecuriKey is installed, the computer won't operate unless the token is inserted. When you remove the token, the computer freezes. When you reinsert it, the computer resumes where it left off.

If the token is used in conjunction with a standard Windows password, access requires "two factor" authorization. Like an ATM, the computer needs different things from you: something you know, the password; and something physical, the token.

The token looks like a standard USB flash drive and is small enough to fit on a key ring. The product comes with two tokens. The second can either serve as a backup or be configured for a second user.

SecuriKey isn't the only PC lock on the market. There are a number of other products available. Some even use fingerprint authorization. But I decided to test SecuriKey as representative of the genre.

I tried it out on an IBM ThinkPad X31. To enable SecuriKey, I had to install the software and set up a user profile. Then I had to insert the token in each of my PC's USB ports briefly so the software could recognize it no matter which port I use.

During setup, you can choose what will happen on your PC when the token is removed. The standard behavior is for the machine to lock up, with the desktop hidden, until the right token is reinserted. But you can also choose to have the machine go into standby mode, which requires the token to wake it up, to log you off or to shut down the computer entirely. I chose the standard behavior.

Next I removed the token and restarted the PC. When it was up and running again, I was asked as usual for my Windows password, but a new box popped up telling me to insert my token. When I did, the computer worked normally. On another attempt, when I didn't insert the token, the PC wouldn't operate no matter what I tried. I also tested removing the token while the computer was running. As advertised, the machine locked up, then resumed working when I reinserted the token.

You can also use SecuriKey for other kinds of protection. For instance, you can configure it to block access to specific files and folders unless the token is inserted, though this works only if your hard disk uses a Microsoft file system called NTFS, which many consumer PCs may not have. The SecuriKey software can handle multiple profiles for different users, based on their Windows sign-in names.

As an added measure of security, you can instruct SecuriKey to block the PC from going into Windows' "Safe Mode"-a special mode that Windows uses when something is wrong, designed mainly to enable the user to diagnose and correct problems. But hackers can sometimes use Safe Mode to compromise or remove security software.

If you don't use your second token as a backup and lose the first one, you won't be able to access your computer. But Griffin will send you a replacement token for $40 plus shipping.