US COMPUTER STOLEN (BLOGGER) David Blatner is arguably the world’s most-recognized authority on Adobe InDesign and the co-host of the site InDesign Secrets.]TidBITS Safe Computing: What I Learned from Having My Laptop Stolen

Safe Computing | 4:47 PM | Print | Comment | +1

What I Learned from Having My Laptop Stolen

by David Blatner

Someday, somewhere, somehow your computer will be gone. It will be stolen, or the hard drive will self-destruct, or it will be hit by a meteor. While the latter would at least provide you with an excellent story, having your laptopstolen , as mine was recently, just plain sucks. However, I did manage to learn a few things in the wake of disaster, and wanted to take the opportunity to share them with you here.

Three things are lost with a computer’s theft: hardware, data, and privacy. I’ll let others deal with the emotional aspects of loss, and instead focus on the practical ones.

The loss of the hardware is, in many ways, the least of your problems. Sure, it’s money out the door, but as my mom once told me, you can always make more money. That said, I do encourage you to make sure yourcomputer is insured. Many homeowner insurance policies do not cover computers that are used primarily for work, or those that are stolen offsite (like from a car). Be sure to check your policies carefully.

I would also recommend installing tracking software on your computer. Of the various options on the market, I picked MacTrak by GadgetTrak for my replacement computer based on several factors: I really liked the company’s owner, who I met at his Macworld booth; I don’t like the idea of a third-party company being the mediator between me and the tracking data (as other companies do); and I like the relatively simple and straightforward approach the software takes.

If my new laptop is stolen, I log into the GadgetTrak Web site and report it missing. The next time my computer pings their server, it sees the status and starts occasionally taking pictures (with the built-in iSight camera) and reporting its location (based on whatever WiFi address the thief is using). Those photos and data go directly to me, and it’s up to me to give that information to law enforcement.

There are a number of other products and companies that can track your Mac including LoJackUndercover. While both programs have some interesting features (Undercover in particular does some things I’d like to see incorporated into a future version of MacTrak, such as taking screen shots as the thief works and simulating a hardware failure to force the thief into bringing the machine in for repair), evaluating them should be saved for another article. and

So tracking helps protect against the loss of hardware, but what about the loss of data? This was my biggest concern at first, considering I kept everything on my laptop and was not that conscientious about backing it up. Lucky for me I had two things in my favor. First, I had been using SuperDuper about once a month to back up the whole laptop to an external hard drive. It’s easy, cheap, and painless to back up a complete copy of acomputer, or make incremental backups regularly.

Second, I had installed a copy of CrashPlan a year or so earlier. CrashPlan is one of several programs on the market that sits in the background and backs up your hard drive to either an external drive, anothercomputer (on your local network or one connected to the internet) that has the software, or to a central location (see “ CrashPlan: Backups Revisited,” 2007-02-26). I chose to store my data at CrashPlan's bank vault in Minneapolis for about $5 per month.

About two hours before my laptop was stolen, I had stopped in at Glenn Fleishman's and Jeff Carlson’s office to say hi and check my email. While there, CrashPlan quietly backed up a few more files without me even knowing it. Thanks to those few minutes of being online, I was later able to recover about 95 percent of my data. The only significant data I lost was the previous month’s worth of photos in iPhoto (which I had for some reason instructed CrashPlan to ignore).

Some of you may be asking, “But what about Time Machine?” Well, to be honest, it didn’t work for me at first, and after 5 minutes of troubleshooting I got tired of it and gave up. For those still curious as to how CrashPlan sizes up to Time Machine, you can find a comparison of the two options on CrashPlan’s Web site.

My next overwhelming sense of loss (and that which stays with me to this day) was the loss of privacy. I did use a program called KeePass to protect my passwords and some other private information (I now use 1Password, which offers far more features, such as autofill in login screens). But what about my Quicken files? Or photos of my family? Contracts and other business documents? Suddenly all of that was in someone else’s hands.

After about 5 days, I logged into the CrashPlan Central server and saw that all the files it was backing up had been deleted from my laptop. Or at least, it simply couldn’t find them anymore. That was a small relief, but ultimately I don’t really know what happened to the data, which leaves me with a bad taste in my mouth.

So here’s how I’m doing it differently on my new laptop. First, in the Security pane of System Preferences, I turned on the checkboxes labeled “Require password to wake this computer from sleep or screen saver” and “Disable automatic login.”

Next, I created a new Guest Account in System Preferences. In the guest account, I set up Parental Controls so a user can’t really do much beyond log in, use iLife, surf the Web, and so on. More importantly, behind the scenes, I have granted GadgetTrak to run quietly. The idea is that a thief, not being able to log into my account, will find that they can log into the Guest account, which will enable me to capture their whereabouts. It may be a long shot, but it’s better than nothing.

On top of that, I have used Firmware Password Utility to lock my firmware, stopping anyone from reformatting the hard drive, launching from an external disk, or even starting the laptop up as an external Firewire drive. (For more information, see Apple’s support article about setting up a firmware password.) I’m sure someone will soon tell me that it’s surmountable, but so far it seems pretty dang secure.

I’ve implemented two other security options on my new computer. First, before leaving for a recent overseas trip, I dug out an old Kensington cable lock that I bought about a decade ago but never got around to using. Being able to lock my laptop to a table gives me a little extra peace of mind.

Second, here at home, I also have two fireproof media safes for backup DVDs and CDs. Note that I said “media safes” - regular safes may be fireproof for paper, but electronic media will melt in them. I had to get two because the space inside is tiny (the majority of the safe is concrete or some other heavy and thick material).

There are still plenty of other security options I could choose to take advantage of. For example, I know Mac OS X has FileVault, but the fact that it has to encrypt and unencrypt the entire Home folder (including gigabytes of photos and videos) puts me off.

Ultimately, I feel that the measures I’ve taken are relatively inexpensive, easy to implement, and leave me with a comfortable sense of security. Sure, the NSA could crack it, and yes, a meteor could still do some serious damage, but if some jerk steals mycomputer again I won’t hyperventilate or panic. It’ll be okay.

[David Blatner is arguably the world’s most-recognized authority on Adobe InDesign and the co-host of the site InDesign Secrets.]