The Globe and Mail rates SecurLock V.1.3 4 Stars

The Good: USB key stores your Windows password, so you can create long, randomized passwords instead of picking things that are short, easy to remember and easy to crack; there's an encrypted holding area for often-used passwords for Web sites and programs; extra features include a secure file shredder and a way to encrypt e-mail and files on removable discs for safe transport.

The Bad: If you leave the USB key in the reader, you have to remove and reinsert it or hit control-alt-delete to get the computer to boot into Windows properly; PC-password security is based on Windows security features, so it doesn't add much extra protection beyond allowing long passwords.

The Verdict: If you rely on Windows' built-in security features to protect information on your computer or laptop from prying eyes, SecurLock can make it a lot more convenient. It also has some neat features for encrypting files, Web site passwords and e-mail, and for 'shredding' unwanted files.

REVIEW:

The problem with passwords is that people usually pick ones that are easy to remember - and consequently easy to crack.

SecurLock is a software-and-hardware package for standalone PCs that aims to make using passwords easier, while allowing people to pick codes that are harder for prying eyes to unravel. It also has some neat features for protecting e-mail and files on removable discs for safe transport, and for 'shredding' unwanted files so they can' be recovered.

The package consists of the SecureLock software, a USB reader module and a USB key the company calls a Smart Card. The key looks like a miniature version of one of those portable USB memory devices, and it fits easily on a keychain.

Installation is easy even for novice computer users, despite the skimpy instruction manual. Install the software, reboot, then install the key reader. After that, you have to come up with a short, easy-to-use password that is used in conjunction with the Smart Card key (similar to the PIN number for a bank card), and decide what parts of your hard disk to encrypt. You can set up different keys and passwords for each user profile on the computer, too - handy for families or workplaces where several people use the same PC or laptop.

Simply removing the key will automatically lock the PC or notebook. Nobody can log on to it, and any files you've encrypted will remain unreadable until the key is put back in the reader.

If someone finds the key, they won't have automatic access to your computer. The system still requires you to enter that short password/PIN number along with inserting the USB key.

The long password stored in the key in combination with the easy one you type in is meant to give more thorough protection than a short, easy-to-remember Windows password alone. If you lose the key, you won't be locked out of the computer, though. As a backup, you can type in your long, USB-key-based password manually in an emergency. This means you can choose a really convoluted alpha-numeric password and then write it down and store it somewhere safe away from the computer for emergencies, instead of relying on an easy password like the name of your pet or your phone number that someone might easily crack.

One feature of the software I didn't like involves the hardware key. If you put it into the reader and then power up your PC, the reader won't recognize it and will bring the boot process to a grinding halt. You'll be prompted to either remove the key and re-insert it, or hit control-alt-delete. It's supposed to be a security feature, but I just found it annoying.

I did like the password-storage feature, though, which the company refers to as "Single Sign On." You can paste passwords into a special SecurLock window that you can call up on-screen. When you need them, you just drag-and-drop the passwords into the appropriate password boxes in an application or Web page. But when you log out, the contents of the password file are encrypted, so unauthorized users won't be able to get at them. It's great for things like bank card numbers and personal ID numbers that you use a lot for on-line bill payments and so on.

You can also use the SecurLock software to encrypt specific files and folders on your system, and then require a password to access them. The software offers a choice of either fast RC4 encryption, or slower and more secure Blowfish encryption. The encryption can also be applied to e-mail with a couple of mouse clicks. A simple menu lets you designate a file for encryption and transmission by e-mail, storage on the desktop or floppy disk, or to be saved as an encrypted self-extracting file protected by a password (say, for storage on a CD-R disc that you plan to take on a business trip). To unlock the file, the user or mail/file recipient will need to know the password you locked the file with. When you run the self-extracting program attached to the document and enter the password, the program will handle the decryption automatically, even on PCs that don't have SecurLock installed on them.

A really cool feature involves installing SecurLock software on computers at different locations, say on your home and work PCs. Instead of using a password, you can use your Smart Card key and its complex stored password to lock the file. You then take the file with you on disc, diskette or send it by e-mail. At the other end, it can only be read if you plug in the USB key reader and your key. Anyone who intercepts it en route won't be able to read it.

And for files that you want to get rid of, SecurLock includes a program it calls the Data Shredder. Drag files or folders onto the shredder icon on the desktop, or select the Shred option by right-clicking the mouse, and SecurLock will chew up the file permanently. The company claims that files deleted with the shredder "cannot be recuperated by any data recovery tools and low level disk utilities." You can also set the shredder up to automatically shred Windows temporary and cache files at regular intervals - very handy.

The Windows logon and password encryption systems worked well, and had no effect on Windows process or system performance that I could detect.

While I'm not a professional hacker, I do know a few tricks for getting at hidden Windows files. Even so, I couldn't figure out a way around the SecurLock system. It is based on the basic Windows security system, though, so it's not uncrackable. Someone with enough time and resources will probably find a way around it. This system is really meant for basic protection from passers by or household members who might want to pry into your files, or who might try to use your computer without your permission while you're away.

SecurLock is a slick little program that is easy to use, and which makes your PC much more secure than it would be with a short, easy-to-remember password alone. The encryption system is smooth, and the shredder and password storage features are really useful, too.