If it were my computer in the hospital, I sure wouldn't allow just anybody to walk in off the street and plug an auto-play device into it. Talk about setting yourself up for a potential security nightmare. Both for the hospital computer freely accepting any old auto-play, and for the patient trusting the hospital computer to be free from spyware/keyloggers. But this Zaptag device only supports Windows so I'm out anyway - I run Linux.

The general utility of this device seems in question too. The non-encrypted stuff - your contact info, etc. - would be better handled with a laminated card in your wallet (I have one of those now). And the encrypted stuff... (1) If you're well enough to walk over and enter your passphrase into the reading computer, you're probably well enough to just tell them the info. (2) If you are too mentally impaired to remember your medical info, you're probably too impaired to figure out how to populate a USB thumbdrive in the first place.

I have a USB thumbdrive, encrypted, with all kinds of stuff on it. Much more than just medical. SSNs, scans of passports, drivers licenses, family photos, auto VINs, insurance policies, credit card info, bank accounts, tax returns, recent water and utility bills, and more ... an identity theft goldmine. I keep this because of the nightmares I read about for Katrina victims trying to reestablish their identities. I sure wouldn't plug this thing into any old computer, even though everything is encrypted. I would always assume keyloggers and spyware were present on the host computer/OS. I'd power down the host computer first, then boot from this thumbdrive. It contains a complete Linux installation that runs from the thumbdrive (and it's "only" a 256Mb thumbdrive!) Since booting from thumbdrives is still black magic, especially on older computers, I have a bootable CD with the same info in my safe deposit box. I really need to send copies of that CD to family members in other states, but I haven't gotten around to it yet.

Actually, I've plugged a U3 equipped drive into Linux machines and had it come up and autoplay. I've told U3 NOT to autorun though, beucase it has trouble with Suse unmounting it and it is lags in XP it wastes more time than I want if all I need to do is grab a 300k file off it.

As for securing a computer, that's part of my job. And here is what I tell everyone I work with- don't worry, it WILL be compromised. So far I haven't seen an autorun attack that can be put on a CD or a flashdrive, but that doesn't mean that there won't be one- I just have to question how useful it would be in a well configured enviroment. Although I will say, if I'm brought in unconcious, with dual compounded femurs and various other physical insults, I'm not all that concerned that you might find a semi-naughty picture of my GF on there, but I also don't keep that kind of thing on a thumb, much less my back account or credit card numbers.

I do the same thing with a Knoppix CD in my ditch kit, although I'm thinking about switching over to a mini-DVD due the more effective use of space. I figure in 18 months or so I'll make the switch. But that isn't an EDC, while the ZapTag is ment to be. Again, I wouldn't put anything special on there, which is why I have my questions as to making it a 256- 128MB would be fine, and thats only becuase I don't know if anyone is still set up to make a 64MB. (U3 isn't very skinny or I'd say a 32 actually, and I can only assume that is what they are using for thier launcher- SanDisk helped develop it.)

And I would say security should be dynamic. In the case you make, while I'm at a greater danger from ID theft at that point, I'm also not in a position to worry as much about it. I have zero doubt that there weren't people going through houses after Katrina looking for things with ID information on them, along with valubles, and I accept that if I'm ever in such a situation, my personal data is compromised.

I actually made a combo traditional/digital dogtag by sandwiching an SD card between two tags in plastic liner. I chose a micro SD in its adaptor so that it can be read by a card reader.pda or I can just put the micro SD in my phone.
Its not really for first responders, but more a way for me to carry more detailed info such as serial numbers, scans of douments, photos, maps etc.
For fiorst responders, I have my name, National Insurance No. & NHS medical card No.

Yes, I agree that you should plan for it to be compromised. My point was not so much to prevent ID theft at that point (but that is still important). Rather, to help you prove identity to obtain government assistance during a disaster. With all the Katrina fraud we read about, I suspect people's ID might be more strictly verified during the next disaster. Hence all that "proof of identity" stuff I keep on my thumbdrive. Also pictures of family and pets on a thumbdrive might help locate them if you were seperated.

You didn't hear about the Sony music CD rootkit fiasco???!!! Any malware executable can be put on a CD and configured to autorun. I think "can be put on a CD" should be replaced with "HAS been put on a CD". Not too many have been, but they can be.

For quick customization and adding your own data, check out SLAX (www.slax.org) It's a lot easier than remastering Knoppix. Add the readily available TrueCrypt module, and you're set to go for encryption (TrueCrypt works on Windows as well - a big plus).

I guess I should get off of computer security and back to the regularly scheduled program ... back to the original topic. Which wasn't directly about computer and ID security, but about a new thumbdrive thingy! <img src="/images/graemlins/tongue.gif" alt="" />

"So far I haven't seen an autorun attack that can be put on a CD or a flashdrive"

The Sony DRM deal was the most recent well known one.

I've studied a lot of computer security myself and sure everything can get compromised but you can take steps to help prevent compromise. Such things as not using MS internet explorer or outlook express to destoying your old cd's and not leaving them around for someoen to find.
Myself I now scan everything and anything super important is kept in a fireproof safe and the rest gets shredded. This was I have less for people to find and if I ever would need to evac the safe is somehting that will go with me.

IMO it's not worth the $$$. The medical data that you really need to be able to convey when you're nonresponsive are:

name
serious allergies
MAJOR medical problems
a contact name/number

This is easily handled by a custom dog tag, engraved bracelet, and/or laminated wallet card. All of which are cheap, waterproof, non-computer dependent and easily accessed by EMS and hospital personnel.

Unless you have some type of extremely rare and dangerous medical condition, I don't see the need to have all your medical records immediately available to God knows who.

IMO this would be a nice item for Alzheimer's victim, with out the password. It has there picture and address and that is all the police and medical personell would need to get them back to there loved ones.

As Glock-a-Roo pointed out earlier, for most people, I think this product is a solution in search of a problem, or at least overkill. It seems to be marketed as an aid in sudden emergencies or injuries, but unless you have a complicated medical history or certain conditions, like allergies, I think even a simple card in your wallet would suffice for EMS/ER purposes and contacting loved ones.

That said, this product did remind me of the thousands of people displaced by Katrina who needed ongoing, long-term care and who were without any medical records. Many doctors' offices and pharmacies were flooded and damaged, medical records destroyed, no staff to contact for help/information, and residents scattered to the four corners of the country, far from home. Thousands and thousands are still displaced.

For these people, a product like this could be useful, since many people don't remember the details of their medical history very well, especially if it's complicated and involves many different kinds of meds. Why waste time, money, and suffer inconvenience and discomfort by starting from square one when your new doctor could simply see your medical history using this product? That said, it would be difficult to get a good, detailed medical history onto this thing. It's not like patients are in the habit of looking over their doctor's shoulder to take notes and later enter the info into their USB thumbdrive. And what's a grandma-friendly method to get a digital copy of an EKG or chest x-ray onto your thumb-drive?

I was thinking of something intentionally created as malware by amatures. But your right, the Sony DRM qualifies.

Maybe we should coin a new term: megloware, from the meglomanic corporations. Although that would include all non-open source OSes, so..... <img src="/images/graemlins/grin.gif" alt="" />

As I said elsewhere, I had forgotten about the Sony DRM mess, as it actually never really effected me or the machines I work with. All of my Sony and BMG CDs are pretty old (I haven't bought major lable music in over five years- it all sounds the same to me), so it slipped my mind.

I have vast quantities of data, and a lousy search algorythem. <img src="/images/graemlins/smile.gif" alt="" /> (And worse spelling, but it is late.)

I was thinking more of something that had been set up specifically as a virus that covertly included itself when optical media was burned or when flash memory was mounted, and then would autorun to place itself onto host machines, and ad nausea. (The DRM, while scary, was not self spreading to media.) Sneakernet as a vector hasn't really been a concern for a while, and I'm waiting for someone to dust it off becuase who, honestly, runs an antivirus every time they put in a disk?

Keeping on the topic at hand, I think glockaroo actually hit the nail that as a geek, I really didn't want to- does this thing actually fill a void? Again, it comes down to "does the medical staff know to look for this", just like the ICE in the phone thing and the "life vial" or whatever it is that I saw advertised at my drug store a few days ago. (The later is basically a plastic tube with a big label on it that you put your meds in and put in your fridge, and a sticker you put on your front door. And it is a pretty little sticker.) Will anyone who knows what to do with the data actually see it?