Password Security in the Cloud Computing World

Image courtesy Travis Goodspeed

Image courtesy Travis Goodspeed

The recent cloud computing security issues including the possible security breach at Lastpass in May 2011 and now the major breach of the RSA SecureID system leading to an attack on major US military contractor Lockheed-Martin has many of us wondering how safe central password repositories are.

I have been using Lastpass, but with a less than perfect password. I was using 10 random characters. I have decided to fall back to a local solution. I am now using Keepass. KeePass is a local application for Windows, Linux, Android, iPhone, Palm, Blackberry, Mac and pretty much any other platform. It can be used as a portable app, carried on a USB stick.

I keep my database stored in a Dropbox folder and synchronized across my computers. The database is encrypted, and stored in an encrypted state on Dropbox.

I can access it anywhere I can connect to dropbox, or run a Windows app from a USB drive.

And it has one other benefit over Lastpass – Lastpass tends to wind up with multiple versions of passwords (if you change them) and knowing the current one becomes a management problem. Keepass keeps one password, and you can group them. For example I have three WordPress logins for different Blogs. With Keepass I can create three groups, one for each Blog, and keep all relevant information for that blog or personality.

 

Google Instant Search is Here – For Better or Worse

Google instant search has arrived. Here in Tasmania we had to wait a while, but it is now operating on both Firefox and IE8 browsers on my Windows 7 PC.

The Advantage

Instant search only works for people logged into Google accounts. The differences are extraordinary! Logged into my Gmail account, I just searched the first few letters of Serenity Computing… Seren on both IE and Firefox. Both browsers returned identical first pages. Serenity Computing was the sixth entry. Interestingly IE got its result in 0.07 seconds and Firefox took 0.11 seconds. In fairness, I do have more tabs open in Firefox. Reducing each browser to 3 tabs and re-trying brings a search on Firefox in at 0.06 and on IE8 in at 0.05 on several passes.

Serenity Computing comes in as the sixth item in both browsers. My son, on the same IP adress, same ADSL connection, but without a Google account gets a completely different set of search results. Google cannot guess past the Sernei. Logging out of my Gmail account brings a completely different experience, I now get the same results as him.

To Google, search is king, and they are excited.

The Google Instant page says that Google Instant will save 2.5 seconds on the average search, more than 3.5 billion seconds a day. That’s 11 hours saved every second.

The Google Instant video is here:

If your connection is slow, Google will turn Google Instant off, and you can do it yourself by clicking the “Instant is On” link on the right of the search box.

Google Instant is not available on mobile devices a this time, and given the cost of mobile data in Australia, that my be a blessing here.

The Wall Street Journal comments: At a demonstration Wednesday at the San Francisco Museum of Modern Art, the Mountain View, Calif., company said the search engine now tries to predict what customers are searching for and instantly displays results before they finish typing. As an example, an engineer who wanted weather information typed in the letter “W” into the search box and immediately got the local weather forecast above other search results.

Marissa Mayer, vice president of search products and user experience, said Google Instant could shave two to five seconds from the average 25 seconds previously needed to search and choose a link—reducing the collective time spent on Google searches by 350 million hours a year. It’s “search at the speed of thought,” she said.

Offensive Language.

Google Instant will turn off search for words that may be offensive. In some cases, this will pause the search on words that have a character string that “MAY” be offensive. Helene Slutsky is upset that her Blog causes Google to stop the Instant Search. Of course, all you have to do is enter the search string and hit enter, and you will get the requested results.

It seems even searching for “I Hate” will switch off Instant Search. But the results of displaying every result could be embarrassing, so I think they are erring on the side of caution.

The Down Side

By feeding the most likely ending to our search result, Google is subtly training us to follow the most common search strings. This will tend to force us away from what comes naturally to us. We will be slowly pressed into the mold of popular decision. the outliers will be extinguished. Thinking will be squeezed into the path of the masses.

This is good for Google. It means that less and less searches will be unique, and the search will become faster because more searches will already be in the cache containing the most common search results.

It also means that the intuitive jump that makes the break away from the accepted path will become even less likely. Instead of following our own path we will begin to follow the herd more and more .

It means that the results of free minds searching for the unexpected may be slowly extinguished. We may slowly find ourselves being molded into The Image of Google…

Image by Manfrys

Why Steve Jobs Was Wrong – PCs are not Trucks

The farm truckRecently Steve Jobs described PCs as like the trucks that where the standard transportation of the poor family working the farm in the 40′s and 50′s. As people moved from a farming society to a suburban one, the car replaced the truck. He suggests that soon the robust heavy lifting truck (PC) will only be needed by the few content creators. In the context, it is a reasonable parallel. But it is flawed. My neighborhood is filled with with trucks and four wheel drives driven by people who just like big vehicles. And the implication is that the iPad is the car,  a better fit for society today.

I think a better metaphor is the family car verses cabs.

The PC is like a family car. It is not cheap, but it is tailored to our needs. It can be big and powerful, or small and economical. We pick the colour, model, features and size to do the job for us. We pay the price and get something that works well, and that we own. It as in the driveway or carpark. we can use it any time, and go anywhere. We can pick up friends, stop for shopping or lend it to a friend.

The PC can be tailored to our needs. We can install Windows or Linux. We choose the software ad how we connect to the Internet. We can install Flash and Firefox. We can develop software, write novels, edit video or audio and create graphics. Everything can be set up the way we like it, and we can use it anywhere.

The iPad is a taxi cab. We don’t pay up front, so it is cheap. We cannot pick the colour or model, we may not like the driver, and we have to go the route he wants to go to our destination. It is convenient, but we cannot tailor the experience. We just don’t own it.

Custom carThe iPad is slick and beautiful, but without apps from the Apple store and the network, it is useless. It is essentially a consumption device. Yes, it can be used for e-mail, note taking, and other things, but only within the limits of the Apple ecosystem. We will pay endlessly for subscriptions to content and the network. Without them it is worthless. Like the taxi cab, it will get us where we want to go, but by the driver’s route, on its terms, and at a constant price.

I won’t buy an iPad, partly because I do not like walled gardens, and partly because I have a netbook that provides enough functionality and is compact enough to serve me well. When it reaches it’s use-by date, I will look at the offerings then and will probably find a more open and flexible tablet device.

For now, my PC be it a truck or a car, is my tool of choice.

Custom car image waechor on Flickr,  Rusty Truck image Revanovum

Internet Explorer flaw used to Hack Google Mail Accounts

The attack by Chinese hackers on Google mail accounts belonging to persons of interest to the Chinese government have been widely reported by others. That attack included more that Google mail accounts, it also targeted a number of military contractors in the U.S.

The common link is an exploit of yet another flaw in Microsoft Internet Explorer. After initial denials Microsoft has now admitted the flaw, and is working to patch it. In the meantime they have published an advisory on how to work around the problem on their web site.

A number of Governments including Australia, France and Germany have issued advisories to users to stop using Internet Explorer.

I have urged people to switch to Firefox for years. As the IT Manager at the University of Sydney Security Service I disabled IE and switched users to Firefox beginning with the Beta 0.9 version, and had few problems. I have offered to install Firefox on the computer of every customer, and many have accepted the offer.

Complacent and Non-technical Users


One of the biggest problems with Windows and Internet Explorer is that to many computer users, Windows is the only operating system and Internet Explorer (IE) IS the internet. The concept of using another browser than IE, which came pre-installed is simply to much effort to even understand.

These same non-technical users are also easy prey to phishing scams and viruses via e-mail.



Geeks Arise, Help the Users Throw Off Their Chains!

It is easy for those of us who know how to secure our systems to roll our eyes and laugh at the average person as they flounder around accepting advice from equally clueless sales staff in department stores and spending money on software that cannot fix already compromised systems, and is often worse than the threat.

It is the responsibility of the geeks and technically minded to help those around them to understand that internet security IS important, it DOES affect everybody and it CAN be fixed. A few steps, simple for those of us with technical minds can provide a reasonable level of security for these non-tech. users.

John Sawyer on the Dark Reading “Evil Bytes”  Blog posted his six things to do to secure your computer. I agree with most of these suggestions, although I would put switching to Linux as a real possibility for many average users. I would also suggest if you want to go to the extent of using item 6, a Virtual Machine is better, but that is beyond the scope of this article.

I will discuss some of the plugins that make Firefox a safer browser soon.

How to Eliminate SPAM Forever!

I am sure that heading caught your attention. It is possible to eliminate spam from your in-box quite easily. A nice side effect is that you also get a permanent, searchable archive of all incoming and outgoing e-mail. You don’t need to change your e-mail address and this works with almost any e-mail server. It also gives you the ability to access your e-mail from any computer, anywhere.

And it is quite free.

Use Google Mail (Gmail) as your filter. Gmail has best filter I have ever seen. Gmail uses computer software, of course, but the real secret is the 80 million pairs of eyes that use Gmail. The users. If you have spam filtering software on your email client, It has to be trained by you. Each time you mark email as spam, the system looks for similar messages. With Gmail, when you mark a message as spam, Google flags that e-mail across the whole system. I assume they wait for a few hundred or thousand people to identify that message as really spam, but then it gets moved into everyone’s spam folder. There is a video by Google here.

The result is that I probably see a piece of spam in my in-box about once every two weeks. I am happy to mark it as spam and contribute to keeping the system clean. There are also no false positives. I have never found a message I want in my spam folder.


So how do you do it?

You must create a new Google Mail account. Just go to Google Mail and open a new account (or use an existing one, of course). Just follow the prompts.

Then either have your e-mail forwarded to your new Gmail address, or have it collected.

Forward your e-mail to Google mail.

If you have control over your mail server, re-directing is easy. My mail server has a Smartermail web interface. I simply set it to re-direct my mail and then delete them.



Or, have Google mail collect it for you.

If you cannot access your mail settings, Gmail can collect you mail using POP, the same protocol that your mail client (Outlook, Thunderbird, etc) uses to download mail. Go into the settings tab of gmail, then Accounts, and click on “Add a mail account you own” in the “Get mail from other accounts” section. Step trhough the form, supplying the email address, the user name, password, POP server details. This information is the same as you use to download mail to your e-mail client. Just look in your account settings.


If you have more than one e-mail account, you can have g-mail label each incoming message with the name of your e-mail account.

Now your e-mail is being sent to Gmail. Send some mail to yourself to test that it is working. Gmail has a brilliant interface, and many people just stop at this point and use the gmail interface for all their mail needs.

Make outgoing (sent) mail look like it is coming from your e-mail address.

The next step is to tell Gmail to send mail showing your real e-mail address. This is done from the settings page again.

In settings > Accounts click on “Add another e-mail address you own” Enter your name, and your e-mail address.

To activate this option, Google will sent an e-mail and you must reply to it, to prove you actually own that email address. You can then set that address as your default, and all mail sent will show your actual e-mail address.

But what if I want to use Outlook, Outlook Express, Thunderbird, etc?

Go to the Gmail accounts setting again. Click on the “Forwarding & POP/IMAP” tab. In POP download, click on the “Enable Pop for mail that arrives from now on” button, and save.

Then Go to your e-mail client, and set it to point at Gmail.

This is the last step.

Item 3 on the page described above has links to specific instructions for most e-mail clients.

Go into the account settings in your e-mail client, and change the settings to download your e-mail from Google mail following the instructions provided .

That’s all folks!

The benefits include having a Gmail interface accessible from any computer. You keep your official or professional e-mail address and you now have a backup of your e-mail.

An added benefit is that if you use Google desktop, it can search and index all your mail on the Gmail server. This gives very fast search and indexing of all your mail.

Log into Gmail occasionally and have a look in the spam folder. Eventually you will give up, and Google will delete all spam more than a month old automatically.

Enjoy! – Phil Stephens