Crowdsourced News
Popular News On The Web

 

Sunday
Mar142010

The Internet - Privacy like the Good Ol Days (It isn't that crazy!)

Full Circle Begins at a Point

Lately there has been a lot of talk about privacy and the internet. Applications like Google Buzz have caused quite the "buzz" about privacy. Also new sites like Please Rob Me showing the danger of posting to much about your location using social media. Is it that the internet is a bad place? Should we board up our windows and run from technology? NO!!! Of course there are risks with somthing, but lets step back for a second and think about what we have.

Just Like the Days of Old

Just think about mankind for a second; we are by nature social creatures, who require social interaction to maintain sanity and purpose in life. We started in tribes where the good of the social outweighed individuality because it allowed society to thrive and expand to what we know today. Hell, the word society is by its very nature social; society is what we are, trying to better the human race by being a collective society of people.

Now think about how things were before the internet. Even 30 years back in the 60's and 70's before the explosion of the internet. Family's and communities were vastly different than they are today. Neighbors were neighborly, people interacted, and apart from the normal abnormalities, society continued along. People knew each other, towns were social. A great example is my small home town, people know other people in town, and to various degrees information that today we might think is a privacy issue. Not needing ID to cash your check, kids allowed to play unsupervised, and in general a rather peaceful and simple community doing community things.

The Big Community of the Internet

So what changed in the past 30 years that has everyone up in arms about privacy? Well for one, people place a great deal more importance on being private, but why? What makes this time so unique that we can't share our lives with others? Why is our neighbor as strange as the person we never met in some far off land? I don't know, and I bet you don't either. Now comes the internet, somthing that by its definition is a social network of people (after all the internet was created to share information) and all is good, until the public at large gets ahold of it.

But wait, we care so much about our private lives, but yet we post our lives on Facebook and Twitter under the guise that somehow we keep what we post online private some how. Why do we cry out that the internet is such a bad thing for our private lives, but yet you just ordered some nice shoes on Zappos?

The internet clashes with our current societies idea of the private life and threatens to make us... social again.

But is this so bad?

Is it crazy to think that people are social creatures? No, that's what we are. So why do we place so much importance on our own privacy to the detriment of others? Think of what we could accomplish if people didn't worry so much about how private their medical records were, but how that information, when used to aid everyone, could solve so many problems we face today. If everyone worked to a common goal and didn't try to out do their neighbor, but helped them succeed. The internet and the people who "get" it, are working to make the web more like how society should be, and less of how society is, not because we are crazy, but because we know that the web is an extension of the human condition. Somthing we can do that people even 20 years ago couldn't... Bring everyone together.

Thursday
Oct082009

Social Engineering and You - Filtered

Recently Hotmail has had a security breach, that has now spread to over 30,000 Gmail and Yahoo mail account (further reading here). Email is such a wonderful thing to have, but it is also one of the more dangerous areas of the internet. Keeping safe is not just large company's problems, it is your's as well.

What Is Social Engineering?

Social Engineering  isn't new, in simple terms, social engineering is the act of convincing someone to do something that they do not realize is wrong. Trying to trick someone to do something has been around probably as long as humans have began to socialize. Deception is key, gain someone's trust (or apparent trust) and you would be surprised what they will do for you.

Social engineering is basically, getting what you want from someone else. Ever convince a friend to come to the movies, when they already had plans? Got that cashier to believe you didn't wear those shoes before returning them, even if you wore them dancing the night before. All can be classified as social engineering.

Social Engineering and Computers

Well now that you understand at least at a high level what social engineering is, start to think of what can happen in the world of technology. The Filtered Geek has at least three books on his book shelf (A good one - The Art Of Deception), that talks about computer horror stories with company's, all stemming from social engineering. A quick example; ever been sitting at your desk and get a phone call from the IT department? Was it the IT department? hopefully yes, but there are documented cases where a rather smart fella, has posed as employees and gained the trust of people. Once the person has the trust, you would be surprised what someone will tell someone. Just imagine this IT guy telling you his sad story, about how the boss needs software audits to be done by closing, and he is falling way behind, but if you could only help him out he would be most grateful. You feel sorry for the fellow employee, and you help him out by giving him some information about your computer, maybe even your login, because he's IT.

Woah, Wait a Second

How can you be SURE he is IT? Exactly! this isn't the only way social engineering can occur, but bear in mind if you are a victim of it, you probably don't even know it!

So what about those emails you get from places like PayPal, or your bank.

THE NUMBER 1 RULE OF SECURITY IS TRUST NO ONE

If you ever get a unsolicited email from anyplace that holds value, like banks, auction sites, anywhere that has your personal information, be VERY weary of it. When in doubt open your browser window, and manually go to the site, login, and try to confirm the information. Links in email can take you ANYWHERE, and it takes about 5 minutes of skill to spoof an email, and not much longer to type a fairly convincing one up. A hacker would love to convince you (social engineering) to click a link in a fake email, and get your password, while you don't even know you have been duped!

Microsoft has a useful site that also outlines some ways to keep you safe from these tactics online

Filtering The Filter

  • Be very weary people claiming to be someone, especially when you can not confirm it.
  • Don't click links in email and login. Go the site on your own and login
  • Trust is what social engineers prey on, watch who you give it to.
  • DON'T CLICK ON LINKS IN EMAIL
Tuesday
Sep082009

Powerfull Passwords - Filtered

Why Passwords Again?

Those of you that have been on the site before probably remember my article on passwords & the Yubikey, but after hearing a interesting comment from Steve Gibson again on the weekly set of podcasts, I thought it would be good to offer a simple yet powerful way to have good passwords that even mom and dad can make use of.

Secure Yet Easy?

So what makes a secure password? Well a long string of random characters, mixed upper and lower case, with symbols is a good start. Let's not forget that you should use a different password for each login you have... oh yeah... So in the perfect world, you would have multiple long random passwords, but if you can't remember them what good are they to you? Well here's the trick, and it will go against what you have heard in the past about secure passwords...

Write Your Passwords Down!

Wait... What? I know what you're saying "Writing down a secure password, makes it the opposite of secure!" This is true, but before I explain the trick that Steve said, lets think of why writing down a password could work.

1. If you can't remember a long password, you will use weak short ones

if your password is '12345' it doesn't matter if you would never give the password up under any amount of duress, a hacker will figure out your password in a snap.

2. Just because you write the password down, doesn't mean you attach it to your monitor for all to see.

Keep the password in your wallet, most people tend to protect their wallet so put it on a slip of paper in there, but don't write what site it is for above it, then at least you have some protection in terms of someone needing to figure out what that random string is for if they do get your wallet. (by no means am I condoning security by obscurity)

Fine, I Write The Password Down... Now What?

Don't write it all down! Yes you read that right, write down the hard random part of your password, because you won't remember that, but when you make your password, add something to the password (beginning, end, middle, wherever) and don't write that down. Ideally it wouldn't be something simple like '12345' but I suppose it could be and the resulting password would be much better than a simple password, or one you simply write down. The thought here is that as long as you know the system for how you add to the password, for example "Place my mother's birthday at the front, and my birthday backwards on the end" you will have a strong password. Even if someone steals your wallet, or somehow gets that password your wrote down, They have nothing. Heck if you wanted to, you could even attach that password to your monitor, since as long as you know what to add to the password, it doesn't matter who can see it! While you have a strong password that is much easier to remember than random junk, and much more secure than a simple password.

Passwords - Filtering The Filter

Ok, nothing super hard about this one, but just to recap

  • Simple passwords are weak
  • Strong passwords that you have to write down are weak
  • Strong passwords written down and kept safe are stronger
  • Strong password written down with easy to remember pieces added to it are very powerful
Tuesday
Aug182009

VLC Media Player - Filtered

What's VLC and why should I care?

VLC is a open source media player that has been in development for around 10 years now. It has been a popular media player in the tech communitys because of its small file size, open source code base, and ability to play just about any file type you can throw at it.

All Files You Say? Even DVDs, Quicktime, and other formats?

You bet! No matter what you need to play VLC will most likely play it. Pop a DVD into your computer, voila! VLC will play it no problem! Found a embedded QuickTime movie in a website and you don't have QuickTime installed... VLC will play it with a simple browser plugin. A handy feature that you may not even know about is the ability to play incomplete downloads... yes, you can be downloading a large movie file, and you can watch the piece you have currently finished.

Got Mac? No Problem!

VLC even works on Mac. Being a open source project has its perks, VLC has been ported to more OS's than you probably thought existed.

But Wait Theres More!

The feature list is almost to exhaustive to print in one article. Checking out the features page on the site will list out more features than you probably ever need. You can check out the features page, but here is a good rundown of the files you can play (and mostly likely will encounter)

  • DVD
  • MPEG 1/2
  • DIVX
  • MPEG 4
  • H.261
  • Windows Media
  • Real Video
  • QuickTime
  • Any Audio File (Except MIDI)
  • Plus many many more

You can even run a VLC server and stream your media across your home network. (But that is a little more geeky than this blog will get into, unless anyone is interested in learning!)

VLC - Filtering the Filter

So VLC is quite the media player, 10 years in development and fairly unknown outside the tech circle. I personally couldn't live with out it, and I bet you will love it too when you give it a go!

So lets recap

  • FREE to download
  • Plays just about every media format out there
  • Can stream media across a network
  • Multiple platforms
  • Small file size (carry it on a thumb drive)
  • Open source

Go out and give VLC a try... Make your media playback quick, easy, and free!

 

Friday
Jun052009

Yubikey - Filtered

What is a Yubikey?

What is the most important thing on the internet to you? Ok, what do you use to keep those important things safe from prying eyes... A password. Why do you hate passwords? Because they are hard to remember! And this is one of the main reasons why your digital life can be at risk, you hate having to remember all your passwords, and because of that, you make them all short and thus easy to break! Well the Yubikey addresses at least part of that problem, weak passwords.

The Yubikey (Avaliable at Yubico.com - $25+S/H) is a small USB device with no moving parts and 1 button. When inserted into the computer it is recognized as a keyboard (this makes it basicly universally accepted with no drivers to worry about). Now if you hit the button on the Yubikey you will see a long string of gibrish type on the screen, what good is this you ask? Well read on.

Yubikey - Better Stronger Faster

So, you have a big long string of text, neat. Well this long string is actually a strong and UNIQUE phrase, and by unique I mean one time, never again, erase and its gone forever unique. Thats right, every time you press that button, you get a long string of text, that you will never ever ever see again. Well what good is that? Well to avoid getting into a long drawn out explination of why (which is better explained by a pro like Steve Gibson (creator of SpinRite --- Basicly best disk recovery tool EVER) on his podcase Security Now with Leo Laporte [Episode 143], but avoid being long winded, the code is unique, but there is a part of the code that is an identifier of the Yubikey (A fingerprint if you will), and this fingerprint can be used to identify the Yubikey, and use it for authentiction using super strong encryption.

Ok So Now What?

So with this unique key you can't just go to your banking site and make your password a button press of the Yubikey (too bad too). Websites need to integrate this type of authentication into their sites. So only if you could use this to manage your passwords.... WAIT YOU CAN! 

There is one password site that the FilteredGeek uses for just this application - MashedLife

MashedLife is a online password repository, that stores passwords in a encrypted account. Simple idea, create an account, and enter login credentials for websites, once that is done you create a login bookmark. Now when you are on a site that you have a login stored, you simply use the bookmark, some javascript runs and viola your username and password are inserted into the login fields. This stops key sniffers and the like, because you don't type on the keyboard, and better yet, you can use really complex passwords because you don't have to type them in! I prefer to use passwords from Steve Gibson's page, Perfect Passwords, which is basically a 64 character long, totality 100% random password, that is uniquely yours!

Ok so the one issue I had with MashedLife was that why would you protect all your passwords behind one password... if someone got that password, they could login anywhere you can.... Bad. Well the Yubikey just so happens to be supported at MashedLife, so you can register the key at the site, and then you use the key instead of a user/password. On top of that, you provide a PIN that you enter after your yubikey is used, which provides multi-factor authentication (awesome).

Yubikey - Filtering The Filter

Yubikey is a great way to use complex safe passwords, coupled with a site like MashedLife you can not only have super safe passwords, but also have easy access to them all!

  1. Go Grab a YubiKey - $25 from YubiCo.com
  2. Sign up for a MashedLife.com account
  3. Enter your passwords into MashedLife (Changing your weak passwords if needed)
  4. Register your YubiKey with Mashedlife
  5. Enjoy a one stop shop with super secure passwords!