Archive for the ‘Technology’ Category

h1

Protect your email with a strong, unique password

April 24, 2020

Some of my friends have asked me recently about computer security, passwords, scams and malware. One thought he had a virus infection on his computer, another had been reposting hoaxes about WhatsApp messages while yet another had received one of these “we’ve got all your details, we’ve videoed you with your own webcam doing embarrassing things; if you don’t pay us money we’ll send the footage to all your contacts” emails. The reason he was particularly concerned was the email included one of his own passwords.

Of course it was a scam; it turned out the scammers had probably got his email and password from the LinkedIn security breach. So I confirmed with him that this wasn’t his email password and then reassured him it was a scam. He changed his email password just to be on the safe side.

Keep your email secure

Before anything like this happens to you, the most important piece of advice I would offer is: make sure your email password is UNIQUE (i.e. you’ve not used it for any other account, anywhere else, ever) and strong (8 or more characters and a mix of at least uppercase letters, lowercase letters and numbers). If it’s not. Then I suggest you change it as soon as you can.

Computer with chains and a lock

It’s unwise to use your children’s names and dates of birth. Don’t use “password” “qwerty” or “1234567890” (which are some of the most commonly used passwords).

Why your email?

Because email is the way you reset every other password. If someone hacks into your email account they can change that password, then access every other account you have by going to the website and clicking the “I’ve forgotten my password” link. The site then emails them a reset link. Worse, they could log into your email and automatically forward your emails to themselves, so you don’t know anything’s wrong, but they receive a copy of any email sent to you.

So your email password is, perhaps after your bank, the most important password you use. And it doesn’t require your email provider to be hacked. If a major website is compromised (recent security breaches in the UK include Tesco.com and Carphone Warehouse) the first thing the hackers will do is try each password on the email account associated with it… and if you’ve used the same password for both, then the hackers have access to your email.

How to make a password strong but memorable

My preferred technique is to pick the title of a favourite book, album or song and use that as the key. Let’s consider, for example:

All I Want for Christmas is You by Mariah Carey.

(I don’t use this, nor should you, it’s just an example)

Take the initial letters capitalised as in a normal sentence:

AIwfCiy

Substitute some of the letters. For example you could change the “C” of Christmas to X for Xmas, “for” to 4 and “you” to u:

AIw4Xiu

It’s still too short, so add the initials of the artist – MC:

AIw4XiuMC

There you have a pretty strong, apparently random, 9-character password, but because you know the passphrase, you can remember it every time. No one will guess it, nor will it fall to a brute-force “dictionary” attack where hackers try every word in the dictionary.

Some sites require your password to include a special character, if that’s the case you can insert a %, & or @ between the song and the artist:

AIw4Xiu%MC

There you go, the almost perfect password.

Could I make it even more secure?

Yes, you could use what’s known as “Two Factor Authentication” or 2FA. Your online bank already uses this so you’re probably familiar with the concept. When you login you need to provide a second password, or a code texted to your phone. Maybe your bank’s sent you a special authentication device such as the Barclays PINsentry below, or you use an “Authenticator” app which generates a one-time random code. There are several authentication apps. Microsoft includes one in Office 365 (now Microsoft 365)Google has one, and Authy is one of the independent ones.

Sites including PayPal, Twitter and Amazon support the use of Authentication apps for 2FA. Many sites offer a 2FA capability and it’s a good idea to enable it if it’s available.

Barclays PINsentry security device

Barclays PINsentry for two-factor authentication

How to remember all those passwords

Ideally every password you use should be strong and unique, but that’s hard, especially as our memories fade with age. Writing them down, while not a great idea, is better than using the same password everywhere. Use a little notebook and keep it somewhere safe at home – that’s far more secure than re-using passwords. Someone would have to break into your house to get it, and if they do that they’re much more likely to steal the telly! Whatever you do don’t write your passwords on a sticky note on your computer!

Better still, use a Password Manager such as LastPass (there’s a free version for web, PC, Mac, iPhone and Android) or 1Password (small annual fee) which can securely store all your passwords, generate new unique random ones and fill them in on your phone or computer as you need them. They have extensions for your favourite browser, and you can also access them securely from anywhere when you’re away from home (unlike the notebook under your bed). With a Password Manager you don’t need to remember, or even know, any password other than the master password for the app. Whatever you do, make that strong, unique and don’t forget it!

Should I change my passwords regularly?

It’s fair to say that the IT security industry is divided on this. Provided your password remains strong and unique then there’s benefit in doing so, and some systems require you to do so periodically. The problem is that many of us have lots of accounts, and trying to think of multiple memorable, unique, strong passwords regularly is hard. So many people, when forced to change their password, just use the same set over and over again, or they use the same password but include a number in it and increment the number each time. So being forced to change your password regularly may actually reduce rather than improve your security. Use a Password Manager and you can change your password regularly – in fact some of them will do it for you automatically!

What happens if the Password Manager site is breached?

Yeah, it has happened. Password Managers are, like antivirus software, a prime target for hackers. But it wasn’t a problem because the way Password Managers work is your passwords are securely encrypted with your master password as a key before being stored in the (yet further encrypted) Password Manager database, and are only ever decrypted, as you need them, on the device you’re using. Even the Password Manager doesn’t know your Master Password. So if the Password Manager site is compromised, all the hackers are likely to get is a list of encrypted records, none of which are any use to them.

They must know my password, how else do I log in?

When you first set up your password, the site does something called salting and hashing. Salting adds a string of characters (which may be very long and is usually unique to your user account) to your password before it’s hashed – a type of strong one-way encryption*. The resulting string can’t be reversed, so it’s impossible to work out your password from the salted & hashed string.

All this processing is done on your computer before the result is stored, so your password is never transmitted over the Internet. When you log in, your computer repeats the process and transmits the result which is compared with the stored version. If they match, you’ve entered the correct password and you’re allowed in. If they don’t, you’ve got it wrong. But at no point is your password known to, or stored by the system.

Even if a hacker managed to get hold of your unique salt and the hashing algorithms (as some are reported to have done in the LastPass breach) they’d still wouldn’t have your Master Password, so they’d have to guess it and try salting & hashing it to gain access to your passwords – which is why its still important to make sure your Master Password is strong and unique.

Clever eh? This salting and hashing system used by many major Internet sites, not just Password Managers. I suspect Tesco and Carphone Warehouse are using it now.

So keep your passwords, especially your email password, unique and strong, and use a Password Manager, then you can just ignore those scammers!

 

 

* For the purists, yes I know it’s not the same as encryption, but this isn’t the place to go into the details of the difference between encryption and hashing.

h1

Football on UK TV at 3pm? Never!

February 15, 2020

It seems perverse to me that in today’s technology and media landscape, with multi-billion pound fees paid for the rights to broadcast live football (soccer, for my transatlantic readers), it’s impossible to watch a live football match on a Saturday at 3pm in the UK unless you’re actually there in the ground, or have privileged access to a TV studio.

Why is there no live football on TV on Saturday afternoons?

The reason is that in the 1960s then Burnley FC chairman Bob Lord convinced other Football League clubs that if live football were available on TV at 3pm on a Saturday – the kick-off time of most football matches at that time – then their fans would stay at home and watch a higher league team on the telly rather than go to the live game. So a law was enacted that prevented the broadcast of any live match between 2:45 and 5:15 on a Saturday. This law is still in place and still observed, even for games being played outside the UK. Pubs in the UK are also unable to stream live matches between those times.

What’s the impact?

This is the reason so many matches are played on Sunday, Monday nights, Tuesday nights, Friday nights and why one Premier League match each Saturday kicks off at 12:30 (currently broadcast live on BT Sport) and another after the blackout at 5:30 (live on Sky Sports).

It’s also the reason that both the BBC and Sky have prime-time TV slots on a Saturday afternoon broadcasting a studio of football pundits all actually watching the live streams of the matches and then recounting to us mortals, who aren’t allowed to see the live action, what’s going on.

BBC football pundits on Final Score

I believe the one thing it does achieve is a substantial audience for the BBC’s Premier League highlights show, Match of the Day, and to a lesser extent the English Football League (EFL) highlights show currently on Quest.

Could it be fixed?

Of course it could. A simple change of the law to repeal this ludicrous rule would enable broadcasters to carry live football on a Saturday afternoon. Would it do what Bob Lord originally suggested and massively reduce attendance at lower league clubs? I don’t believe so, after all when lower league clubs get their matches broadcast live as part of FA Cup coverage, people still go to the games.

Perhaps we could try it as an experiment and revert if Bob Lord’s apocalyptic prediction comes true? But we’ll never know if we don’t try, because this has never been allowed in the UK – the home of football.

Perverse or what?

h1

A new type of telephone scam

November 12, 2018

My landline phone rang showing the number 0345 203040 (which I found out afterwards is Halifax’s customer service number). The lady on the phone with a strong Scottish accent said her name was Angela and that she was calling from Visa about some suspicious transactions on my bank Visa Debit card.

Would I confirm they were mine, and then they’d release them for payment? I asked how I knew she was from Visa. She said she wouldn’t ask me for any account details but didn’t give me any further verification.

She said one transaction was for £400 with Argos, and the other was £700 with Tesco. No, they weren’t mine. I wanted to find out which bank’s card this was (I have several with different banks). She wouldn’t tell me which bank, but asked me to list the banks. Which I did. She picked one and said it was that one.

She was very clever and credible. She knew my name and address. She asked what else I’d used that card for recently, if I’d put it into a cashpoint where it might have been compromised. (Possible but unlikely, I generally use it for contactless transactions). Did I actually have the card? Yes. Had it been damaged? No. What was the current balance? Hmm, I was dubious but I did tell her approximately.

Then she raised my suspicions further by saying she’d now like three pieces of security information, the first being my mobile phone number. I said I’d give her the last four digits, but she wanted the whole number. She said this was to demonstrate their security – she’d call my mobile and the number displayed would match the customer service number on the back of my debit card.

When I pointed out that it’s very easy to spoof any phone number you like on a phone call she hung up.

I presume if I’d been convinced by the phone number spoofing, she’d have gone on to ask for other details like my account number, sort code and so on.

I did call my bank afterwards who confirmed there were no such transactions, and that even in the event of a suspicious transaction on my card it would be them that contacted me, not Visa.

This is a new one on me – so watch out for Angela, or whatever name she uses next time!

h1

Black Friday – let’s leave it to the US

December 1, 2017

So it seems “Black Friday” has come and gone in the UK without it really stirring anything very much. The Daily Telegraph reports that Currys PC World in Oxford Street opened its doors especially early to let in the rampaging hoardes looking for a bargain – and there was one bloke outside who’d dropped by to pick up his pre-ordered laptop!

It’s no surprise to me. In fact I’m rather pleased that this particular US import isn’t getting much traction over here.

And nor should it.

Picture from The Sun of shoppers fighting over a flat-screen TV

The reason for “black Friday” is that this is how it was referred to by US retailers. The day in question is the Friday after Thanksgiving – which always falls on the last Thursday in November. For many of my American friends Thanksgiving, or “turkey day” as it’s colloquially known, is a much bigger family event than Christmas. The problem for US retailers was that after a day of scoffing Turkey and convivial drinking with their loved ones, most folks booked the Friday as vacation and slept in the next morning. So retailers didn’t sell very much on that particular Friday morning.

Hence it became known as “Black Friday”. Then some bright spark thought of the idea of having a discount sale, but one that ended at midday. So to get the great prices you had to get out of bed and go buy that TV, bike, carpet or whatever else, before lunchtime. I’ve been there on that day (in Boston, MA), and done it. And it’s quite fun, but a lot of people end up buying a lot of stuff they didn’t really want or need just because it was cheap, and the offer was time-limited.

That was it. And of course the UK doesn’t celebrate Thanksgiving, we didn’t have the dip in retail sales on that day, and “black Friday” meant nothing to us.

But the world’s moved on. We can now shop on the internet, so Americans can still sleep in and snap up those bargains without even getting out of bed. And, of course, anyone else in the world with an internet connection can shop from those US retailers. And, with US retailers owning UK chains (IIRC it was Asda, which is owned by WalMart, which originally introduced the concept of Black Friday to the UK some years ago) Black Friday has metamorphosed from a once-a-year, Friday-morning only sale in the USA, to a whole week of discount offers across half the globe.

I’m delighted to see that Marks & Spencer, Fat Face and several other major UK retailers are spurning the Black Friday farce – I believe they’re right when they say all it does is bring higher-price sales during December forward, and reduces the margin on them. It also encourages people to buy stuff they don’t really need. Time magazine suggests that in the US return rate of goods bought on Black Friday is significantly higher than for goods bought at other times of the year. It’s especially so for technology purchases. So the admin and restocking cost for the retailer is higher.

Please Britain, remember Thanksgiving isn’t something we celebrate, so let’s abandon this unnecessary US import.

h1

Whoops, no head-up display!

September 2, 2017

In an idle moment recently (I don’t get many of those at the moment) I was scrolling through Honest John’s car advice in the Daily Telegraph. I found this one:

This struck a chord with me, because I’ve just bought a pair of Polarised sunglasses to eliminate reflected glare from the inside of my car windscreen – which can be a major problem if the sun’s in front of me and shining directly onto the top of the dashboard.

So, some basic physics. When light is reflected off a surface, most of the light that’s vibrating parallel to the surface is reflected, while most of the light that’s vibrating at other angles is absorbed or diffused. This means the reflected light is mostly vibrating in one direction – this is what “polarised” light means. Reflections from the inside of a car windscreen will be horizontally polarised.

Polarised glasses are designed to eliminate horizontally polarised light because it’s horizontally polarised light which reflects from surfaces such as roads, puddles and lakes, tables and so on. That’s why I bought my new glasses – to eliminate the reflection from the inside of the windscreen when driving towards the sun.

Head-up displays work by projecting the display upwards so that it reflects off the inside of the windscreen – as shown above.

If you wear Polarised glasses, these will cut out any light reflected from the inside of the windscreen, however it got there, so you will not be able to see a head-up display. Reactolite glasses aren’t polarised, they just darken the lenses, so the display will still be visible.

Obvious really, Honest John!

h1

OneDrive – this idiot’s guide

September 11, 2016

Finally, I think I’ve got the idea of Microsoft OneDrive, and it works!

In principle, it’s very straightforward – OneDrive is a cloud drive, the size of which depends on how much you pay for it, but it’s at least 5GB for a free account. This then shows up as a local drive on your PC or Mac which appears in Explorer/Finder and which is synchronised with the cloud version. You can choose which folders to synchronise, or to synchronise all of them (which is the default action).

onedrive-apple

Seems pretty simple. However there are some wrinkles and it’s taken me a while to work them out.

How many Drives are One?

I don’t have just one OneDrive, I have three: one for my personal account (which is free, and therefore 5GB), one for my business account, with which I pay for Office 365. This gives me a 1TB OneDrive for Business. And finally I have one provided by the company for which I’m doing some work at the moment – I’ll call this my “client” account. I suspect this is also 1TB, but given that it’s a 400+ employee company and it’s using Office 365 (O365) with Exchange in the cloud it may well have even more online space than that.

I use three computers:

  • A MacBook Pro at my client, with O365, apps and OneDrive paid for by my client
  • A MacBook Pro at home, for my own business, with O365, OneDrive and apps paid for by my business
  • A Windows 10 PC at home – my home machine – I login to this machine with my personal Microsoft account, but I’ve installed O365 using one of the five O365 computer licenses available to my business account.

For a while I thought I had a fourth OneDrive. You see Windows 10 comes with a OneDrive app already installed, but unless you log in to one of your OneDrive accounts (at which point the icon shows a green tick on it), it works simply as a local drive, so it looks like it’s an entirely separate OneDrive from the others. However if you login, either when prompted on startup, or by right-clicking the OneDrive icon in the Taskbar (I logged into my personal OneDrive on my Windows 10 PC) then it synchronises with that OneDrive in the cloud, and what appeared to be four OneDrives now become three.

Can I access more than one OneDrive simultaneously?

So, how do I access multiple OneDrives at the same time one one computer? The answer isn’t obvious. Initially I expected I could simply add multiple connections. But it’s not that straightforward.logo_onedrive_business

The easy way is to go into one of the O365 apps (I’ll use Word as an example since it’s easy – Outlook is similar but much trickier to do) then I can add the other OneDrive accounts. I launch Word 2016. On Windows I click on the “File” menu, (no need on a Mac – the first presented view is fine). There’s an “Open” option in the left-hand menu. Click on this, and one of the options offered is “add a place” – and that’s where I connect to my other OneDrive accounts. I can click either OneDrive (to add my personal account) or OneDrive for Business (to add either or both my business or client’s account) – I enter the credentials and there are all the files. So I can open any Word documents that are stored in any of my three OneDrives.

The same works for Excel, PowerPoint, and (with a bit of rooting around in the menus) Outlook 2016. In Outlook you’re looking for the “Office Account” menu option under “File” rather than “Open” which tries to open another email account.

This all works beautifully if the only documents I want to use are Microsoft files. So I can browse all three OneDrives looking for Word documents in Word, or spreadsheets in Excel. But I also use some other apps, specifically Adobe Photoshop, Acrobat and InDesign. All my Adobe documents are stored on my client’s OneDrive for Business. How do I access them from home so I can work on them remotely? Or do I have to give in and use Adobe’s document cloud for my Adobe documents, and Apple’s iCloud for my Apple files? Or do I abandon all of these entirely and use a third-party cloud such as Google or Amazon?

All computers are equal, but PCs are more equal than Macs

The answer is you can do it on a PC, but I haven’t found any way of doing this on a Mac.

On my PC if I go to the Task Bar (conventionally bottom right) and right click on the OneDrive icon, and click “settings” I’m presented with a bunch of tabs. If I click the “Account” tab then there’s an option to “Add an Account” – by selecting this and logging in with another OneDrive set of credentials I can create a second OneDrive on the PC – in my case for my business drive. Et voilá – I can now access all the files on that OneDrive, not just the Microsoft ones.

After working this section out for myself, I found a useful Microsoft Support article that covers this.

Repeat for all other OneDrive accounts and you have access to all your files on a Microsoft OneDrive, whichever it is.

[On a Mac you can download the Microsoft OneDrive App from the App Store. But it appears that you can connect it only to one OneDrive. If I find a way of connecting the MacOS version of OneDrive to more than one OneDrive account, I’ll update the post.]

Update: I’ve worked out how to do this on a Mac. In Finder, right click on the OneDrive icon on the menu bar and click Preferences. Then select the Account tab and click on “Add an Account” – login with your other OneDrive account credentials, and away you go! Simple (well it is when I stop trying to look for a OneDrive menu bar and use Finder instead – doh!)

But the iPad version is the best

Trivial. Download OneDrive for iPad from the App store. Log in with one of your OneDrive/Office365/MicrosoftLive accounts. In the top left corner you’ll see a little icon of a person. Click, select “Add account” and log in with another, and another.

If you’ve already downloaded (and activated) your O365 apps on the iPad then it all just works. Seamlessly. Why isn’t the Mac version this easy?

h1

Sort out passports, UKBA, for the country’s sake

April 28, 2012

The news today is full of reports of 2-hour queues at Heathrow to get passports inspected.

I remember the halcyon days of international travel, back in the 1990s, when getting back into the UK after a trip abroad was a breeze. You stood in line for a few moments with a queue of maybe 10 or 12 people ahead of you. The passport official (now the UK Border Agency of course) took a cursory glance at your passport and you were in.

Back in the halcyon days of travel only getting into the United States was tricky and time consuming. Today getting back into the UK, Read the rest of this entry ?