Monday, January 17, 2011

Trading Liberty For Security

Ben Franklin notwithstanding*, you can sometimes find an acceptable trade-off between liberty and security. A friend just had her Twitter account hacked and used for spam, an occurrence I've seen increasingly frequently over the last year. So, just a suggestion, but if you're the sort of person who has chosen an easy-to-remember password and used it on multiple sites... just stop. Now.

Look, I know it's not easy. A year ago, I was as guilty as you, but I have since repented my sins. I made a New Years Resolution last year was to secure my online presence. It took the better part of a year to do it, but by mid-December I was glad I had. Otherwise, whomever hacked Gawker Media would have potentially had access to my accounts on Facebook, Twitter, Tumblr and a host of other social networking and blogging sites. My financial data would have been safe, as I kept a second password for all of that, but just imagine what could happen if that password had been compromised.

The secret to creating a secure password is to find one that satisfies three criteria: it needs to be strong, memorable and unique. Strength in this case is measured in terms of it's resistance to combinatory attacks; the less likely you are to have chosen a particular sequence of characters, the stronger it is. Memorability prevents you from needing to store passwords insecurely or request frequent resets. Uniqueness guarantees that when (not if) one site is compromised, others will remain secure.

The easiest way to choose a strong password is to choose a combination of upper- and lower-case letters that do not make up recognizable words, then throw in a bit of random punctuation and a few numbers. Of course, choosing a password by banging on keys would sacrifice memorability, and while you might be able to remember one arbitrary string of characters it would be impossible to keep your passwords unique for multiple sites.

The trick I used to balance the three competing goals was to use a pattern to generate passwords that were strong, memorable and unique. The method I use is based on a suggestion I read in this Lifehacker article, but if you really want to geek out you should read this post by Hans Anderson. I may eventually upgrade to a more complicated pattern, but for the moment anything is better than my previous two-password system.

As long as you're updating all your passwords anyway, might I suggest upgrading your password vault as well? Almost everyone saves passwords in their browsers these days, which is fine insofar as it goes. The assumption is that if your computer is lost or stolen, you'll need to change all your passwords anyway (and most likely all your financial data, maybe even your SSN just to be safe). However, once you find yourself storing them in your work computer, your girlfriend's computer, your laptop... well, obviously the risks multiply. While I was updating my passwords, I began storing them at a site called LastPass**. Having a secure online password vault would be useful enough, but its the browser plug-ins that really sold me. It's the closest thing I've found to single sign-on for the internet. If you're the sort of person that worries about rogue corporations selling your passwords to the highest bidder or whatever, I'm told that Keepass offers an open-source alternative, but I'm too cynical to follow politics these days so I'm more familiar with the one with the prettiest user interface.

So that's it, my whole secret to a more secure life. Use it when you sign up for new sites, spend an hour a night for a few weeks updating your existing passwords, go forth and sin no more. I know the whole thing seems like a pain in the ass now, but I bet you'll feel pretty stupid when all your Facebook friends start getting porn spam from you.***

* Actually, Franklin opposed trading liberty for "temporary safety", but then what other kind is there?
** Thanks for the recommendation if you're reading this, Adrienne ;)
*** Note that these suggestions do not necessarily apply to those who already use their Facebook account to send porn spam.

Tuesday, May 8, 2007

Google Case File IOT03 :: New Reminders

This totally rocks. I live my life by reminders from Google Calendar and Remember The Milk. RTM had all the advantages in this regard, giving me options for email, mobile and a half-dozen chat options for reminders. But GCal is catching up... check it out:

Options for reminders are only email and pop-up right now, but as soon as GTalk is on that drop-down I'm a happy camper. And if they would ever give me options for reminders beyond one week I would be eternally grateful. Can you hear me Google?

[This Just In: I'm always the last to the party. This is what I get for falling days behind on my feeds.]

Tuesday, January 9, 2007

The Coolest Thing Ever :: Twitter
A Little Bird Told Me...

One of the best things about living in the mid-west is that it is so incredibly simple to stay on the bleeding edge of technology. The hard part is often dragging a bunch of friends with me so that I'm not lonely out there. Of course, then I suddenly have more friends on MyFriendDegrees than in real life, and its no longer the edge, let alone bleeding.

But I digress.

My point is that St. Louis is a great place to be a lazy trend-setter. All you have to do is read some press from the Coasts, check in with Chicago people every once in a while, and keep a vague eye on what's cool in London and Berlin. Then hit the bong a couple dozen times and forget all that. Follow this by siting on your ass for six months until you feel like just can't avoid work any longer, and then hope the URL suddenly springs unbidden into your consciousness.

This is approximately the story of how I started using Twitter last weekend. All the tech-toy cool kids out on the Left Coast have been using it for months, talking about how it makes them feel connected even when they can't see friends for months at a time. My initial reaction was envy; I often wish I could not see my friends for months at a time. I even spared a moment of jealousy for the bong hits those hippies must have been doing.

The Master Plan behind Twitter is to give your friends, associates, digital stalkers and illicit love interests an easy way to keep up with what you're doing. At first glance it seemed like it would have to be a huge pain in the ass in both directions. First, who the hell would bother to keep it updated. Second, who's going to remember to check some website to find out what I'm doing.

Of course, since then I've started spending more time on the whole "Blogging in my Blog cuz I'm a Blogger" thing. I've also managed to reduce most of my inter-personal communications to one or two line text messages, often accompanied by an emoticon*. And I've been told that my best artistic endeavors are often found in my status message on Google Talk.

Anyway, it turns out that the whole thing is much more zero-interface than I would have thought. Of course, there's the web view, which is very much boring-in-a-good-way but has been primary useful as only when telling someone about the site, or blogging about it. The ideal way to use Twitter is via text. You can send in updates, check on your friends, and even nudge others to update either by SMS (text message) or IM (chat). You can also have Twitter send you notifications of your friends' updates by either of those methods, although I don't recommend the SMS notifications if you're paying for text messages.

When I created my account last weekend, I registered both my phone and my Google Talk account and the whole process took about five minutes. The longest part was waiting for Google Talk to catch up after I added twitter@twitter.com. Since then, whenever I'm bored, I've been updating it with whatever I'm doing, thinking about, or banging my head against. I've set my notifications to come in via IM as well, so I see my friends' updates in the same window. If I get busy and don't want to be bothered, sending the text off turns off notifications. After that, I can either get recent updates from friends with get or get username or just turn notifications back on. Oh, and if I'm wondering what someone is doing, nudge username will prod them into action (sometimes, depending on the person).

Of course, the same should work with any chat client, but if you're not into IM the any phone with SMS capability will do. I'd probably leave notifications off quite a bit more often if I was doing it that way, and (particularly if I had to pay for text messages - poor L-a) I might update once or twice a day at most. Still, if that were my case I think I might value it more in some ways, since I'd have less chance to just talk for entertainment purposes.

My advise? Go sign up, check it out for a few days. The process is brief and, although you are giving up email, IM and cell phone. I'm not worried, as I expect the privacy policy to hold given the pedigree of the founders, Obvious Corp, who also created Odeo and (most recently) Hellodeo.

Oh, and when you do, hit my page and click the Add Oliver Wendell Jones button on the left. You may even be able to just Add Me To Twitter with this link, once you're signed up. Then let me know at owenj23-at-gmail-dot-com, in case I don't notice right away. I haven't found enough people on there yet to really be sure how the friend notifications work; that's why I need my loyal readers to help me learn. Let me know if anyone is trying and has trouble; I started to take some screenshots to write a step-by-step, but it seemed intuitive enough to me that I didn't complete the effort.

*While this isn't quite true, I do sometimes go in another room so I can argue with The Brat via GTalk. Trust me, it's easier that way.

Monday, January 8, 2007

Google Case File IOT02: Case of the Unread Items

As I've mentioned before, one of the reasons I drank the Google Kool-Aid a long time ago is that they have some of the only software so complex that it regularly exhibits behavior that I simply can't explain. I have this pet theory (or maybe I read it somewhere) that Google has developed into the first networked intelligence. I know more, but fear Blogger would only delete my post if I were to publish it.

But I digress.

For today, let's just take the case of my Topher's linkblog. Topher has been following my linkblog for a while now; frequently I convince him to try a service shortly after I declare it The Coolest Thing Ever, and Google Reader was not a hard sell after it's incredible upgrades last year. Of course, as soon as I set him up I subscribed to his Shared Items feed, but for a while he didn't use them much. Recently however, he decided to emulate my for- tags and share a for-me feed (no, I'm not linking to that... god only knows what that boy might send me). That's when things got weird.

It seems that two items in his shared feed and one in his for-me feed just refused to become unread in my Google Reader. Eventually we traced the for-me item down to an old post regarding a Mythbusters bloopers reel on Youtube [Ed Note: can't find the link right now, ironically -- Topher?], and once he removed it my Reader returned to normal for that feed. The Shared Items problem was more recalcitrant, however, and even GReader admitted there was a problem:

Now obviously this is not particularly a usability issue, at least not for me. It does however trigger my OCDUI tendencies, which made me investigate further. It seem that if I go to the home screen, It will actually show me the two "unread" items:

Funny thing is, these are both links I'd seen before, on feeds that I read, and I'm pretty sure that I shared one or both of them. Not that I can find them now, of course; as has been lamented in nearly every forum on Earth, the lack of search in GReader is deplorable. And while the Google Co-op Hack and ensuing Greasemonkey script are cool, they don't really excuse it. I really have to think that some company out there must have the necessary technology to index large amounts of text for quick searching by many users at a time. If only Google could partner with them...

Anyway, it seems likely that once I tell Topher what items are bugging the system, [Ed Note: it's the XKCD Katamari comic and the Lifehacker DIY Warhol, if you're curious.] he'll be able to remove them fairly easily. Which still raises the question, where and how did the wires get crossed?

I suppose I'm pretty unlikely to find out, and knowing Google the entire issue will completely disappear with absolutely no warning nor fanfare by about half past whenever. Still, it's curious. Is anyone else using Google Reader to subscribe to Topher's Shared Items? Do you see the same behavior. Let me know...

[Another Ed. Note: Special thanks to CyberWare, which pointed me to FastStone Capture for the screenshots above. Beautiful piece of software. Installed in about 60 seconds, worked immediately, almost zero-interface and it sits in the system tray when I don't want it. Oh yeah, and it's free.]

Tuesday, January 2, 2007

Project Description: Blogroll Widget

I've been wanting to build one of them thar Web 2.0 Widget Thingamabobs for a while now. The problem, of course, is that almost everything has been done. Not always to my specifications, of course, but often close enough to let the laziness factor kick in. However, I have yet to find a Blogroll Widget of any sort that will satisfy my theoretical use case, and it seems like it should be easy enough to design.

Here's my plan: I'd like to auto-generate the blogroll by querying my del.icio.us account, perhaps for the tags iot+blogroll for this blog or cas+blogroll for Cheating At Solitaire, my poker blog. From what I understand, having not yet looked at the API, this should be a trivial implementation. However, I'd like to go a step further, adding the ability to add meta-data such as feed or author links. I think this could be accomplished by embedding formatted text in the description field, although that may violate a TOS or something. A preferable method would involve tagging additional links with the same title and iot+blogroll+feed, for example. I'm not sure if their querying structure will support that, however.

It seems to me to using del.icio.us as a back end for this sort of thing would allow the ability to insert one of those little buttons on your page that would allow others to automatically add you to their blogrolls. You could even add such a thing directly to your feeds, if you use a service such as Feedburner. Obviously, the real Web 2.0 way to do this would be to announce a startup called iBlogRoll.com or MyBlogBuddies or something and then try to get VC funding prior to actually writing a line of code. And of course, I may still do that... hmm, wonder if someone has already snapped up those domains?

Anyway, I'm not sure if or when I'll get time to work on this, but I thought it might be a good idea to get the project notes down while I'm still high and think that I can accomplish something. Later, once I realize that I'm nearly completely useless, I'll feel properly embarrassed about posting this I'm sure.

Wednesday, December 27, 2006

Fast Firefox Fix Found

It's no secret that Firefox is a memory-leak hydra: every time the development team fixes one, two more spring up to take it's place. Build a large enough application and you're guaranteed to drop a few pointers here and there, and once you add in a Javascript engine, Chrome interfaces and a half-dozen or more extensions you might as well throw in the towel on your leak analyzer. This is the one area that Internet Explorer will always surpass Firefox. When you package most of your functionality as an integral part of the OS, your memory leaks are either found quickly or so deeply buried that you'd have to move Jimmy Hoffa to find them.

On the other hand, Microsoft Visual Studio 2005 leaks like a sieve, but it's the most helpful development environment I've ever seen. Perhaps memory leaks are found due to usefulness the way security flaws stem from popularity. That theory would conveniently explain the balance of bugs in Microsoft's OS code. But I digress.

There are some people (whose initials may be BMW) that will tell you that the best solution for this problem is to never install Firefox on a Microsoft OS. These are usually the same sort of people who still prefer vi to a text editor. Personally I'm not one to give up functionality for the sake of form, but what can a resource-constrained power-surfer do?

Well, the traditional method of freeing up resources lost to a leak is to restart the application. Back in the old days (like, three months ago) this was a major pain, involving bookmarking or finishing any open tabs, logging in to sites again and losing any form data that you might have entered on any open pages. Of course, there were extensions to fix any of those problems, but often they were a cause of the very problems you were trying to fix.

Thankfully, Firefox 2 fixed all that. I don't even want to know that you haven't updated yet, just go do it now. I'll wait. Anyway, Firefox 2 includes a crash recovery mode that can restore your entire session, usually without reloading the pages. Of course, this doesn't happen when you voluntarily close the browser, but you can see it in action when you install an extension. In fact, I suggest you check it out right now. Go install the Restarter extension from from the add-ons site. Once you've clicked the Install button (after the standard five-second penance), the Extension Manager will open to show the progress. Installing this tiny extension will probably take less time than the install delay. Once it's done, notice the Restart button? Click it. Go ahead, I'm patient.

That served two purposes. First, you have now seen the session restore function at work. Until now, the only way to trigger that as a user was after installing an extension. However, the tiny little extension that you just installed added an item to your File menu. At the bottom, just above Exit, there is now a Restart Firefox option. This will do exactly what the Restart button just did for you, so you can try this whenever the browser seems to have gotten bloated and slow.

This is far more convenient than a restart used to be, and it is guaranteed to free up any leaked memory, but it's still not always convenient. It's like rebooting the computer, almost guaranteed to fix the problem but sometimes like chasing a fly with a baseball bat. However, I found a potentially more useful tweak today in a post on Cybernet, which I found via Lifehacker's Best of April 2006. Here's what to do:
  1. Highlight the words config.trim_on_minimize and copy them to the clipboard.
  2. Open a new tab and type about:config in the address bar. This will display a page of Firefox's internal configuration values.
  3. Right-click anywhere on the page and select New -> Boolean from the context menu.
  4. Paste the copied text from above into the input box that appears and hit enter. Yes, you can type it if you'd prefer, I just found cut-and-paste more convenient.
  5. Select true as the value and click the OK button, then go to the File menu and click that new Restart Firefox option we just added.
So what did this accomplish? Well, now Firefox will unload most of itself from memory each time you minimize it. In my experiments, it went down to between 7M and 8M, from it's average of 40M to 50M (too many extensions loaded). Your results may (and probably will) vary, but from what I've been able to determine, at least some leaked memory is regained after you maximize the application. At the very least, you can free up a big chunk of system resources while you're doing something else without having to close the browser. This is a must for any serial tab abuser like myself, as well as anyone running on an ancient and/or overloaded system. I'm looking at you, Kare-Bear... just follow the instructions, you'll thank me later.

Thursday, December 7, 2006

Google Feeds My Neuroses

[Ed Note: Just another post that felt isolated and alone back in the old one-blog days.]

Just a random bit of Google weirdness that left me wondering who exactly was getting high last night.

Results of Google search for flickr+feed+viewer (Wednesday 2006-12-06 c.11:00pm CST)
How did this patent application become the top result?

This is the patent application in question. It does not contains 'flickr', 'feed' or 'viewer'.
The URL is a doozy, you'll have to scroll to see it all.

Results of Google search for flickr+feed+viewer (Wednesday 2006-12-07 c.11:00pm CST).
The next day it's gone. But...

While this is on 'flickr' and it does have a 'feed', still no 'viewer'. And not exactly relevant either.

I'm not sure why this sort of thing fascinates/annoys me so greatly. Some part of my brain wants more weird data points like this, thinking that if it had enough outliers I would understand Google's algorithm or something. Of course, if I could correlate that many data points I probably wouldn't need a search engine as much.

Then again, this could be an artifact of someone gaming the algorithm. Maybe some private Google-bomb or black-hat SEO is trying to screw with the search term Flickr? Or maybe Google is messing with the term internally now that Yahoo owns them.

I need to find the Google-equivalent of Fox Mulder to investigate this for me. Anyone have any wild theories?