Why Use Tor?

So why should you use Tor?
That’s a good question.  First, you need to know what Tor does.  I find that simple descriptions are often the best.  So here is my simple version of what Tor is: Tor is a means of tunneling specific messages (i.e., traffic) through an anonymous (and reasonably secure) network.  Wikipedia describes it here.
Many people look at Tor and ask why is such a thing needed?  Their questions presuppose that they trust the networks that they communicate across.  Most folks think Tor is just for copyright violators, organized criminals or other unsavory netizens.  But that is both too simplistic and too trusting.  Tor is for anyone who needs to ensure that their communications across the network remain anonymous and/or secured.
Let’s consider a real-world example.  There are many nations that do not allow for the Bible to even be carried .  Further, many countries routinely persecute and prosecute people that publicly proclaim the gospel of Jesus Christ.  But the gospel cannot be silenced by mere mortals.  There are men and women who have always been willing to share the Word of God regardless of the cost to themselves.
And throughout the world, tyrannical governments seek to squelch opposition by monitoring the communications of their citizens.  Indeed, you could easily argue that the majority of people in the world are being “watched” by the very governments that should defend their liberties.
Like the early Christians in ancient Rome, there will always be those who stand for truth and justice rather than simply obey corrupt civil authorities.  And in these nations, tools that help maintain the anonymity of persecuted citizens are very important tools indeed.
If you don’t believe that this was true for our nation, then ask yourself why so many of our founding fathers used pseudonyms for their writings.  Indeed, even the authors of the Federalist papers used pseudonyms – although not just for the sake of anonymity.
-Roo

Add to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

Not So Seamless – But Oh, So Delicious

Sometimes, you have way too many balls in the air.  I saw the shiny bauble (Tor on my Droid 2) and I had to chase it.  Here is what happened:

  1. I tried to download the tool from the Tor site.  That proved fruitless.  I was connected via 802.11 to my home network.  And my home network has content filtering through a third-party.  And this site was blocked.
  2. Consequently, I had to disconnect from the home network and connect via the 3G network.  The download still had some problems.
  3. So I downloaded to my PC and connected up the USB cable.  From there, I moved and launched the package installer.  The installer did it’s job and Tor was on my phone.
  4. Too bad I couldn’t connect to the Tor network.  I tried the default test site from my Android browser and was greeted with the fact that my browser wasn’t using Tor.  That made some sense as I hadn’t pointed my browser to a local proxy that was configured to use the Tor connection.  Since Orbot uses Privoxy, I had the proxy.  I just had to configure the browser to use the proxy.
  5. Unfortunately, changing the proxy on the default Android browser is not as easy as you might think.  There are plenty of articles about how to update the settings if you have rooted your phone; I have not as I want to see what an average user can do with their phone.  But most articles also said that you could use adb to update the settings.
  6. I went ahead and tried to use adb.  But I had some issues getting adb to work from my PC to my Android phone.  The basic trouble is that I had already change my SDK to support Gingerbread.  And adb was moved in the new SDK to the platform-tools directory.  That one was easy to fix: I just had to change my PATH to include the new directory.
  7. The next attempt was also unsuccessful; I had authorization problems.   Rather than keep stumbling, I turned to “off-the-shelf” solutions to update the proxy setting.
  8. Fortunately, there are plenty of tools in the Android Market to change the proxy settings.  Once I downloaded one of them, I changed my browser’s proxy settings and retried the test that comes within Orbot.  The results of that test are found in the image above.

I’m not done with my tests.  But I am encouraged that I can now encapsulate everything from within a Tor tunnel.  More to follow…
-Roo

Add to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

It’s About Time – In So Many Ways

This week was quite surreal.  I’ve spent almost thirty-five years working with computers.  [Note: That includes a few years as a teenager.]  I’ve built computers from scratch.  I’ve held practically every job you can imagine in the software industry.  But I have never been officially certified in anything.  So I’ve been confronted with one of my own personal boogeymen: I must take a test that I must pass in order to keep my job.  What’s up with that?

I have chaffed at the utter indignity of it all.  And I’ve been more than a little bit apprehensive about the upcoming test.  [Note: I’m taking my test on December 27th.  So I would really appreciate your prayers.]  And I’ve also laughed at the ridiculousness of such tests.  As a senior leader, I recognize the importance of such things.  And as an individual contributor, I recognize the fact that such tests are really poor predictors of performance. But as a man called by God to set an example, I must set any and all of these other considerations aside.  I must prepare as if I were doing this for the Lord – as indeed, I am.  And I must demonstrate my faith with my gentle attitude.   So I am soldiering on.

So after a long week of staring at LCD monitors, I was so glad to get home and just relax. Of course, that didn’t happen.  Things have just kinda stacked up at home.  So I finally got some time to attend to some overdue items.

I finally got my revised taxes submitted to my state’s department of revenue. This is always arduous, frustrating and altogether soul-rending.  But I just needed to set aside a few hours to pull all the pieces together.  Hopefully, the state will understand what I have submitted.  But if they don’t, this will take a whole lot more time to iron out.  But I’ve taken the first few steps in the journey.  So I have a smile on my face.

I also had to assemble all of my ‘dependent’ verification documents for my employer.  BTW, I’ve never had to provide so much data before.  I had to get birth certificates for everyone.  I even had to find my marriage certificate. Unfortunately, the marriage certificate was in a safety deposit box at a bank that I haven’t visited for over twenty year.  Neither Cindy nor I could find the keys for the safety deposit box.  So after paying to have the lock drilled out, we retrieved our marriage certificate.  And we bought a fire box so that we could securely store all of these documents in the house.  As of now, all of the older and newer documents that need to be protected against calamity are now safety tucked away in a hiding place that can survive fires or tornadoes.  With this done, I got all of the ‘dependent’ information bundled together and sent to my employer.

In addition to this, I’ve finally finished all of the retirement consolidations that I’ve been doing over the last few months.  It’s nice to have all of the administration in one place.  And it is good to have my retirement savings properly invested in a diverse number of well-managed funds.  I can’t wait to do my next quarterly review in order to see how well (or poorly) we’ve done with my new plans.  I certainly can’t do any worse than I did when almost everything was vested in (and through) only one corporation.

But these things aren’t what prompted me to write this post.  Yes, all of these things were woefully overdue.  But this morning, I got a chance to ‘geek out’ – just a little.  My classes have focused on information security.  And I have always been an idiot-savant in this area.  I’ve never had any formal training in the subject – even though I was a senior security engineer about twenty-five years ago.  I’ve always learned by doing.  And I have a passing familiarity with the subject.  [Note: If you don’t believe that last statement, just read some of my posts over the years.  You’ll see that I am wholly entranced by security and privacy matters.]

With the purchase of my Android phone, I’ve had to confront a whole lot of privacy issues.  I use my phone to securely connect to my home computers.  To do this, I tunnel VNC through SSH.  I also store some fairly important documents on my phone.  So I use Truecrypt (on my PC) to create and store a secure backup of a small number of important files.

But I’ve always had to encrypt the data myself.  Or I’ve had to use other tools on my phone and/or PC.  Basically, all of these tools were file-oriented solutions.  At the same time, there were very few options to securely encrypt streams of data between the phone and other computers.  Yes, I could use https to build a secure tunnel to the site I was interacting with.  But if I wanted to secure all traffic, I was out of luck – until now.

The folks at the Tor project have released an Android tool named Orbot.  I had a little trouble downloading the tool OTA.  But I finally got it by transferring the package to my SD card.  Over the next few days, I’ll be testing this tool to see how it works.  I am pretty darned psyched that this tool is now available – and it’s about time that phones could participate on the Tor network.

-Roo

Add to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

It's About Time – In So Many Ways

This week was quite surreal.  I’ve spent almost thirty-five years working with computers.  [Note: That includes a few years as a teenager.]  I’ve built computers from scratch.  I’ve held practically every job you can imagine in the software industry.  But I have never been officially certified in anything.  So I’ve been confronted with one of my own personal boogeymen: I must take a test that I must pass in order to keep my job.  What’s up with that?
I have chaffed at the utter indignity of it all.  And I’ve been more than a little bit apprehensive about the upcoming test.  [Note: I’m taking my test on December 27th.  So I would really appreciate your prayers.]  And I’ve also laughed at the ridiculousness of such tests.  As a senior leader, I recognize the importance of such things.  And as an individual contributor, I recognize the fact that such tests are really poor predictors of performance. But as a man called by God to set an example, I must set any and all of these other considerations aside.  I must prepare as if I were doing this for the Lord – as indeed, I am.  And I must demonstrate my faith with my gentle attitude.   So I am soldiering on.
So after a long week of staring at LCD monitors, I was so glad to get home and just relax. Of course, that didn’t happen.  Things have just kinda stacked up at home.  So I finally got some time to attend to some overdue items.
I finally got my revised taxes submitted to my state’s department of revenue. This is always arduous, frustrating and altogether soul-rending.  But I just needed to set aside a few hours to pull all the pieces together.  Hopefully, the state will understand what I have submitted.  But if they don’t, this will take a whole lot more time to iron out.  But I’ve taken the first few steps in the journey.  So I have a smile on my face.
I also had to assemble all of my ‘dependent’ verification documents for my employer.  BTW, I’ve never had to provide so much data before.  I had to get birth certificates for everyone.  I even had to find my marriage certificate. Unfortunately, the marriage certificate was in a safety deposit box at a bank that I haven’t visited for over twenty year.  Neither Cindy nor I could find the keys for the safety deposit box.  So after paying to have the lock drilled out, we retrieved our marriage certificate.  And we bought a fire box so that we could securely store all of these documents in the house.  As of now, all of the older and newer documents that need to be protected against calamity are now safety tucked away in a hiding place that can survive fires or tornadoes.  With this done, I got all of the ‘dependent’ information bundled together and sent to my employer.
In addition to this, I’ve finally finished all of the retirement consolidations that I’ve been doing over the last few months.  It’s nice to have all of the administration in one place.  And it is good to have my retirement savings properly invested in a diverse number of well-managed funds.  I can’t wait to do my next quarterly review in order to see how well (or poorly) we’ve done with my new plans.  I certainly can’t do any worse than I did when almost everything was vested in (and through) only one corporation.
But these things aren’t what prompted me to write this post.  Yes, all of these things were woefully overdue.  But this morning, I got a chance to ‘geek out’ – just a little.  My classes have focused on information security.  And I have always been an idiot-savant in this area.  I’ve never had any formal training in the subject – even though I was a senior security engineer about twenty-five years ago.  I’ve always learned by doing.  And I have a passing familiarity with the subject.  [Note: If you don’t believe that last statement, just read some of my posts over the years.  You’ll see that I am wholly entranced by security and privacy matters.]
With the purchase of my Android phone, I’ve had to confront a whole lot of privacy issues.  I use my phone to securely connect to my home computers.  To do this, I tunnel VNC through SSH.  I also store some fairly important documents on my phone.  So I use Truecrypt (on my PC) to create and store a secure backup of a small number of important files.
But I’ve always had to encrypt the data myself.  Or I’ve had to use other tools on my phone and/or PC.  Basically, all of these tools were file-oriented solutions.  At the same time, there were very few options to securely encrypt streams of data between the phone and other computers.  Yes, I could use https to build a secure tunnel to the site I was interacting with.  But if I wanted to secure all traffic, I was out of luck – until now.
The folks at the Tor project have released an Android tool named Orbot.  I had a little trouble downloading the tool OTA.  But I finally got it by transferring the package to my SD card.  Over the next few days, I’ll be testing this tool to see how it works.  I am pretty darned psyched that this tool is now available – and it’s about time that phones could participate on the Tor network.

-Roo

Add to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

Still Prideful After All These Years

Consider it pure joy, my brothers, whenever you face trials of many kinds, because you know that the testing of your faith develops perseverance. Perseverance must finish its work so that you may be mature and complete, not lacking anything.
James 1:2-4

It has been twenty-seven years since I took my last timed exam.  Since then, I’ve never had to get certified for a job that I have.  That is ending with my current job.  There are a couple of professional certifications that I need in order to meet some customer requirements.  So I and my team must all get a minimum set of certs in order to continue on the contract.
Consequently, I am in class this week.  I am taking five days of preparation before I take the test.  But I have had a really poor attitude throughout the class.  Don’t get me wrong.  I’ve paid attention.  I’ve engaged with the teacher and the class.  And I’ve tried to be light-hearted throughout the class.  But I have maintained an attitude of entitlement.  I was confident that my years of experience were all that was needed to meet this challenge.
In my personal arrogance, I decided to take a practice test after only two days of class (and no studying).  I had a few technical problems with the test (e.g., two questions didn’t even show up due to what appeared to be problems with an ActiveX control).  And I was interrupted during the practice exam when someone wanted to pull me off my test station (during a timed test) in order to discuss testing strategies for our group.  So I had a couple of strikes against me.  Technical difficulties + testing interruptions + incomplete class work (i.e., only 40% complete) + an attitude of entitlement = C+ on the exam.
One of my team members (who is a dear brother in Christ and a member of our Bible study group) told me that I should be happy with the score as it showed that I was on track.  [BTW, Bob didn’t do quite as well as I had done on the practice test.] Rather than be grateful [or help Bob find solace and focus for his journey], I just sulked in my own disappointment.  I was convinced that I could get a B+/A- without even going over the material.  I was in good shape but I had convinced myself that I should have done much better.  Rather than misinterpret the results and act small, I should have helped to buoy Bob’s spirits.  Instead, I lost the opportunity to lead.  Bob, I am so sorry.  Please forgive me for my selfishness.  And thank you so much for your positive heart.
When I got home, I was in a very sour mood.  Cindy and Dana went to the gym while I fumbled around and felt sorry for myself.  Fortunately, God reminded me that the best rmemdy to missing the mark is to try again with the right attitude.  So I gathered together my materials and assessed my “off the mark” assessment.  Actually, I had done rather well.  No, I didn’t meet my own selfish and prideful needs.  But I’m glad that I didn’t.  If I had scored higher, I am sure that I wouldn’t be paying attention for the next three days.  And I am sure that I wouldn’t prepare before the test.  And after reviewing my missed questions, I could easily see that the difference between achieving my goal and failing my goal was the sections of the material that we had not yet gone over in class.  Had I known the terms from those sections, I would have met my expectations.
After a few hours of stewing, I finally relaxed my jaw and let go of the bone that I was chewing.  And I let God speak to me.  His words were gentle – but firm.  Who are you?  Why do you think you “deserve” to be “top dog” amongst your peers?  Why aren’t you happy with knowing that you are almost ready?  And why are you chaffing under the authority system where I have placed you?
I was stunned and humbled by God’s directness.  And I thank Him for it.  These reminders will cause the following reactions: 1) I will focus during the remaining classes, 2) I will be excited to learn new terms and techniques, 3) I will take many more practice tests, 4) I will greedily embrace all of the test aids that I can find, and 5) I will have the right attitude about this venture.  I must remember that I am at this job for a few reasons: a) to provide for my family, b) to be a leader amongst my younger colleagues.  Lord, please help me be an attitude leader as well as a skills leader!
-Roo

Add to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

DoubleTwist = Android Sync + Markets


A few years ago, a fellow named Jon Johansen (aka, DVD Jon) exploded onto the scene with some really cool technology: he released DeCSS as a means to “liberate” DVD films from onerous copy protection.  I don’t want to go through the legal and moral arguments that his actions provoked.  But later, he became more legit when he helped to form DoubleTwist.
When DoubleTwist first hit the market, it was a means of decrypting iTunes music files for use by other applications on your PC.  This meant that it was a very speculative venture.  First, it was taking aim at folks who were ostensibly “protecting” musicians and their copyrighted works.  Second, the folks who needed decrypted versions of music (on their desktops) were a limited community: most of them were using songs that they had purchased as input to other programs (e.g., DVD authoring tools, etc).  So while I tried the product, I decided to buy music from Amazon instead.  So until recently, DoubleTwist was cool – but not very useful for me.
But Jon & Co. have finally pulled together a more expansive reason for DoubleTwist: syncing media with Android devices.  DoubleTwist is now a free product that can sync any (or all) of your iTunes files with your Android device.  The product is free to use.  So DoubleTwist is making its money in a different way – it is now a distribution channel and an advertising platform.  For those that have an Android device, you can buy apps from within DoubleTwist.  And you can also buy music and movies from Amazon through the DoubleTwist tool.
So the way that you can legitimize a hacking tool (that decrypts protected media) is to become a media intermediary.  I am sure that DoubleTwist is giving the media “market” owners a “cut” of their business.  That way, a previously offensive technology is now legitimized.
But is it a good tool?  After a few hours of playing with the tool, I am thrilled to have a free tool like this.  Yes, you can buy tools to sync with Android phones.  But I am happy to recommend this tool.  It syncs the music I want to sync.  It scrobbles to Last.fm.  It allows you to set songs as ringtones.  It also downloads and displays album art with ease.  After a few more weeks, I may revise and extend the recommendation.  But for now, I give DoubleTwist a qualified “thumbs up” on the Roo-meter.
-Roo

Add to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

What Does Your Wife Think About Wardriving?

For those who have read my blog for any amount of time, you already know that I am oddly fascinated with security.  Am I a certified information security professional?  No, I am not – at least, not yet.  Nevertheless, I have been fascinated by both the techniques and the ethics of hackers.
And that fascination is nothing new.  I installed my first WiFi access point last century.  And I have had WiFi access within my home ever since.  I did my first “war-walking” through my neighborhood in 2002.  Then, I had a laptop an a PCMCIA card.  And it was fun to know just how few of my neighbors had installed WiFi into their houses.  Those that had taken the plunge were woefully under-secured.
But things sure have changed in the last decade.  Now, over half of my neighbors also have WiFi.  And more importantly, most have some form of security on their networks.  At the same time, the tools I use have also changed.  I now have a Droid 2 phone.  And I am using tools like Wardrive and Wigle Wifi.
I have done two simple “wardriving” runs since I got my Droid 2.  The first was on a car drive coming home from work.  The second was on a bike ride to work.  What fascinated me was just how many access points I found within such a small area.  And more startling was the fact that I had found a thousand “new” access points and networks.  [Note: “New” means that wigle.net did not have a record of this device at the specific GPS coordinates that I provided.]
After a very long day yesterday, I decided not to ride my bike home.  I just didn’t have the heart to fight traffic after eleven hours at work.  So I rode home with my wife.  And I talked to her about my day.  When I told her that I had done some wardriving, she was appalled.
As a geek, I was perplexed by her response.  When I was riding my bike and collecting data, I was just inventorying the packets that were available from the street.  And I was not even trying to probe the defenses of these networks.  I was just cataloging the packets that my phone collected as I rode by.  Nevertheless, my wife thought that I was doing something nefarious.  I bristled at her “lack of understanding” of the simple and innocuous inventory I had collected.
But after several hours of thinking about her comments, I think I can understand her objection.  Most of the people that have WiFi access points have no idea about computer security, licensed and unlicensed RF spectrum, existing law (in the form of local, state and federal statutes) or even the curiosity of hackers.  What these users are doing is simple: they are using their home systems to perform simple tasks.  And they are expecting a certain degree of privacy – even if they are doing the equivalent of electromagnetically shouting through their windows.  Basically, people are assuming and expecting privacy.  And to collect their carelessly scattered packets is a violation of an implicit trust arrangement.
But was I a party to that trust arranggement?  No, I was not.  Nor were these people’s neighbors party to any such agreement – either implicit or explicit.  Nor was Google a party to this implicit agreement.
Nevertheless, I can hear my wife blaming Google as well as blaming myself.  Is she right?  As a geek, I scream my objections to her misunderstanding.  But when I really consider her argument, she may very well have a point.  Yes, these people are ignorantly casting their data out into the air and onto the streets.  And I willingly picked up that data.  Am I attempting penetration of their networks?  Of course I’m not doing that.  But I am sifting through the junk they are throwing out.
I’ve come to a simple conclusion: I wasn’t “wardriving” at all.  Instead, I was doing the equivalent of electronic dumpster diving.  They are leaving important trash un-shredded.  And I am rummaging through their ignorance.
Should I stop collecting such small and insignificant packets?  After all, I am not doing anything illegal.  Nevertheless, I must now carefully consider my wife’s thoughts before I do my next “wardriving” run.
And even more importantly, I must rethink whether or not this activity become illegal/immoral when someone like Google does it.  It may be tenable when it is done by a lone and curious geek.  But does it become something more “sinister” when it is done by a large and “menacing” corporation?   I don’t know.  But I’ll have to think about it.  What are your thoughts on the matter?
-Roo

Add to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

A Maze of Twisty Passages…


I am definitely an old school gamer.  My son plays games like Modern Warfare 2 and Left 4 Dead 2.  But I started when games required thought and not just lightning-fast reflexes.  And one of the very first computer games I remember was Colossal Cave.  I first played it on an IBM S/370 that ran MVS and TSO (i.e., Time Sharing Option).  But some of my most favorite memories of the game were when I played it on the Heathkit H89 PC that I soldered together with my own hands.
And there was one part of the game that always fascinated me: the maze of passages.  Actually, there were two such mazes: one had twisty passages that were all alike and the other had twisty passages that were all different.  And in these tunnels, you could either become lost forever or find the pirate’s treasure.
So what does this game have to do with anything?  It’s simple: the use of tunnels can lead to frustration or it can lead to treasure.  For today, I’m going to talk about tunnels that can be used for treasure.
Most of us know about one form of tunneling or another.  Many people use (or know about) SSL tunnels and/or IPSec tunnels.  These kinds of tunnels are commonly used by many folks who must use VPN technologies to access resources that are secured behind corporate firewalls.   Most people have no real idea of what is going on “behind the scenes” when they use their corporate VPN’s.  But the basic premise is simple: one kind of data that is commonly blocked can be “wrapped” within another kind of data that can be allowed to pass.  Think of this as the knife in the birthday cake.  The guards won’t allow the knife to be given to a prisoner.  But the guards can be fooled if the real payload is hidden from sight.
Of course, this analogy is simplistic – and somewhat deceptive.  Tunnels are not used just to hide nefarious objects from the prying eyes of the world.  They are more commonly used to control the kinds of data that passes the sentry points in a system.  Think of it this way: if the cargo hole in a ship is shaped like a square, then valid cargo must also be shaped to accommodate the size and shape of the square entryway.
For those who have a little more knowledge, there are other forms of tunnels that are commonplace.  For example, SSH tunnels are de rigeur for most system administrators.  SSH tunnels can be associated with commercial tools (like VanDyke’s Secure Shell or BitVise’s Tunnelier).  But they can also be used with open and freely available tools (like sshd and PuTTY).  I use SSH tunnels for so many things.  SSH is used to secure my router.  It is also used to securely access my home systems from any location on the Internet.
But amongst those who work with security for a living, there are many other forms of tunneling – some widespread, others obscure.  For years, TOR (The Onion Router) has been used as a means of anonymous (and encrypted) browsing.  And TOR has often been used with local proxies that ease the burden of tunnel configuration and workload separation.  But recently, the use of TOR and local proxies has gotten a whole lot simpler.  You can now downlod a single package that will install and configure a browser, a proxy and TOR onto a portable platform (i.e., a USB key).  In this kind of configuration, you can insert a USB device into almost any system connected to almost any public hotspot.  Once the browser is launched, you can commence anonymous and secure browsing of the Internet.
And these tools can now be combined with all sorts of other tunneling tools.  For example, you could tunnel TOR traffic within SSH and then forward it across a DNS tunnel.  This would allow you to bypass most content filters established on the networks to which you might be connected.
Is this cool technology?  Most definitely it is.  Can this technology be used for good things?  Of course it can.  Consider an evangelist within a repressive country.  Such a person can connect and communicate with others within his country or with those who are outside his country.
But can this technology also be used for nefarious purposes? In candor, it certainly could be used for illegitimate purposes.  But I think of these kinds of technologies in the same way that I think of freedom of speech.  We must allow gross and unseemly speech if we want to have any freedom of speech.  Otherwise, our speech (however comely and delightful it might be) could be considered objectionable – and hence, controllable.
So what should we do about the maze of twisty passages?  In my narrow view, I must come down on the side of allowing such technologies.  They can be used for good or “twisted” into unacceptable uses.  Of course, the same thing is true about guns.  They can similarly be used for unsavory purposes.  But the protection of our liberties will lie in our ability to use tools that allow us to secure and protect individual liberties – even when this means that the state will have a more difficult time dealing with the criminals.
-Roo

Password Managers – Bleh or Yay?

How many of you remember the scene from WarGames when Matthew Broderick slides the desk drawer open to reveal a list of passwords?  Yeah, that movie is twenty-seven years old now.  But the message is still apt: don’t store passwords where people can find them.
And after twenty-seven years of computer development, we have single signon systems, strong passwords, multi-factor tokens, and all sorts of cryptographic wizardry.  But despite all of this, we have competing rules for password strength, differing password expiration durations, and even more different types of accounts that demand different strengths of security.  For example, most people are very concerned about password strength for their financial transactions.  But these same people are probably less concerned about the password for their PetCo account.
The result of all these new rules and password differences is the same: people either store their passwords somewhere, or they use the same password root with variations in prefixes/suffixes, or they periodically must go through the password change/challenge dance.
Amidst this reality, there are a plethora of solutions.  But two such solutions have captured my attention: Roboform and LastPass.
Roboform is an excellent tool that will store passwords in an encrypted, local password store.  It seamlessly integrates with most browsers – especially Firefox.  It is actively developed.  And most importantly, it is secure by design.  Specifically, passwords are stored in a private place under YOUR control.  Of course, this means that if you access online accounts, you will need to have access to your password store.  This usually means storing passwords on a portable USB key.  For these and other reasons, Roboform has a large and devoted following.
But there is a new gunslinger in town.  Over the past few months, LastPass has garnered a large and growing user base.  It has a very attractive UI.  But more importantly, it is flexible and very powerful.  Like Roboform, it has the ability to store and exploit multiple identities.  And it is tightly integrated with every browser – including Chrome.  Indeed, the Chrome plugin is one of the best features of LastPass.
But unlike Roboform, the LastPass team has chosen a different path for its success.  LastPass exploits cloud-based technologies for customer password storage.  This is excellent if you will be mobile and you can’t carry your identity in a mobile fashion.  Of course, this means that your critical password store is publicly available.  So if you want to use LastPass, you need to understand how they store your passwords and how they control access to your passwords.
What is Roo’s recommendation: I have switched over to LastPass.  And I use a very complex and totally unique password for this store.  Do I trust the team at LastPass to protect my password store?  I must grudgingly say that I trust them – for now.  Do I know these people personally?  No, I do not.  But I do trust them enough by virtue of the people and organizations that have publicly endorsed their technology.
That said, I am reminded of something that President Ronald Reagan once said: trust – but verify.  So I am now keeping a mindfl eye on the continuing performance of the LastPass team (including its financial supporters).
-Roo

Portable…and Secure

A few weeks ago, I wrote about PortableApps and their application portability framework.  With a sufficiently large USB thumb drive, it is possible to store most (if not all) of your day-to-day applications.  And if those apps are “portable” (i.e., they do not store anything on the local machine), then you have the start of an even more secure system.  And as I’ve begun to use this portable device as the hub of my applications and my data, the need for strong security practices is also increasing.
So what have I done to make my portable environment more secure?

  1. I’ve implemented a “traveler configuration’ of Truecrypt on my primary USB device.  This allows me to store important and private files in a secure/encrypted container.  This container has a lot of important files – including a private key that I need for identifying myself when I use remote access services.
  2. I have installed Putty Portable so that I can access my main systems from any remote computer that I might access.  Note: In order to authenticate to my home systems, I must mount the Truecrypt container that holds the private key that is required to access those systems.
  3. I use a secure, VNC-based system that requires multi-factor authentication.
  4. I’ve deployed portable browsers onto my USB drive.  I use these portable instances to ensure that private browsing data is never available on the local systems that I visit.
  5. I use tools like Toucan to sync my portable device to my central system.  This ensures that I have a copy of key files (like certs and private keys) – just in case.

Are these steps wholly sufficient?  Hardly.  Do theses steps provide me a small measure of assurance when I go portable?  Maybe.  But I am glad that more and more tools are becoming available all the time.  I just can’t wait until I can implement self-destruct technologies to remotely disable a USB device.  That technology does exist for the most expensive USB drives.  But I can’t wait until it becomes available for the average user.
-Roo