While I was away…

Let’s take a look at some of the recent headlines in Tech. (In no particular order..)

* FCC privacy rules can’t stop ‘gold rush’ in personal data

“The flourishing ‘surveillance capitalism’ that profits from selling consumers’ personal data will be little affected by the new rules.” Read More..

* Malvertising Campaign Hits Top Websites to Spread Ransomware

“Hackers are always in search for an elite method to create loopholes in the cyberspace to implement the dark rules in the form of vulnerability exploitation. Top Trustworthy sites such as The New York Times, BBC, MSN, AOL and many more are on the verge of losing their face value as a …” Read more..

* Warning — Hackers can Silently Install Malware to Non-Jailbroken iOS Devices

“Hard time for mobile phone users! Just recently, two severe vulnerabilities in Qualcomm Snapdragon chip and Stagefright were spotted on the Android platform, affecting more than a Billion and Millions of devices respectively. And now: Hackers have discovered a new way to install malicious apps ..” Read more..

* Apple users, beware: First live ransomware targeting Macs …

“Security researchers have discovered what they believe to be the first-ever ransomware attack targeted at Apple users that actually made it out …” Read more..

* Android Trojan infiltrates mobile firmware, Trend Micro apps

“An Android Trojan which displays unwanted ads and installs nuisance software on mobile devices has been discovered in the firmware of smartphones and in popular Android applications, according to researchers.” Read more..

[ “firmware” is chip-level coding, which comes into play when you first power up, but before the operating system (and therefore, any ‘anti-virus’) launches. ]

* The 18 scariest computer viruses of all time (slideshow)

And, there’s also Apple vs the F.B.I., and other delightful stories… But.. none of them are happy.

Today’s quote: “Happiness is when what you think, what you say, and what you do are in harmony.” ~ Mahatma Gandhi

Copyright 2007-2015 © “Tech Paul” (Paul Eckstrom). All Rights Reserved.

---

>> Folks, don’t miss an article! To get Tech – for Everyone articles delivered to your e-mail Inbox, click here, or to subscribe in your RSS reader, click here. <<

---

All we really have, in the end, are our stories.
Make yours great ones. Ones to be proud of.

E-mail Confidential

Reader Asks How To Ensure Only Intended Recipient Can Read The E-mail

Q: I read your article on using WinPT to encrypt e-mail. But I don’t think that will work for me. I am an appraiser, and I need a way to ensure that confidential documents are seen only by the customer, and I need that document to be locked down. I do not want the client to be able to forward it to some other party, or be able to alter the contents. I use Acrobat to create locked PDF’s but how do I handle the encryption?

A: Dear Reader, I think what you need is a Mission Impossible type system, and once the e-mail is opened, a recorded voices says, “This e-mail will self-destruct in 10 seconds… 9…8…” Ha! (hint: google “self-erasing email”)

Seriously, I did write a series about using GPG and WinPT (see Who’s reading your (e-)mail? Part 1) to generate digital certificates. That topic didn’t do too well — too technical, probably — and so I wrote about a much simpler method (see Simple E-mail Encryption) where you get a certificate and ‘plug it in’ to your e-mail client. (Both these have the advantage of being free.)

And you are correct: those methods will not prevent your clients from forwarding the e-mail once they’ve opened (decrypted) them. They are used point-to-point, to ensure privacy during the transit.

To make sure that your recipients cannot forward, or copy>paste your confidential documents and e-mail attachments, I recommend using the “Pro” version of eCipher, which costs $80/yr. This will prevent printing and forwarding of your messages.

Today’s free link: There is a free site that lets you send confidential e-mails using a unique method, and gives you lots of control (including preventing forwarding). Checkout WatchDox.

Today’s free download: Folks, There is also a free version of eCipher which is very easy to install and use. If you are concerned about privacy and confidentiality, check it out.

Copyright 2007-9 © Tech Paul. All rights reserved. post to jaanix

Share this post :

A Collection of Tips for E-mail

One of the very first things I do in the process of starting my day is I check my e-mail Inbox(es). It is as much a part of my routine as my morning cup of coffee. This morning, it struck me that you do not have to be a computer geek to realize and appreciate that electronic communication has become an important — if not vital — part of our lives. And that it has changed the way we live.

If you will pardon a little self-indulgent reminiscing, I would like to tell you in a before-and-after manner, that I am old enough to well-remember what it was like in the days before email, Instant Messaging, and cellphones. In my High School years there simply were no such things. (There were no ATM machines either, if you can imagine that.)

When I wanted to find out what my friends were up to, I picked up a Slimline telephone (with cord) and tried to catch them before they left, but I usually had to track them down by “making the rounds”, in person, of our ‘hangouts’…which put a lot of miles on my 10-speed bike. (No obesity here.)

Besides ‘Ma’ Bell, the other method of communicating was the mail, now known as “snail mail”. How we ever got along back then is beyond me.

Today the speed at which I transmit written correspondence is limited only by how frequently the recipient checks their Inbox. My pals answer their phones no matter where they are (or their voicemail does) or what they’re doing.. who doesn’t carry a cellphone? I not only talk to my neice and nephew out on the East Coast, but I can see them via “videoconferencing” (free). Or I can “chat” with IM, no matter the miles of separation (also free).

But of all these modern methods, I rely the most on email. Email is the main way I stay informed and in contact with my friends and kinfolk, and the same is probably true for you.
(For kicks, I challenge you to a little test: how long can you ignore your Inbox before it irritates? Could you take a week’s vacation… and never check it?)

Because I am an “email guy”, I am perhaps overly aware of the negatives of email. I am peeved by spam, alarmed by phishing, nervous about privacy, and paranoid about hackers and e-criminals. I have written a few articles on these ‘negatives’ and how to combat them, and my “Tip of the day” today is; if you have not read them, to consider clicking on the following links.
Managing your email: eliminating the junk
Managing junk mail in Outlook/Thunderbird
They ARE reading your mail
How to block ads
Simple e-mail encryption

It is my hope that the knowledge you find there will make using the modern miracle of electronic communication a safer and more pleasant experience.

Today’s free download: If you are considering building your own website, or are interested in free WYSIWYG web-authoring tools, a nice tool is the free version of Web Easy Professional, by V-Comm.

Copyright 2007-8 © Tech Paul. All rights reserved. post to jaanix

Share this post :

Encryption: say no to data theft*

If your laptop is stolen, will the thief be able to read your vital statistics and personal info? They will if you haven’t used encryption. They’ll have your passwords as well. Do you keep any confidential business files on your computer — like some doctors and Veteran’s Affairs employees do?

As I mentioned in my series on the NTFS file system (click here), Windows has the ability to encrypt your stored data as well as controlling access from networked computers. Enabling encryption is easy, and acts invisibly to the user (you) — and by that I mean your files will look like they always do, but to an “unauthorized user” they will look like a garbled alphabet soup of nonsensical gibberish.

Tip of the day: Encrypt your My Documents folder for top-notch security. To encrypt files and/or folders in Windows you must be using the NTFS file system, which most of you will already have on your machines (use the link above to read how to check, and convert to NTFS if neccessary). There are a few different ways to use encryption; you can encrypt individual files; you can encrypt entire folders and, by default, their subfolders; and, you can encrypt your hard drive (of import for laptop owners). The process for the first two are the same, while the third requires a different method.

[Vista Users: Microsoft says, “EFS is not fully supported on Windows Vista Starter, Windows Vista Home Basic, and Windows Vista Home Premium.” Of course, what they mean by that is “NOT supported; and if you want it, spring for Ultimate Edition”. I recommend using the free TrueCrypt to encrypt your data.]

The simplest method to provide encryption to your personal data is to encrypt the My Documents folder, which I will use for purposes of demonstration — as I mentioned, doing so will encrypt all the files inside and also encrypt the contents of any subfolders. Start by right-clicking on the My Documents folder and selecting Properties…accessing the folder may be as simple as clicking the Start button or finding its icon on your desktop or you may have to click Start >My Computer >Local drive C:, depending on your settings and preferences.

When the My Documents folder’s Properties window opens, click on the “Advanced” button.

As you can see, my My Documents is set to “compressed”, but is not encrypted yet. Compression is another feature of NTFS that was very, very much sought-after in the days before giant hard drives (back then, we hadn’t heard of digital ID Theft) and is a method that uses an algorithm to shrink file sizes. You cannot, however, use encryption and compression at the same time, and today the value of the former far outweighs the latter. Fortunately, switching from one to the other requires no effort on your part, simply select “Encrypt contents to secure data” and the rest is automatic.
Now click “OK”, and then “Apply”. Whenever you encrypt a folder, you will be asked if you want to apply encryption to just that folder, or all the files and subfiles and folders; you want the latter, which is the default.
That’s it. You’re done. Your documents are now safe from “unauthorized” eyes.

That is true, unless the person trying to access your data has their hands on your machine and is able to ‘crack’ your User password (you have given your User Account a password, haven’t you?) which may be the case if your laptop is stolen. To prevent data loss in that type of a situation, you want to encrypt your whole startup process and password protect it…which in essence encrypts your whole hard drive. To do so, click Start >Run and then type in “syskey” (no quotes). Now click on the “Update” button.

Select the top radio button, “Password Startup” and enter a good, strong password. Then enter it again for confirmation. Be sure to write down your password and keep it in a safe place — should you ever forget it, it is not an easy task for even an experienced tech to get you back in to your machine.

A final thought: I think it only fair to tell you (what you may have already guessed/know) that a very knowledgable Evil Doer, if they have physical access to your machine, can often get around whatever security you have in place. The hacker expression is, “if I can touch it, I own it.” So please don’t be careless with your, or your company’s, vital data. Also, you may want to consider a more powerful, 3rd Party encryption tool like TrueCrypt.

Today’s free link: most of you already know that the World Wide Web is a wonderfully rich resource for researching information, but did you also know it is an excellent resource for digital images? Need a picture of the Golden Gate bridge to put into your child’s homework assignment? The place to start looking is Google Images.

Copyright 2007-8 © Tech Paul. All rights reserved. post to jaanix

Share this post :

Is your wireless a hackers’ playground?

I have found in life that many things we deal with are…mixed blessings. Such is the case with wireless technology. The very factors which make it so convenient (and thus popular) also make it less secure. A WAP is a radio station. It broadcasts its signal in all directions, for a limited distance; and it “listens” for signals as well. It (by default) sends out a constant “I’m here. I’m ready. I’m here. I’m ready…” When a passing device, a laptop or PDA say, gets within range it hears the WAP (Wireless Access Point) and can connect with it by sending a “I’m ready too. Let’s begin.” message.
So convenient. So easy. And no wires holding you to one spot. It’s a modern miracle!

It’s little wonder that nine out of ten networking devices sold in the US are “wireless”. They cost basically the same as wired, so why not get wireless too? My router is wireless (a WAP). Isn’t yours?

But I know about wardriving. Yes–”war+driving”. What’s that? It’s driving around with a laptop and a sensitive antenna (or a piece of coaxial cable stuck into the bottom of a Pringle’s can) and trying to “sniff” (detect) unprotected WAPs. It’s a game hackers play: who can detect the most unsecured WAPs in an hour? When they’re not doing it for kicks, they’re accessing a wardriven WAP and ‘creeping’. What’s that, you ask? “Creeping” is browsing around the data on the computers connected to the WAP. Most of the time they’re not interested in stealing your data (there’s no challenge there), they’re just snooping. They get some kind of kick out of it. (Sometimes they’ll leave behind a ‘calling card’ to let you know you’ve been ‘creeped’.) Most of the time these guys cause no harm…unless they see that you’re a total non-geek novice (no anti-virus, all your .docs are in one folder, you’ve never ‘defragged’, etc.) and they decide you’re “too stupid to own a computer” and they take it upon themselves to “punish” you by erasing your config.sys file (which will cause Windows to fail to load).
Sometimes they will simply “pile on” or “coast” a WAP and use it to surf the web for free–the main downside to the owner is reduced bandwidth (speed).

When a hacker runs across a WAP in his wardriving games that the owner has taken the precaution of encrypting, he usually passes on by, but sometimes they get bored with the super-easy creeping, and feel the need for a challenge (I’m sure, thinking, “what’s this guy hiding behind that encryption?”). This is when hackers become crackers. See, it’s terribly easy to turn on encryption–every WAP manufacturer builds it into the product–and use it. The trouble is most folks don’t know about it, much less use it…But for those who do, manufacturers included the ability to use WEP encryption (Wired Equivalent Privacy): a 128bit stream cipher key. So now the hacker is looking at gibberish and needs to find a way to “crack” the code to see the data being transmitted, and to talk/co-operate with the WAP–thus the ‘challenge’. Sadly, with the computing power of today’s personal computers and freely available tools a hacker can break into WEP protection in less than two minutes (much less).

Eventually, the hacker’s methods were discovered and WEP was quickly declared to be next-to-useless, and manufacturers switched to a new (2003) and improved methodology called WPA–Wi-Fi Protected Access. Now there’s WPA2. Have the hacker/crackers been thwarted? Well…um…no. However, WPA and the newer WPA2 are so time consuming to crack, the average hacker won’t bother. Why should he? There’s still plenty of folks broadcasting “Here I am. I’m free and easy. Here I am…” Seeemingly every house on the block an unwitting Internet café.
WPA2 is pretty good, and keeps out all but the determined (and sometimes even them).

The main points I want to make here are:
* You really do want to turn on the feature that scrambles your wireless transmissions. (To read my How-To article, How-to-secure-your-wireless-network, click here.)
* Securing your wireless by encrypting with WEP is next to useless; with WPA is so-so; and, WPA2 is the way to go at this time.
* Your network is only as capable as its weakest link, so if you have older devices that aren’t WPA-capable, your newer devices will default down to WEP (or no encryption) level to accomodate your old. I recommend replacing your older gear with newer, WPA2-capable devices.

Copyright 2007-8 © Tech Paul. All rights reserved. post to jaanix

Share this post :

How to encrypt your e-mail, the easy way

Great! You have exchanged e-mails with Comodo, and completed the free certificate installation {and so has the person(s) with whom you want to exchange private messages} as I described in the proceeding article. That was easier than you thought, right? You are now mere clicks away from simple-and-easy private exchanges.
All we have to do is associate the new certificate with the (appropriate) e-mail account. Once that is done, the encryption will be virtually transparent.. as in “automatic”.

1) Verify install (Optional): Open an instance of Internet Explorer (if it isn’t already) and click on the “Tools” menu item in the upper-right. Select “Internet Options” from the Context Menu. Now click on the “Content” tab. Look to the middle for the “Certificates” button, as shown below.
 
Now you should see your new Certificate listed…
 
As shown here. If you don’t see this, it means that Windows did not complete the certificate installation. You will need to re-open the Comodo e-mail, and revisit the link, and repeat the Install process.
But, that’s thinking negative, so let’s proceed as if everything (so far) looks right.

2) Associate Cert with e-mail: Close IE and open your e-mail client. In my screenshots I am using Live Mail, but the process steps apply to Mail, Outlook, and OE as well. (Thunderbird and AppleMail are slightly different menu choices, but the principle is the same.) Click on “Tools”, and then select “Accounts”.
This will list your configured e-mail accounts.
 
Select the account you requested the Certificate for by clicking (once) on it, {For demonstration purposes, I am associating the Cert with this site’s e-mail account.} and then click on the “Properties” button. Select the “Security” tab.
 
Start by clicking the “Select” button for the “Signing certificate”..
 
And click on the certificate shown (if you have more than one personal Certificate showing, use the dates issued to choose the correct one) and then “OK”. Repeat this for the “Encrypting preferences” “Select” button.
Your e-mail account is now “Certified”! And you are ready for…

3) Send a “Signed” e-mail to your friend: Address a “New” e-mail to the person(s) you want to exchange encrypted messages with, and click the “Sign” button, then “Send”. By “signing” your e-mail, you are sending them your “Digital ID” and a copy of your “public key”.

4) Have the other party do #3 to you: Having the other party send a “signed” e-mail to you, gives you a copy of their DID and their public key. Now you both have the keys you need to exchange secure, private, encrypted e-mails to each other.

5) Click the “Encrypt” button before you click “Send”: That’s it.. it is now that simple. Your e-mail will appear in their Inbox like this..
 
And when they open it (no special actions needed) they will see this…

.. and visa versa. From now on, it will be so smooth and easy, you might begin to wonder if your mail really is being scrambled/unscrambled. (It is.)

To read the How to on getting the free e-mail Certificate (part 1 of this article), click here.

Copyright 2007-8 © Tech Paul. All rights reserved.

Share this post :

Continuing adventures in e-mail security

Who’s reading your e-mail? Are you sure it is only the person you sent it to? Could it hurt you, or your business, (or, your marriage?) if someone else was reading it? Wouldn’t it be great if you could ensure that only the intended recipient could read it?

Loyal Friends and True of this series will remember that I while back I wrote a series on using WinPT and GPG to encrypt your e-mail and keep your important conversations private. (If you would like to take a look, click here.) I feel compelled to confess to you, Dear Reader, that the topic was not too well received, and my stats took a bit of a downturn during its run. It is my belief that this was due to the fact that the method described is not one-click simple. It is, in fact, a bit complicated.

In the prior series, I explained (in my limited way) that the encrypting of files, and sending them to someone else, where they then need to decode them, is best done by the exchanging of “keys” in what is called “Public-key encryption” (for Wikipedia’s explanation on that, click here). I will not be lecturing on that today.. though, I invite you to click the link if you’re interested in (or curious about) cryptography.

It is not hard to understand how encrypting your writing — so that it can travel across the Internet in an unreadable format — is a “good thing”.. a desirable thing.. and would have serious benefits. The encrypting of e-mails is often required by businesses, and they install cool (and expen$ive) machines on their networks that automatically encrypts all company e-mail. But what about us? Here at home? How do we do it? Can it happen automatically.. like it does at our job? Well, yes and no. The first step is to get yourself a “key”. (GPG allows you to generate keys, btw.)

I mentioned in yesterday’s article that I had started using a new (to me) e-mail client (Windows Live Mail) to access my webmail accounts. Live Mail, and all other e-mail clients (Outlook, OE, Thunderbird, etc.) natively support the use of “keys”, and allow you so “sign” and/or encrypt your e-mail with a single click… assuming you have taken a couple of steps first.
You may have noted that I have been putting the word key inside quotes; that’s because when I’m speaking at the level of how crypto works, I am actually speaking about algorithms and when I talk about using those keys, I am talking about “Certificates”. To encrypt your e-mail you need to get a Certificate… which is really a key (pair). Confusing, I know.

Tip of the day: Get a Certificate for your e-mail account(s). There are several Certificate Authorities that offer free Certificates for the personal use in e-mail, but I have found that if you are using any Microsoft products.. or you suspect that your recipient(s) may be using Windows and/or Outlook (which is a fairly good bet), you want to get your e-mail certificate here:
Today’s free link: Comodo Free Email Certificate 

Fill in the form, and use the e-mail address that you want to protect with encryption (If you use more than one e-mail address regularly, repeat this process for each one: each account needs its own Cert), and click on the “Advanced Private Key Options” link, and place a check in the “User protected?” checkbox, and enter a “Revocation password (twice). Click “Agree & C ontinue”.

A window will open telling you that a Certificate is being “requested on your behalf”.. agree. Now you will see the screen (pictured). Click “OK”.

If all goes as it should, the Comodo webpage will change to a “Congratulations!” page, and instructs you to check the Inbox of the account you created the Cert for. Do so. There will be an e-mail from Comodo containing a link. You will need to click it to complete the process (Copy>Paste links into the address bar of your browser, remember?!).

Your e-mail will look like this. When you’ve copy>pasted the e-mail’s link into your browser’s address bar, and requested the Cert download, Windows will then automatically try to install it for you, but needs your permission..

Click “Yes” to give it.

This tells you you’re done, and now you can digitally “sign” your e-mail.. which is the first real step to exchanging encrypted email.. which I will describe tomorrow.
Now, e-mail a link to this article to the person(s) you want private conversations with, and tell them to click the link and follow the Comodo wizard and get their key.. you’re going to need it. Once you and they do this, encryption is a click away.

The conclusion of this How To is now available here.

Copyright 2007-8 © Tech Paul. All rights reserved.

Share this post :