Please visit the LangaList Home Page

Please note: Older issues may contain information that is now out of date.


How To Subscribe and Unsubscribe is at the end of this note. Mailing List Trouble? See http://www.langa.com/help.htm
Questions about the advertisers? See the end of this note. Please also see legal notices at the end of this note. LangaList: ISSN 1533-1156

Please recommend the LangaList to a friend! (And maybe win $10,000 !)

An easier-to read formatted HTML version of this newsletter is available
<a href=" http://www.langa.com/newsletters/2003/2003-03-03.htm ">here</a>

The LangaList
Standard Edition

2003-03-03

A Free Email Newsletter from Fred Langa
That Helps You Get More From Your Hardware, 
Software, and Time Online

Please visit our sponsors and help keep the LangaList S.E. free!

Contents:

1) Password Security
2) Safely Test Your Passwords
3) Need A Quieter PC Fan?
4) WinDriversBackup
5) XP Home vs Pro
6) New Month, New Chances
7) TinyURL Test Fails
8) They Loaded The Code
9) Security Flaw in WinMe
10) Just For Grins
11) Plus! Edition Highlights:

 

--- ( Your Clicks On Ad Links Help Keep The LangaList S.E. Free! ) ---

Fred's Own Reference Shelf--- And Up To 20% Discounts!

Check out computer-related books
personally selected and recommended by Fred Langa
and available at Amazon.COM's deepest discounts!

<a href=" http://www.langa.com/books.htm ">Click!</a>

--------------( the above is an advertisement )--------------

 

1) Password Security

Fred, can you shed some light on the subject of passwords for us. We are constantly advised to use secure passwords, using alpha numerics and special characters, and to keep them secure. With several dozens of passwords in use its difficult to remember them all, and I am mobile so a desktop based password keeper is not an option. Writing them in a notebook is certainly not secure. So what's the solution? I use an easy to remember keyword, ie "cats", add a special character from the top row of the keyboard, chosen based on the first vowel in the keyword, where a=! e=@ etc. and add to it 3 additional characters, based on the name of the site I'm logging into. For example Langa.com, I shift a place to the left on the keyboard for the first 3 letters L=K, A=], etc. The result is a secure, 8 character, alpha numeric plus special character password, that is unique to each site, yet easy to remember, because all you need is the keyword, and the 2 rules. My only problem is sites that are set up to require ONLY alpha passwords, or ONLY alpha numeric passwords, or worse yet, sites that ASSIGN you a password. How can we get a standard for passwords that is universally used. Thanks, Dave

The issue of password security is very broad--- just think of how many systems, programs, and web sites require a login name and password.

Password security also came up as a very specific issue in our discussion of XP's "Remote Control" software, because--- obviously!--- you don't want just anyone to be able to take over your PC by guessing a too-easy password.

Dave's letter-substitution method is based on a solid idea, and in fact, I described a more secure variation of that technique in the InformationWeek.Com article now running at http://informationweek.com/story/IWK20030221S0012 :

...There are many software tools that can help generate excellent passwords, and a few can also help you securely store your passwords. I particularly like "AI RoboForm" ( http://www.roboform.com/ ) which is a secure form-filler, encrypted filer, and password-generator: When I need a password, I can generate a random string like "Dx*SHeOAniy&ju" with one click. The software also can store the password in any of several secure ways for later retrieval, so you won't go nuts trying to remember it. [Note: RoboForm also can generate just alpha, or just alphanumeric, or alphanumeric+punctuation passwords, on demand, making it a good choice to meet the varying demands of different sites.)

But a solution like RoboForm doesn't help much at initial login or with purely-local (non-Web) logins. For those, you need a way to generate a password that's simultaneously hard-to-crack and easy to remember.

You might, for example, use the "warez" and cracker trick of simple but orderly substitution of numbers and punctuation for normal letters: You pick a word or phrase--- the longer the better, up to the limits of your password system--- and devise simple substitution rules. For example, a capital "I" might become a "!" an "o" becomes a "0" (zero), "e" becomes a '3" and an "i" becomes a numeral "1." If you start with a random phrase--- let's use "I read InformationWeek"--- and then remove the spaces and perform the substitution, you get "!r3ad!nf0rmat10nW33k."

That's a trivial example, but you get the idea: With a properly obscure phrase and substitution system, you can develop passwords that are both resistant to casual cracking and yet easy to reproduce from memory.

But even an excellent password can eventually be broken if a cracker is given enough time...

... and the rest of the article goes on to discuss additional steps you can take to help ensure you stay secure even with something like Remote Desktop enabled. (See http://informationweek.com/story/IWK20030221S0012 for the full story, including the info on passwords.)

Besides Roboform, there are many tools available for managing your passwords--- helping to keep them straight, and to recall them on demand. For example, see: http://content.techweb.com/winmag/columns/explorer/2000/24.htm

But how can you be sure that any password is really safe to use? See next item
 

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

--- ( Your Clicks On Ad Links Help Keep The LangaList Free! ) ---

--------------( the above is an advertisement )--------------

2) Safely Test Your Passwords

Canadian Tom had this link as a site to test how good your passwords were, thought it may be of interest: http://www.securitystats.com/tools/password.asp
---Marcel Villeneuve

Thanks, Marcel. The site has a form in which you can input passwords for evaluation. The site tells you how easy or hard it might be to guess a given password.

Note: The site specifically says not to test your real passwords, but passwords that are *like* your real password: You don't want to be broadcasting your for-real passwords over open web links! <g> The same page also lists Do's, Don'ts and suggestions for selecting strong passwords. Good info!

BTW: My sample password from the previous item--- !r3ad!nf0rmat10nW33k, based on the easy-to-remember phrase "I read InformationWeek"--- gets the highest possible rating. That kind of phrase-and-substitution method really *is* a good way to generate easy-to-remember, yet quite secure passwords!

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

3) Need A Quieter PC Fan?

Fred: In your Information Week article on Low-Cost PCs ( at http://www.informationweek.com/story/IWK20030206S0014/2 ), you wrote (regarding a CPU fan)

> It was, in fact, so noisy I replaced the stock CPU fan with a $15 unit especially designed for low noise...

As someone with a very noisy computer myself, that sounds to me like a _great_ idea. Do you have any suggestions for where to purchase such a fan or which ones to look for? Thanks! Kathryn

Sure, Kathryn! Indeed, PC (and some Mac) fans can be hideously annoying--- like a mosquito that never alights and never goes away. 

Sound is measured in decibels, or dB, and the dB scale is logarithmic: each 10 dB increase represents in a doubling of the sound level. Thus, getting a fan even a few dB quieter than what you now have can make a noticeable difference in the overall noise level around your PC.

Fortunately, there's a huge aftermarket of fans and blowers of all kinds, capacities, and prices. No exotic tools or skills are needed: Fan replacement is usually a simple screwdriver operation.

The first step is to power off your PC, open the case, and look inside to see what's there. You may want to have a metric ruler handy: Most fan sizes are given in millimeters, and are based on the fan housing, not the diameter of the blades.

Note that a PC usually has two or more fans these days:

The power supply itself usually has a fan. This is often the main source of noise, but it's also the most expensive to replace because it's integral with the power supply--- a single sealed unit. But on the plus side, power supplies are easy to replace (usually involving just 4 screws and a couple of electrical plugs that are "keyed" so they literally cannot be plugged in the wrong way), and they're not expensive for common sizes. But don't automatically assume that a new power supply will be quieter than what you have unless the vendor specifically makes claims about the relative quietness of a unit, and ideally backs up the claim with a specific sound rating.

Any replacement power supply should match or exceed the electrical rating of the unit you're replacing (the specs will be stamped or printed somewhere in the unit); and--- although you can get a power supply for a few tens of dollars--- the more expensive units usually will be more robust, have some level of built in surge-suppression, and come with a quieter fan than cheap units: You usually get what you pay for. See http://www.google.com/search?q=quiet+silent+pc+power+supply

CPU fans are usually the next-noisiest fans in a PC, although they can be the #1 noise source in some systems. This is sometimes due to the fan design itself, and sometimes is due to the heat sink: Heat sinks with the highest resistance to airflow create more noise than others. You can often get the quietest results by replacing the stock fan and heatsink with a custom unit designed for optimum airflow. But it's fine just to replace the fan, too. http://www.google.com/search?q=quiet+silent+cpu+fan

"Case fans" or "system blowers" either blow air into or out of the case as a whole. As these fans usually fit predrilled holes, you'll probably want to match the existing fan size, unless you want to drill new holes. If you have a choice of sizes--- some PCs have multiple mounting holes to accommodate different size case fans---  you'll find that, in general, larger-diameter fans can spin slower while moving a given volume of air, and so can be less noisy than smaller fans: http://www.google.com/search?q=quiet+silent+pc+fan+blower+case

Various other components--- especially video coprocessors--- may have their own tiny fans. Unlike the other fans we've discussed, these tiny units usually are not as easily user-replaceable. (Hard core hobbyists do it all the time, but it's usually not as simple or quick a screwdriver operation as with the power supply, cpu and system fans.)

All the above fans also can come in single-speed, multi-speed manual, or thermostatically  regulated versions. The multi-speed and automatic versions are more expensive, but can offer better sound control because the fans only spin as much as is needed, rather than going full tilt all the time.

Fans also come with several types of bearings: Needle and sleeve bearings are the cheapest, nosiest, and shortest-lived. (You can get cheap fans for literally $3-4 or so--- but you'll get just that: a cheap fan.) Ball bearing fans cost a little more, but are quieter and last longer. The fanciest fans actually use magnetic levitation bearings, so there's no physical contact between the rotating fan shaft and the motor itself. These fans make almost no mechanical noise at all--- just air noise.

When buying fans, comparison shop for units with the lowest dB rating possible for a given size and airflow. For quick comparison, a whisper rates about 20dB and normal conversation is about 60dB.

The sources above can help you find literally thousands of fan options, but the best single source I know of is LangaList advertiser Cyberguys. Their catalog has a table that lists dozens of fans by size, airflow, plug type, and decibel rating, making it very easy to find *exactly* what you want: http://www.langa.com/sponsors/cyberguys.htm  But, they are an advertiser, and some readers may suspect collusion, so I also offer the general links above so you can do your own digging, too.<g>

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

--- ( Your Clicks On Ad Links Help Keep The LangaList Free! ) ---

--------------( the above is an advertisement )--------------

4) WinDriversBackup

One of my test PCs here contains a perfect, error-free installation of every current version of desktop Windows--- Win98, WinME, Win2K, XP Home and XP Pro. Whenever I'm working on some complex topic, I'll fire up the OSes in sequence to explore the issue from the vantage of each major flavor of Windows.

With Win98's scheduled demise later this year, I decided it also would be good to have several other installations of that OS locked away for safekeeping: an "as initially installed" version, fresh off the setup CD, an "as patched" raw version, with all current patches and updates, but otherwise unaltered; and so on.

In building a fresh install of Win98, I got to the point where the OS was trying to set up the network card. It asked for the driver floppy, and--- I was stumped. Oh, it was around here someplace, but the floppy wasn't where it was supposed to be. Worse, I also discovered that I hadn't backed up the drivers to hard drive or CD. Man, I must have been having a bad day to have missed all the steps I normally take to preserve important drivers.

I could have torn the office apart to find the floppy, or gone on a web hunt for a replacement driver, but the easiest solution was to use the "WinDriversBackup" tool we discussed here last year ( http://www.langa.com/newsletters/2002/2002-11-04.htm#7 ): I booted a working copy of Win98 (one that already had the driver installed), used WinDriversBackup to copy all the drivers in use on that setup, then re-started the new copy of Win98, and simply pointed its setup process at the folders full of known-good drivers created by WinDriversBackup. It worked perfectly.

There are other tools that do the same thing, too, making it easy to back up all the drivers in use on a given system against future need. See http://www.google.com/search?q=driver+backup

If you use a tool like that now, when everything's working on your PC, it may mean you'll never have to go hunting for drivers again when it's time to reinstall or upgrade your system--- especially if, like me, you sometimes don't put your driver floppies away where they're supposed to be!

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

5) XP Home vs Pro

I'm not the only one prepping for Microsoft's coming abandonment of Win98: A lot of readers are asking about their upgrade options. Among those looking at XP, the most common question is "Which version; Home or Pro?"

The Home version is OK, and it costs substantially less than the Pro. But it does lack some features found in the Pro version. Dell actually has a good, though limited, summary page that shows what's *not* in the Home version, here: http://www.dell.com/us/en/fed/topics/winxp_000_index.htm

Paul Thurrot's excellent site goes into more detail:
http://www.winsupersite.com/showcase/windowsxp_home_pro.asp

And there's even more detail here:
http://www.iqt.com.au/selectnewsletters/currentissue/windowsXPdifference.htm

Less useful, but worth a look, is the Microsoft "how to buy" site:
http://www.microsoft.com/windowsxp/home/howtobuy/choosing.asp

To me, the key difference is that the Pro version has better security. For example, Microsoft considers the Encrypting File System (EFS) to be a "corporate" feature, and so took it out of the Home version of XP. But file encryption is actually a good thing overall, for anyone. There also are significant differences in networking that can matter a lot on larger networks, although most of these differences aren't important on the relatively small network in my office.

All else being equal, I prefer the Pro version, although the $100 (or so) price difference may be show-stopper for many. In any case, the above resources, plus these ( http://www.google.com/search?q=features+Windows+XP+Professional+Home ), may help you figure out which version is best for you.

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

6) New Month, New Chances

It's a new month, and right now your chances are the best they'll ever be! To have a shot at winning a no-strings $30 Gift Certificate for any item at Amazon.Com--- books, software, hardware, kitchenware, toys, and more--- just use the following link to recommend the LangaList to a friend. Your friend just may find a new source of useful information; I just may gain a new subscriber; and you just may win a mini-shopping spree! (Full details also available via this link):
http://www.langa.com/recommend.htm#2

The more times you make a recommendation, the greater your chances are of winning!

Or, if you'd like to try to win $10,000(really!), try this link (full details also available here): http://www.recommend-it.com/l.z.e?s=143182

Either way, thank you, and good luck!

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

7) TinyURL Test Fails

Sigh. My initial, small-scale tests of TinyURL went fine, but when I used it a *lot* in a recent issue ( http://www.langa.com/newsletters/2003/2003-02-24.htm#4 ), problems surfaced. The site seemed to die for a while, and some of the links went dead. Oh well.

I really like the idea of TinyURL and other sites that work similarly, such as http://makeashorterlink.com/index.php and http://snipurl.com/index.php . These sites provide a redirect link via a server-side script, which is transparent to end users.

This can be more reliable than the standard approach that uses a client-side, browser-powered redirect link, via an html "meta tag" or a small JavaScript. Many, many "security" tools assume that all client-side redirection is evil, and cause it to fail, often with a dire security warning. Users who've disabled redirection on their own, or who have disabled scripting likewise may case the client-side redirect to fail. That's why I don't simply build my own redirect links for long URLs--- they won't work for many readers.

And that's why the server-side approach (like TinyURL's) seemed promising--- because it was invisible to the end users, and would not be defeated by hyperactive security tools.

Alas, it doesn't seem to be ready for prime time. So, I'll go back to using all the link-shortening tools sparingly, and only for truly monstrous links.

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

8) They Loaded The Code

Do you have a home page or website? (It doesn't matter what size.) Please click over to http://www.langa.com/code.htm , and maybe you can join the hundreds and hundreds of LangaList readers who have "Loaded the Code!" (If you've already "Loaded The Code" and are wondering if your site will appear here or on the Langa.Com web site, please see http://www.langa.com/link.txt )

Speaking of which: Here's another eclectic sample of reader sites--- some professional, some very personal:

View A Randomly-Chosen Reader Site
http://www.langa.com/randomlink.htm

Manually Browse All Posted-to-Date Sites Starting At
http://www.langa.com/readersites.htm

Accurate Premium Audits
http://apaaudit.com/

The Lake, Family & Friends
http://www.richardewood.com/

Rock Valley Ski Association
http://www.skirockford.org/

Sponagle Genealogy
http://snurl.com/v6n

DeLad's Place (offers Gator download)
http://www.deladsplace.my100megs.com/enter.htm

Jones Family Homepage
http://www.flexi.net.au/~jjonesaus/

Lawrence Web Site
http://www.angelfire.com/zine2/jlawrence/

The Daugherty Files
http://mysite.verizon.net/res1cwlq/

Baby Names Plus by Impressions of Life
http://www.baby-namesplus.com/

Ships of Destroyer Squadron 45
http://bobrosssr.tripod.com/index.html

Nearly New Books
http://www.nearlynewbooks.com/

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

--- ( Your Clicks On Ad Links Help Keep The LangaList S.E. Free! ) ---

"Fred, I , like so many others in the industry (computer geeks) get in the habit
 of trying out different software (freeware and shareware) never planning to
use it, but just trying it out so we will have a glimmer of an idea of what
a client may be talking about. Computer, internet, service newsletters are
the same, I have so many sent to me at my junk mail e-mail site, that I
never more than browse them (if I don't automatically trash them). Then
comes the dawning: 'I really am reading and using this particular newsletter
or software.' I guess what I am really trying to say is Thanks...At this
time I'm signing up for the plus subscription. If we use it, we should pay for it..
I and my clients thank you. ---Bob Javoroski"

 Thank *you,* Bob. <g> For my part, I try to make it as painless as possible
 to get the Plus! edition by keeping costs as low as I can:
Just a dollar a month, or about 14 cents per issue.

The Plus! Edition is ad-free, spam-proof, and contains even more content---
 tips, tricks, advice, downloads....---
than the Standard Edition you're now reading.

Get all the details:
<a href=" http://www.langa.com/plus.htm ">Click!</a>

--------------( the above is an advertisement )--------------

9) Security Flaw in WinMe

Yet another "unchecked buffer" problem in Microsoft software has come to light:

Flaw in Windows Me Help and Support Center Could Enable Code Execution

Software: Microsoft Windows Me
Impact: Run Code of Attacker's Choice
Max Risk: Critical

Issue: Help and Support Center provides a centralized facility through which users can obtain assistance on a variety of topics... Users and programs can execute URL links to Help and Support Center by  using the "hcp://" prefix in a URL link instead of "http://".

A security vulnerability is present in the Windows Me version of Help and Support Center, and results because the URL Handler for the "hcp://" prefix contains an unchecked buffer. An attacker could exploit the vulnerability by constructing a URL  that, when clicked on by the user, would execute code of the attacker's choice...... [T]he attacker could cause an attack to trigger automatically without the user having to click on a URL contained in an e-mail.

More info and patch:
http://www.microsoft.com/technet/security/bulletin/MS03-006.asp
http://www.microsoft.com/security/security_bulletins/ms03-006.asp

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

10) Just For Grins

Ken Thomson sends along these "Things Asked Of/Suggested To US Park Rangers:"

A small deer came into my camp and stole my bag of pickles. Is there a way I can get reimbursed?

Ban walking sticks in wilderness. Hikers that use walking sticks are more likely to chase animals.

Too many bugs and leeches and spiders and spider webs. Please spray the wilderness to rid the area of these pests.

Chairlifts need to be in some places so that we can get to wonderful views without having to hike to them.

The coyotes made too much noise last night and kept me awake. Please eradicate these annoying animals.

Need more signs to keep area pristine.

The places where trails do not exist are not well marked. Trails need to be reconstructed.

Please avoid building trails that go uphill.

A McDonald's would be nice at the trailhead.

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

--- ( Your Clicks On Ad Links Help Keep The LangaList Free! ) ---

--------------( the above is an advertisement )--------------

11) Plus! Edition Highlights:

  • Revised Step-by-Step Help Re: NetBEUI
       (good enough to be the final word on the subject?)
     

  • Clever Way To Convert Web Documents
       (doc/pdf/rtf/etc to html with one click)
     

  • Multi-Boot Heaven
       (freeware tool lets you boot up to 6 versions of Windows!)

The Plus! edition is only pennies per issue, and comes with a MONEY BACK
GUARANTEE from Fred. How can you lose? Check out the details:
http://www.langa.com/plus.htm

Click to email this item to a friend
http://www.langa.com/sendit.htm

return to top of page

See you next issue!

Best,

Fred
( Editor@Langa.Com )

Please recommend the LangaList to a friend! (And maybe win $10,000!I)

An easier-to read formatted HTML version is available in the "Current Issue" section of http://www.langa.com.  (The HTML version of each issue normally is available by 9AM EST [UT-5] of the issue date.) All past LangaList issues are also available at the Langa.Com site.

return to top of page


Administrivia:

UNSUBSCRIBE: From the same email account you used to sign up with), send an email to
unsubscribe-langalist@lyris.dundee.net

SUBSCRIBE (it's free!): Create and send a new email to
subscribe-langalist@lyris.dundee.net

CHANGE ADDRESS? LIST TROUBLE? HAVE QUESTIONS? OTHER PROBLEM? NEED HELP? See http://www.langa.com/help.htm

This newsletter is SPAM PROOF and requires two levels of subscriber confirmation before delivery begins: See http://www.langa.com/info.htm

About the advertisers: http://www.langa.com/privacy.htm#ads

Disclaimer: http://www.langa.com/legal.htm  In brief: All information herein is offered as-is and without warranty of any kind. Neither Langa Consulting LLC, nor its employees nor contributors are responsible for any loss, injury, or damage, direct or consequential, resulting from your choosing to use any information presented here.

This newsletter is a service of Langa Consulting LLC and is Copyright © 2003 Fred Langa / Langa Consulting LLC. All worldwide rights reserved. LangaList: ISSN 1533-1156

return to top of page


Please visit the LangaList Home Page