How IT Should Be
Powered by Squarespace

Go Green
Recommended in our Store
  • Clickfree Transformer
    Clickfree Transformer
    Clickfree
Friday
22Jan2010

Simple Passwords Remain Popular, Despite Risk of Hacking - NYTimes.com

Back at the dawn of the Web, the most popular account password was “12345.”

Today, it’s one digit longer but hardly safer: “123456.”

Despite all the reports of Internet security breaches over the years, including the recent attacks on Google’s e-mail service, many people have reacted to the break-ins with a shrug.

According to a new analysis, one out of five Web users still decides to leave the digital equivalent of a key under the doormat: they choose a simple, easily guessed password like “abc123,” “iloveyou” or even “password” to protect their data.

“I guess it’s just a genetic flaw in humans,” said Amichai Shulman, the chief technology officer at Imperva, which makes software for blocking hackers. “We’ve been following the same patterns since the 1990s.”

Mr. Shulman and his company examined a list of 32 million passwords that an unknown hacker stole last month from RockYou, a company that makes software for users of social networking sites like Facebook and MySpace. The list was briefly posted on the Web, and hackers and security researchers downloaded it. (RockYou, which had already been widely criticized for lax privacy practices, has advised its customers to change their passwords, as the hacker gained information about their e-mail accounts as well.)

The trove provided an unusually detailed window into computer users’ password habits. Typically, only government agencies like the F.B.I. or the National Security Agency have had access to such a large password list.

“This was the mother lode,” said Matt Weir, a doctoral candidate in the e-crimes and investigation technology lab at Florida State University, where researchers are also examining the data.

Imperva found that nearly 1 percent of the 32 million people it studied had used “123456” as a password. The second-most-popular password was “12345.” Others in the top 20 included “qwerty,” “abc123” and “princess.”

More disturbing, said Mr. Shulman, was that about 20 percent of people on the RockYou list picked from the same, relatively small pool of 5,000 passwords.

That suggests that hackers could easily break into many accounts just by trying the most common passwords. Because of the prevalence of fast computers and speedy networks, hackers can fire off thousands of password guesses per minute.

“We tend to think of password guessing as a very time-consuming attack in which I take each account and try a large number of name-and-password combinations,” Mr. Shulman said. “The reality is that you can be very effective by choosing a small number of common passwords.”

Some Web sites try to thwart the attackers by freezing an account for a certain period of time if too many incorrect passwords are typed. But experts say that the hackers simply learn to trick the system, by making guesses at an acceptable rate, for instance.

To improve security, some Web sites are forcing users to mix letters, numbers and even symbols in their passwords. Others, like Twitter, prevent people from picking common passwords.

Still, researchers say, social networking and entertainment Web sites often try to make life simpler for their users and are reluctant to put too many controls in place.

Even commercial sites like eBay must weigh the consequences of freezing accounts, since a hacker could, say, try to win an auction by freezing the accounts of other bidders.

Overusing simple passwords is not a new phenomenon. A similar survey examined computer passwords used in the mid-1990s and found that the most popular ones at that time were “12345,” “abc123” and “password.”

Why do so many people continue to choose easy-to-guess passwords, despite so many warnings about the risks?

Security experts suggest that we are simply overwhelmed by the sheer number of things we have to remember in this digital age.

“Nowadays, we have to keep probably 10 times as many passwords in our head as we did 10 years ago,” said Jeff Moss, who founded a popular hacking conference and is now on the Homeland Security Advisory Council. “Voice mail passwords, A.T.M. PINs and Internet passwords — it’s so hard to keep track of.”

In the idealized world championed by security specialists, people would have different passwords for every Web site they visit and store them in their head or, if absolutely necessary, on a piece of paper.

But bowing to the reality of our overcrowded brains, the experts suggest that everyone choose at least two different passwords — a complex one for Web sites were security is vital, such as banks and e-mail, and a simpler one for places where the stakes are lower, such as social networking and entertainment sites.

Mr. Moss relies on passwords at least 12 characters long, figuring that those make him a more difficult target than the millions of people who choose five- and six-character passwords.

“It’s like the joke where the hikers run into a bear in the forest, and the hiker that survives is the one who outruns his buddy,” Mr. Moss said. “You just want to run that bit faster.”



Thursday
29Oct2009

Q&A: Which Windows 7: Full or Upgrade?

Q.

How do I know if I can use the cheaper “upgrade” version of Windows 7 or have to pay more for the “full” version?

A.

In addition to having several editions of Windows 7 on the market, Microsoft also has differently priced versions of those editions based on which version of Windows you are currently using.

If you have Windows XP or Windows Vista on your computer, you can buy the upgrade edition of Windows 7. If your operating system is older than Windows XP, you need to purchase the full version of the software. So the price for the upgrade edition of Windows 7 Home Premium for someone using Windows XP is about $120. Someone upgrading from a more ancient version of Windows or a Linux system needs the $200 full version of Windows 7 Home Premium.

Microsoft’s Windows 7 Compatibility Center has a Windows Upgrade Advisor tool that scans your PC to make sure it will work with the new operating system. The site also has information on getting driver software that will let your hardware peripherals work with Windows 7.

Keep in mind that Windows Vista systems can use the comparatively easy “in-place” upgrade option that installs Windows 7 on the computer without disturbing the documents and files that are already on there. Windows XP users, on the other hand, need to perform a clean install by copying all the data off the machine onto an external drive, installing Windows 7 and then transferring the files back onto the computer and reinstalling programs.

Microsoft has its own step-by-step instructions for the Windows 7 upgrade process. If you’d prefer a more automated approach, migration aids like Laplink’s PCmover or iYogi’s Windows 7 service might make it an easier trip to the new system.

 

Sunday
12Jul2009

Fixing the IE 8 warning - ‘Do you want to view only the webpage content that was delivered securely?’

(from http://blog.httpwatch.com)

To download the content a user would nowhave to click on the No button. As we know, most people using the web only scan text and avoid reading it if at all possible! They will usually go for the Yes button if there isnot an OK button.

Some sites are going to find that their secure pages in IE 8 have the following problems:

  • Any non-secure HTTP image beacons used for analytics data gathering will often be ignored
  • The page may not display or even work correctly if it relies on non-secure images, CSS or Javascript

Therefore, avoiding mixed content on HTTPS pages is even more important now that IE 8 has been released. It often becomes an issue when using third party services such as analytics or Content Delivery Networks (CDN). For example, we avoided the use of Google hosted Ajax libraries on our site until Google added HTTPS support.

An IE user you can disable this warning by:

  1. Going to Tools->Internet Options->Security
  2. Select the ‘Security’ tab
  3. Click the ‘Custom Level’ button
  4. In the ‘Miscellaneous’ section change “Display mixed content” to Enable
Saturday
11Jul2009

Configure Firefox to use Gmail or Google Apps for MailTo Links

(from Google Operating System Blog 6.16.09)

 

These instructions will configure Firefox to use Gmail or your Google Apps hosting account to handle mailto links:

 

  1. First, type about:config in the address bar, search for gecko.handlerService.allowRegisterFromDifferentHost, and double click to set the value to true.
  2. Then, log into GMail or your Google Apps mail URL, paste this line of JavaScript into your address bar, and hit enter:
    For Gmail: (compressed for formatting purposes - just copy & paste)
    javascript:window.navigator.registerProtocolHandler("mailto","https://mail.google.com/mail/?extsrc=mailto&url=%s","GMail")
  3. For Google Apps:(compressed for formatting purposes - just copy & paste)
    javascript:window.navigator.registerProtocolHandler("mailto","https://mail.google.com/a/example.com/mail/?extsrc=mailto&url=%s","GApps")
    Replace “example.com” with your domain.
  4. Finally, to set the default email client in Firefox without installing extensions:
    * go to Tools > Options
    * select the Applications tab
    * search for mail
    * select Use Gmail or GApps from the list of actions associated with the mailto protocol
    * click OK to save the settings.

Saturday
27Jun2009

Windows 7 pricing announced: cheaper than Vista (Updated)

Microsoft has revealed almost all the remaining information about Windows 7. The biggest announcement is pricing: Home Premium and Ultimate editions have slightly dropped in cost.

By Emil Protalinski | Last updated June 25, 2009 8:00 AM CT

 

Microsoft today announced Windows 7 retail pricing, upgrade information, launch details, and a preorder deal. The software giant has reduced the price on its most popular retail Windows product, the Home Premium upgrade version, by approximately 10 percent (this varies based on the market). In the US, this means a drop from $130 to $120, a savings of $10. For the Home Premium full version, the price drops from $240 to $200. Those are the only differences when comparing Windows Vista prices to Windows 7 prices after Microsoft made cuts in in February 2008 (compared to the ones announced in September 2006). The table below summarizes the slow drop in cost for Windows Vista and Windows 7 in the US:

Upgrade retail products

 

Windows Vista
as of 1/2007

Price
Windows Vista
as of 2/2008

Price
Windows 7
as of 10/2009

Price
Home Premium $159.99 Home Premium $129.99 Home Premium $119.99
Business $199.99 Business $199.99 Professional $199.99
Ultimate $259.99 Ultimate $219.99 Ultimate $219.99

 

Full retail products

Windows Vista
as of 1/2007

Price
Windows Vista
as of 2/2008

price
Windows 7
as of 10/2009

Price
Home Premium $239.99 Home Premium $239.99 Home Premium $199.99
Business $299.99 Business $299.99 Professional $299.99
Ultimate $399.99 Ultimate $319.99 Ultimate $319.99

Comparing the Windows Vista retail pricing at launch to the Windows 7 retail pricing at launch, the differences are much more notable. The Home Premium upgrade version has dropped $40 and the Ultimate upgrade version has dropped $40. The Home Premium full version has dropped $40 and the Ultimate full version has dropped $80. However, Microsoft has not touched the pricing for the Professional edition (previously called the Business edition). This might be attributed to the fact that in Windows 7, every edition is a superset of the previous one. That means that unlike Windows Vista Business, Windows 7 Professional will contain all the features that the Home Premium edition has, and thus Microsoft cannot justify a price drop.

Upgrading from XP or Vista with a retail copy

While these price changes are positive for consumers (none of the products has increased in price), they are rather disappointing for those hoping for much more aggressive price slashes given the current economic climate. Thankfully, retail pricing is typically used as a starting point; most users will not be buying retail versions anyway. Retail sales account for less than 5 percent of Windows sales, the rest of sales are via OEM. Some consumers will either grab an OEM copy via an online or in-store purchase, but most will be getting a copy of Windows 7 with the next purchase of their PC.

Windows XP users need to know that regardless of which edition they currently have installed (Windows XP Home, Windows XP Professional, or Windows XP Media Center Edition) and regardless of which edition of Windows 7 they are moving to (Home Premium, Professional , or Ultimate), they will need to perform a clean install, whether they buy the upgrade or full version. The hassle of backing up applications and user data will fall on the user; a clean install will not back up anything. Using Windows Easy Transfer, users can copy their important files and settings to an external USB stick, external hard drive, or DVD, and then move the data back after the installation.

The installer will verify that XP is genuine and Windows 7 will have to be installed on the same partition as the XP installation. The good news is that Microsoft is allowing XP users to buy the cheaper upgrade version if they want to (Microsoft typically lets owners of the two previous releases of Windows to do this, in this case XP and Vista).

Windows Vista users can follow multiple upgrade paths to Windows 7. As was the case when upgrading from XP to Vista, you will only need to perform a clean install if you are going to a version that is lower on the food chain. For example, if you are going from Windows Vista Ultimate to Windows 7 Home Premium, you would do a clean install. If you are going from Windows Vista Home Premium to Windows 7 Ultimate, you do not need to do a clean install. When you switch to a higher version, you're adding on the existing functionality, but when you're going to a lesser version, you're taking away functionality, thus the need for a clean install.

Clean installs will also have to be performed when upgrading from a 32-bit version to a 64-bit version, regardless of edition. Unless the user chooses to repartition or format the current partition, Vista's files from C:\WINDOWS will be preserved under C:\WINDOWS.OLD, just as when upgrading from Windows XP to Windows Vista.

As with Vista, each DVD includes the various editions. Unlike Vista, every edition of Windows 7 is a superset of the previous edition, so you will not lose any features when upgrading. Once you have some edition of Windows 7 on your system, whether you purchased it via an OEM or just upgraded from Windows XP or Windows Vista, you will be able to upgrade to a "more premium" version of Windows 7 by purchasing an upgrade key to unlock additional features, just as with Vista. This is called Windows Anytime Upgrade (WAU). For example, you could start off with Windows Vista Home Premium, upgrade to Windows 7 Home Premium, and then later choose to upgrade to Windows 7 Professional.

Windows 7 E: no upgrades for the EU

Both Windows XP and Windows Vista come with Internet Explorer, and the upgrade editions of Windows 7 were never tested to handle the installation of Windows 7 without Internet Explorer. Mike Ybarra, general manager of product management of Windows, told Ars that Microsoft had three choices for the release of Windows 7 E: delay the whole release of Windows 7 to make sure everyone gets the release of Windows 7 at the same time and without any upgrade problems, delay the release of Windows 7 just in Europe and have this market wait till Windows 7 E passes all upgrade tests, or don't offer upgrade versions at all.

Microsoft chose the last solution, and it's actually a pretty good one, for both Microsoft and consumers. Windows 7 E editions will be sold only in full versions: there will be no upgrade versions available in the European Union. The good news is that the full versions will be available at the upgrade price, though if history is any indication, they'll likely still be higher than the US upgrade prices shown above. Microsoft announced two weeks ago that it was shipping Windows 7 in Europe without Internet Explorer 8 installed in response to the EU's antitrust investigation of its browser with Windows.

Preorder Windows 7 cheaply

In select markets, Microsoft is offering its customers the ability to preorder Windows 7 upgrade versions at a significantly reduced price. This is easily the most aggressive pricing Microsoft has ever offered for Windows. The low preorder price will vary per country:

  • US: Windows 7 Home Premium ($49.99) and Windows 7 Professional ($99.99)
  • Canada: Windows 7 Home Premium ($64.99) and Windows 7 Professional ($124.99)
  • Japan: Windows 7 Home Premium (¥7,407) and Windows 7 Professional (¥14,073)
  • UK: Windows 7 Home Premium (£49.99) and Windows 7 Professional (£99.99)
  • France and Germany: Windows 7 Home Premium (€49.99) and Windows 7 Professional (€109.99)

The deal includes select retail partners, such as Best Buy and Amazon, as well as the online Microsoft Store. This program begins Friday, June 26 in the US, Canada, and Japan. It goes on while supplies last or until July 11 in the US and Canada, and until July 5 in Japan. For the UK, France, and Germany, the preorder starts July 15 and runs while supplies last or until August 14. Microsoft was not willing to discuss the limits of the supplies, but a spokesperson did confirm to Ars that the reduced prices for the European countries will simply apply to the full version (as noted above), as upgrade versions will not exist in Europe. In short, these preorders will allow those in the UK, Germany, and France to purchase full versions of Home Premium or Professional, except without IE8, for a very low price.

Windows 7 Upgrade Option Program

Waiting to buy a PC until Windows 7 is released can be frustrating (especially given the upcoming back-to-school season), so Microsoft is making an upgrade offer similar to what it did for consumers buying XP but who wanted to secure a copy Vista: buy a Windows Vista PC as of June 26 and receive the equivalent edition of Windows 7 when it comes out. If the June 26 date sounds familiar, that's because it was rumored earlier this month via a leaked Best Buy memo (contra the rumor pointing to July 1 being the date). Microsoft will be offering the program globally until January 31, 2010 but OEMs can cut it off early if they choose to.

The offer will be available only from participating OEMs or retailers and encompasses Windows Vista Home Premium, Windows Vista Business, and Windows Vista Ultimate. For example, if you purchase a computer with Windows Vista Home Premium on it, once it is available, you will get a copy of Windows 7 Home Premium to upgrade to. Further details will be available soon at windows.com/upgradeoffer and windows7upgradeoption.com.

Ybarra told Ars that Microsoft would not charge consumers for Windows 7 if they purchased a Vista PC between tomorrow and the day of general availability. He did admit, however, that OEMs can choose the price of the upgrade, possibly charging for shipping and handling fees. Furthermore, it will be up to OEMs to decide which computers the upgrade offer will be available on, so it's unlikely that low-end computers like netbooks or PCs on sale will have this offer.

Windows 7 in your language

Microsoft is promising that all major OEMs will have PCs with Windows 7 shipping in all language versions beginning on the day of general availability, October 22, 2009. However, the same cannot be said for the Windows 7 retail versions. On October 22, they will be available in 14 languages: English, Spanish, Japanese, German, French, Italian, Dutch, Russian, Polish, Brazilian Portuguese, Korean, Simplified Chinese, Traditional Chinese, and Chinese (Hong Kong).

On October 31, the remaining 21 languages will become available: Turkish, Czech, Portuguese, Hungarian, Swedish, Danish, Norwegian, Finnish, Greek, Ukrainian, Romanian, Arabic, Lithuanian, Bulgarian, Estonian, Slovenian, Hebrew, Thai, Croatian, Serbian Latin, and Latvian. This wait of just over one week is a big improvement over Windows Vista's launch: the wait between the initial launch in the US and all the languages becoming available was about three months.

This theme of "better than Vista" that we're seeing with Windows 7 is apparent in today's announcement as well: the release has better pricing and will be more rapidly broadly available. However, whether "better than Vista" will be good enough for consumers to switch away from their current operating system is up to the market to decide. That said, we're optimistic, as Microsoft is quite obviously listening intently this time around.

Update

A few readers have asked in the comments and via e-mail about retail pricing in other countries. While we begged for pricing in every country, a Microsoft spokesperson told Ars that only pricing for the EU and the UK were available:

  • The EU: Home Premium upgrade (€119.99), Professional upgrade (€285.00), Ultimate upgrade (€299.00), Home Premium full (€199.99), Professional full (€309.00), and Ultimate full (€319.00)
  • The UK: Home Premium upgrade (£79.99), Professional upgrade (£189.99), Ultimate upgrade (£199.99), Home Premium full (£149.99), Professional full (£219.99), and Ultimate full (£229.99)