Of Russian hacks and password cracks

by Gil Poulsen | Aug 7, 2014 | Mac, Technology

ANOTHER DAY, another data breach and this one appears to be one of the most significant in recent memory–over a billion usernames and passwords now in the possession of some Russian hackers. Although a very interesting take on this exploit at The Verge calls into question whether said quantity of personal data was actually “hacked” or merely acquired from other criminals, the fact remains that the data is out there, and yeah, there’s probably a reasonable chance that your info is in there somewhere.

What many of us find particularly frustrating about these escapades is that the names of the sites that were compromised are usually not released for days or even weeks after the hacks occur, in the event that a site remains vulnerable after the hack is disclosed. This was the case with the recent Heartbleed bug, where many Web site operators were unconscionably slow to inform their users as to whether their sites needed patching, had or had not been patched, and exactly what information could been compromised.

In the end, we’re all left thinking, “What can I do, or what should I do, to protect myself?” Well, there isn’t much we can do to prevent these kinds of exploits, but there are two things we can do to minimize the potential risk. One is to use “strong” passwords (“un9Ayg3I1oN8” as opposed to “password”) on the Web sites that we frequent, and the other is to use unique (and strong) passwords for each site. Using strong paswords alone wouldn’t have helped much with this specific exploit, but using unique passwords would.

WHY? BECAUSE hackers know that most of us use the same 2-3 passwords for all the sites we visit. So if they capture just one, along with your email address, they may well have a way in to many of your other online accounts–some of which may contain a lot more personal information than just your name and email.

Now there’s a very good reason why–in spite of all the warnings we get each time a Web hack is publicized–most of us use the same 2-3 passwords for everything, and that’s because in order to use them, we must be able to remember them. Even working with only a few passwords can be challenging, and we’ve all had those moments wherein we type in what we think the password is, then what it might also be, then what we think it is but with an initial cap, etc. Were we all to employ strong passwords, even if they were not unique to each site, we would certainly fail at most of our login attempts.

That’s where password managers come in. Some are programs that reside on your computer; some are Web sites that store the passwords for you. Some are bare-bones and some are amazingly full-featured. But the one invaluable service they all perform is they enable you to use strong, unique passwords by remembering them for you and regurgitating them on demand. You have only to remember one “master” password to unlock the rest.

THE KEY WORD here is “enable.” It would be a truly marvelous thing were a password manager to vist all the sites you frequent, change your password on each one to something infinitely more robust like “Nim2ceWg8O9q,” and then repeat that action every three months. In the real world, of course, accomplishing that requires a little more “elbow grease,” if I may borrow an idiom from my parents’ generation.

Even with the assistance of a password manager, you must take the following steps to update your sites with a strong and unique password:

1. Log in to the site with your current (presumably weak) password.
2. Locate the area of the site where you can update your password.
3. Enter your current password in the “Current Password” or “Old Password” field.
4. Enter a much stronger one in the “New Password” field (most password managers will generate this for you).
5. Apply the password change using the “Save,” “Update, “Apply” or similarly-named button below the password fields.
6. Make sure the password manager updates its record for the new password (most do this automatically, or at least semi-automatically).
7. Repeat for the remainder of your sites.

DON’T GET ME wrong–I don’t mean to give the impression that password managers aren’t worth the trouble. I use a password manager, and I feel they are extremely useful and truly the only practical way to employ strong and unique passwords across multiple Web properties. But they still require an investment of time and thought to allow them to safely and effectively “manage” your passwords.

So if this latest exploit has you thinking that it might be time to stop using “password123” for the majority of your Web accounts, you would be well-advised to employ some form of password management. Just be prepared to spend a few hours or more working up a little elbow grease in the process.

Yosemite Slam

by Gil Poulsen | Jul 30, 2014 | Mac, Technology

I SUPPOSE I should refrain from slamming a new operating system before it’s even released, but I can’t help but wish that Apple would clean up the rest of the bugs and performance issues in Mavericks 10.9.x before announcing their next arrival. Nonetheless, OS X 10.10, aka “Yosemite,” was announced at the annual WWDC this past June and is due to arrive sometime in the fall of this year. The hardware requirements for Apple’s newest OS are identical to those of OS X 10.9 Mavericks and, like its predecessor, Yosemite will be a free upgrade for all.

There are, of course, a plethora of new features and a further extension of  the “minimalist” design that characterizes the current iDevice operating system, iOS 7. Yes, they remain two completely distinct operating systems, but the lines continue to blur. Many of the new features and capabilities of Yosemite center around improving the interaction between iDevices and Macs–what Apple refers to as Yosemite’s Continuity feature set.

Specifically, the “Handoff” components of the new OS will link all your Apple tech in such a way that you could start composing an email on your iMac and finish it on your iPad without missing a beat, or check out a Web site on your iPhone and be brought to the exact same spot on that site when you return to your MacBook Pro.

AND THAT’S JUST  for starters. You’ll be able to receive and respond to all text messages on your Mac, not just iMessages (the blue bubbles in the Messages app) but also standard SMS text messages (the green bubbles that heretofore didn’t appear in the Messages app on Macs). You’ll even have the ability to “hand off” phone calls from your iPhone to your Mac, essentially turning it into a giant speakerphone.

Even the new iCloud Drive feature, which brings a long-overdue “DropBox”-style service to Macs, is arguably most useful when you have an iDevice or two in addition to your Mac.

Finally, the AirDrop technology for swapping information wirelessly, which–in spite of the fact that it already exists on Macs and iDevices–has never allowed you to move your stuff between those two platforms, now makes amends for that by baking it right into Yosemite and the forthcoming iOS 8 (more on that in a moment).

Sure, there are other Yosemite features that don’t revolve around iDevices, like the option to scrawl on/annotate images or PDF attachments in Mail. But overall it sure seems like Apple is banking on the notion that most of you own at least one Mac and one iDevice, and that you’ve a hankering for them to work together far more smoothly and efficiently than they have to date.

HOWEVER, Yosemite and iOS 8 are the future, even if said future is mere months away. Mavericks 10.9 is the present, and I am compelled to state here that I still have reservations about upgrading from “Mountain Lion” 10.8 if that’s the OS you’re running and it’s working as advertised for you. In fact, the one thing that stands out to me as far as Mavericks’ new features is a penchant for breaking my clients’ ability to print to PostScript printers that worked just fine in earlier versions of the OS. So if you haven’t made the leap to 10.9 yet, I would have to recommend that you hold off for a few more months and see what Yosemite brings.

Don’t hold off on iOS 8, though, which was also previewed at the WWDC alongside Yosemite. This latest OS for iDevices brings some wonderful new stuff like iCloud Photo Library, which provides vast improvements in photo management/storage by offering a simpler and more useful alternative to the bewildering combination of Photo Stream and iCloud Photo Sharing–neither of which I can satisfactorily explain to my clients (given that I barely understand them myself).

Even more significantly, Apple is finally overhauling the way multiple Apple IDs are managed among individuals and families courtesy of the new Family Sharing options. For most of us, Family Sharing will bring an end to the heartbreak of managing purchases made under multiple Apple IDs, to Mom getting text messages intended for Dad and vice versa, and to the unintentional mingling of Junior’s contacts on his iPad with the address book on Dad’s MacBook Pro.

LET US FIRST exult in the glory of the new manner in which all your devices will handle your photos. Turn on iCloud Photo Library, and all of your fab pix and videos are stored (and backed up) on iCloud, in their original format (even RAW) so they can be accessed from anywhere. That’s it! Ah, but that amount of storage is going to cost me an arm and a leg, you say. Fear not, intrepid shutterbugs, because Apple has completely restructured their pricing for iCloud storage, veritably plummeting from the currently lofty $100/year for a mere 30GB, to an extra 20GB for the paltry sum of $0.99 per month, with 200GB going for just $3.99/mo.

It’s not only the storage that’s more convenient. When you use the Photos app on any of your devices to edit your mages, those changes will be visible everywhere. Even better, your edits are non-destructive–meaning that you can revert back to the original image if necessary. As part of all this, iPhoto on the Mac will be replaced by Photos, which will have a similar look, feel and feature set to the Photos app in iOS 8. That probably means some iPhoto features will be lost in the shuffle, but no one seems to like or even really understand iPhoto all that much, anyway…

On to Family Sharing. While I imagine that implementing this may be a bit tricky for a family of five with multiple existing Apple IDs, the basic concept is quite simple and long overdue. WIth Family Sharing. up to six family members–each with their own Apple ID–can access all purchases made under any of those IDs (assuming they’re made with the same credit card). And since the IDs are unique, each person can maintain their own set of iCloud calendars, contacts, reminders, etc. Thoughtfully, Family Sharing automatically creates a single shared Family calendar (with reminders) and a Family photo collection, assuming that there are some things you do want to share.

SO HOW EXACTLY will all of this work? Well, if Sis downloads the latest from One Direction, Dad, Mom and Junior all have immediate access to that album–regardless of whether or not it fits their particular musical tastes. And lest you fear that Junior is now free to embark on a reckless buying spree of the entire Maroon 5 catalog, rest assured that Apple has baked in what they call “Ask To Buy,” which alerts the credit card holder via text message whenever a purchase is attempted and allows for the immediate acceptance or rejection of same.

Assuming Mom is not subject to that restriction, the moment she purchases the now-classic Game of Life on the App Store, the rest of the family is free to grab it, fill their virtual plastic automobiles with virtual plastic spouse/offspring pegs, and agonize over whether or not to buy fire insurance when the opportunity arises. So whether or or not you’re a fan of this classic board game, Family Sharing represents a drastic improvement over the current “multiple Apple IDs” mess in which many have found themselves enmeshed.

LAST BUT certainly not least, iOS 8 includes two new technologies known as Health Kit and Home Kit. These are not apps but more of a central “hub” which, in the case of Health Kit, enables health information to be collected and shared among third-party apps such as those that detect your blood pressure, heart rate or glucose levels. This info could also be transmitted remotely to healthcare providers–something that could be potentially life-saving should any of those readings fall outside of their normal ranges.

Home Kit works in a similar fashion by allowing home automation apps from disparate developers to work together in such a way that you could, for example, inform Siri that “it’s bedtime,” at which point your downstairs lights would shut off, the thermostat would adjust appropriately, all the doors would lock and the garage door would close in the event it was left open. Apple has confirmed that they are partnering with companies like Cree, Texas Instruments, Kwikset, Philips, Chamberlain, and Schlage, which means that the major players in smartphone-based home automation are already on board with Home Kit.

So that’s iOS 8, coming to an iDevice near you sometime this fall. There are a few other nifty little features I could wax poetic over, but since I’ve been promising this posting for nearly a month now, let me sum it all up in as succinct a manner as possible:

iOS 8? Great.

Yosemite? Wait.

With every bleed of my heart…

by Gil Poulsen | Apr 9, 2014 | Mac, Technology

The “Heartbleed” bug

Many of you have probably already heard about the security issue known as “Heartbleed,” which affects numerous Web sites and potentially other programs and systems that use specific versions of an encryption technology known as OpenSSL.

SSL (Secure Sockets Layer) is the protocol that scrambles or encrypts sensitive information that moves across the Internet, and this “bug” in OpenSSL means that any data sent between your Mac or iDevice and a Web site affected by the vulnerability could be intercepted and decoded (including passwords and credit card info).

Although no one is sure if the bug has been exploited or if any information has actually been stolen, it has the potential to be serious. I’ll let you read all about it here if you want to get all the gory details, but here’s the bottom line: While your Mac is not affected directly by this, many of the Web sites that you use on a regular basis might be.

It’s estimated that approximately 15-20% of all Web sites are affected by Heartbleed. I wish I could provide you with an updated list of these sites, but as of yet no such list exists. However, someone has put together a handy little online tool that lets you type in the Web address of any site and check to see if it uses the particular flavor of OpenSSL that is affected by Heartbleed.

The owner/operator of any affected site needs to correct the problem on their end; there’s nothing you can do until the site notifies you that they’ve addressed the issue. Changing your password isn’t going to help until they’ve fixed the problem, at which point you should then seriously consider updating your password just in case it was appropriated while the site was vulnerable.

So for your financial sites at least, if nothing else, I would do a little detective work using the tool noted above. For what it’s worth, GMail is not affected by this, nor is iCloud.com. If anyone wants to report back via a comment on which sites are safe, feel free. I’ll update this post if I get any new or useful info on the subject.

Office, ours

After a wait long enough that most of us figured it would never come to pass, Microsoft Office for the iPad and iPhone/iPod is now available for download. The software itself, as well as the pricing and licensing policies, are completely different for iPads vs. iPhones/iPods, and may not seem so favorable by comparison to Apple’s iWork suite of apps, but I’ll let you be the judge.

Here’s how it breaks down:

The app for iiPhone/iPod is known as Microsoft Office Mobile. It’s completely free to download and use as long as you’re willing to create an account with Microsoft with which you can sign in; without first entering a Microsoft account ID and password the app can’t be launched.

Once you’ve gotten past that hurdle, you’ll find you can open, create, edit and save Word and Excel files but, strangely enough, you can’t create PowerPoint files even though you can open existing ones, as well as edit and save them. Further, you can’t store Office files on your iDevice, so you need to use Microsoft’s OneDrive, OneDrive for Business, or SharePoint in order to really make use of this (20GB of OneDrive storage is included).

For your iPad, Word, Excel and PowerPoint are offered as individual apps. If you want only to view existing Office documents, you can use them all for free as long as you’d like. Assuming you might actually want to create or edit documents, however, you must subscribe to Office Home Personal for $6.99/mo. (covers one tablet and one Mac or PC), or Office Home Premium for $9.99/mo. (allows the use up to five mobile devices and up to five Macs/PCs).

If you happen to work for a company that already has an Office subscription for their business, you should inquire about using that. As with Microsoft Office Mobile, you can’t store files on your device so you’ll need to use OneDrive or SharePoint for that, and you get the same 20GB of OneDrive storage provided to iPhone/iPod users.

The actual iPad apps are generally getting rave reviews, although not everyone is as enthusiastic about the Microsoft subscription model. You can try the iPad apps free for 30 days, so I’d suggest at least taking a look if you feel that you really need the Office suite on your device.

Since the iWork apps (Pages, Numbers and Keynote) can open and save Office files, and they require only a one-time purchase with no monthly or annual subscription fees, they might be a better deal. Keep in mind, however, that they’re not as full-featured as Microsoft’s offerings, nor are they as capable of seamlessly opening, editing and saving an Office document while preserving every aspect of the file in question.

Mavericks: Ready. Or Not.

Back in early February, I wrote that I really couldn’t recommend any of you upgrading to Mavericks, and as of this moment my position hasn’t changed on that. There are still some major issues even after the 10.9.2 update, so we’ll see what happens when 10.9.3 is released, probably sometime later this month.

Those of you already using OS X 10.8 “Mountain Lion” really aren’t missing all that much, other that tabbed Finder windows, tags for documents and the aforementioned bugginess. If, however, you’re still running OS X 10.6 “Snow Leopard,” or OS X 10.7 “Lion,” you should think about moving up to 10.8–as long as your Mac supports it.

Those of you still on 10.5 “Leopard” should absolutely move up to 10.6 at a minimum (to eliminate the constant warnings about the Adobe Flash Player, if for no other reason), again assuming your Mac model supports that operating system.

If you’re not sure which model Mac you own, enter your Mac’s serial no. here. And if you don’t happen to have your Mac’s serial number handy, just go to “About This Mac” from the Apple menu, and from the About window, click twice on the line that indicates the system software version.

As always, feel free to drop me a line if you’re unsure which way to go here.

All a ‘Twitter

by Gil Poulsen | Feb 25, 2014 | Mac, Technology

Last time out I noted that I was contemplating joining the Twitterverse, and perhaps even Tweeting–on a limited basis, of course. I’ve always believed, as Polonius expressed so eloquently to Hamlet’s mom, that brevity is indeed the soul of wit, something that to me applies not to the length of each Tweet–which Twitter already restricts to a scant 140 characters–but to the number of Tweets issued on a given day as well.

But before I get around to tossing out a Tweet or three, I want to make a case for why I feel Twitter is worthy of your attention in the first place, and–should you find yourself in agreement with me–how to go about getting your Tweet wet with Twitter on your Mac.

I’ve been part of the Twitterverse for only the last couple of weeks, but my brief experience has already shown that if one limits time spent with the service, and follows the appropriate people (the @s)/or topics (the #s), value can indeed be gleaned from this particular flavor of social media.

One long-standing criticism of social media services like Twitter and Facebook–and I have certainly voiced this myself–is that the information put forth seems at best trivial and at worst hurtful, or just plain mean. So I am happy to report that I have, in a fairly brief period of time, identified not less than a baker’s dozen individuals who, at least in my humble opinion, contribute information of indispensable value to the Twitterverse.

To illustrate, those whom I’ve elected to follow have graciously provided the following insights, images, info, and indisputably insightful non-sequiturs over the course of the past few days:

• Why are all the “House of Cards” journalists so bad at journalism?
  Andrew Kaczynski | @BuzzFeedAndrew | Reporter for @BuzzFeed Politics

• ‘Chuffed’ was used in the last moments of Liam Neeson’s interview & last scene of Downton on the same evening. Coincidence for a Brit term!
• ‘Mongrel’ spiking at http://m-w.com after Ted Nugent referred to @BarackObama as a “subhuman mongrel”
• TGIF is correctly pronounced TEE-JIFF. You’re welcome.
  Peter Sokolowski | @PeterSokolowski | Lexicographer, Merriam-Webster

• John Glenn and fellow Mercury astronauts clad in “Lawrence of Arabia” garb during 1960 desert training exercise
• A rejected design for the Washington Monument
• Edwin Land, inventor of the Polaroid camera, during 1st public demonstration in Manhattan, 1947
• Lincoln’s funeral procession in downtown NYC, with a 6-year old Teddy Roosevelt watching from a third-story window at upper left
  Michael Beschloss | @BeschlossDC | Presidential Historian

• The “eat” of battle – how the world’s armies get fed (skip to the pix)
• Is That Sausage Worth This?  (Spoiler: gross.)
  Mark Bittman | @bittman | Food writer for NY Times; author of How to Cook Everything

• Insomnia. A simultaneously useful and destructive state.
• I’ve just installed WhatsApp and hate myself as a result.
  Emily Bell | @emilybell | Director of Tow Centre for Digital Journalism at Columbia

• Over the past two weeks, Putin’s face has shown as great a range of expressions as Lenin’s (in his current condition).
• Olympic opening and closing ceremonies remind of of the influence of HDTV. Nothing this ambitious would have been done in analog TV days.
• Warning to non-tech media: I’m THIS close to using my authority to force you all to stop using the word “selfie.” Just FYI.
  Andy Ihnatko | @Ihnatko | Chicago Sun-Times technology columnist and Internationally Beloved Industry Figure™

• “The Lego Movie” is still number one at the box office. How dare they make a film about plastic people and not call me!
  Joan Rivers | @Joan_Rivers | A simple girl with a dream…

• 11 Historical Uses for Invisible Ink
• What Spitting Cobras Are Actually Aiming For
  Mental Floss | @mental_floss | Amazing facts from the good people at mental_floss magazine

Sure beats hateful Tweets about gay athletes, or a FaceBook posting featuring pics of what your niece had for breakfast. So in the event this brief taste of Twitter has whetted your appetite for more, all you need do is head over to twitter.com and create an account. You don’t have to Tweet anything yourself at the outset; besides, until you can coerce a few others to follow you, you’ll be Tweeting to an empty room, so to speak–er, Tweet, that is…

Once you’ve got your Twitter identity established, simply select a few individuals to follow, and revel in your new-found wisdom! To help get you started, I’ve taken the liberty of including the Twitter handle of each contributor noted above.

Point of clarification (#1 of 2): Twitter members are designated by the @ symbol; Twitter topics/keywords are indicated by a hashtag (#). Click on any keyword in a Tweet to see all Tweets which include that keyword; you can also search Twitter for a specific keyword; #SochiProblems has been particularly amusing as of late.

By way of example, my (and presumably everyone’s) favorite 320-lb,. ex-N.Y. Giants quarterback Jared Lorenzen issues Tweets as @jaredlorenzen22; keyword #heftylefty also exists for anyone to include when they Tweet about Jared himself, or anything they deem Jared-related.

Therefore, were I to Tweet regarding Jared, I might compose something like the following:

Latest on @jaredlorenzen22: The #heftylefty suffered a broken leg in the Feb. 9 game but is on the mend. Hang in there J.Load!

So if you follow @jaredlorenzen22 you’ll get all of his Tweets; if you explore the keyword #heftylefty, you’ll discover what everyone else Tweets about regarding the “Pillsbury Throwboy.” If you’re not into sports, my sincerest apologies. Simply substitute @tim_cook and #Apple respectively for their counterparts above 😉

Point of clarification (#2 of 2): You may have noticed that, in your iDevice(s) Settings and in your Mac’s Mail, Contacts & Calendars preference pane, you are provided with the option to enter your Twitter account credentials. This simply stores your Twitter handle and password so you are able to Tweet images, Web links, etc. expeditiously; it does not provide a means for you to follow others on Twitter.

Therefore, you need to download Twitter’s app for iPhone/iPad to use Twitter on any of your iDevices. On your Mac, you can simply follow all your Twitter feeds in a browser window, or download Twitter for Mac from the App Store.