Securely manage WebSites, user ids and passwords

For the last two weeks I have had the pleasure to discover a new tool to more safely manage passwords and avoid web site spoofing. The tool is PINS, and it is free, but only works on Windows unfortunately.

PINS allows me to create a secure repository on my PC to Store important data. It is encrypted with a 448 bit Blowfish algorithm. I am now storing WebSite URLS, user ids and passwords in PINS exclusively in PINS and have turned off the SAVE PASSWORDs feature in both IE and FireFox.

FireFox stores the passwords encrypted ONLY if you put in a master password, most people don't even put in the master password. Even if you do enter a master password, just google for "recover firefox passwords" and you will have a myriad of choices to use.

IE stores their passwords differently depending on the Version of IE. However, they are easily recovered using a variety of tools. Just google for "recover IE passwords" to see the options.

The key take away here is if you are storing passwords for banking and other critical websites, then understand that any local or domain admin can obtain your passwords. Unless your drive is encrypted, then anyone who has unsupervised physical access to your PC will be also able to obtain your passwords. If you have a PC that can be rebooted using a floppy or CDROM, then your local Windows passwords file is vulnerable and can be obtained and decrypted offline. If your PC drive is disposed of, it should also be wiped. Old drives laying around contain lots of data you don't want in the wild.

Using PINS to keep my URLs, user IDs and passwords safe is a little less convenient than the Browser tools but for the security and piece of mind it is worth it.

I started by extracting my list of saved passwords from Firefox using an ADDON called Password Exporter to export my list of passwords to a CSV file. I edited this file using Excel and Saved to another CSV file. I also added a Category Column that groups URLs by category in PINS.

PINS has an import CSV function that works perfectly and allows you to map columns into their format quickly. Now whenever I want to go to a site I click on PINS, enter CTRL-F to FIND my URL, enter CTRL-H to launch the Website in a browser and then CTRL-Y to enter the user id and password into the appropriate boxes in the website.

One feature I really like is the password generator. When you edit or enter a new record, there is a button to quickly generate a new password. Then I just cut and paste the password that PINS generated into the Website's change password function. Now I can easily have a different password easily for every website I log onto. But with a different random password for each website, I am VERY dependent on making sure I don't ever lose my PINS database of passwords. No file exists until it exists in at least two places

PINS helps with making sure you have safe copies also. In the Tools >> settings >> Saving tab, you can specify a place to store a second copy whenever the file is saved. Keeping the second copy on a thumbdrive or external storage will make you file easily portable.

PINS also protects your password by having a time out that automatically locks the password file after so many minutes. If you don't re-enter the password you can't access the PINS database.

PINS also allows you to keep multiple different password files in use. If you are a consultant then you might have multiple companies or separate files for work and personal.

BY getting in the habit of ONLY accessing websited through PINS I can be assured I am hitting the EXACT URL that I know is correct. Many of the phishing Scams use the fact that the main pages of banking sites are not HTTPS and are vulnerable to man in the middle attacks. I make sure to record the https version of any website in the PINS URL field to make sure I am hitting the right website.



Free Tools:
Drive Encryption: TrueCrypt
Drive Wiping: Dans Boot and Nuke (DBAN)
Windows Password Recovery: google on Windows Password Recovery or go here

Another great tool for Software Development Shops

I had the pleasure of discovering the Herman Miller Telescoping screens recently. I am wondering how we have managed to live without such an amazing tool for so long. I love these things. They are actually pretty hard to find online. Depending on configuration, they will cost you $1,500 to $2,000 each. I think buying a few of them for your development team is a great investment

These tools are giant white boards on wheels that 'telescope' so they can be stored or pulled out for a brain storming session. You can configure them with bulletin boards to post up large ERD diagrams along with white boards. Being portable you can wheel them into various meetings and well as put them away or bring in a new one when one get filled up with details that you do not want to erase.

Roasting my own coffee and Open Source

About five years ago I was on vacation and read about people who roast their own coffee beans at home. They were raving about the freshness and lack of bitterness and the enjoyment of achieving the perfect roast. When I came home from vacation, I purchased a Fresh Roast II online and started roasting my own beans. I was not very good at roasting beans at first. Blogs about it weren't as numerous as they are today. In the past five years, I have gone through three roasters and probably 300 lbs of coffee. Today I use a an IRoast 2 from Hearthware and have a few favorite profiles

How does that apply to Open Source? Once someone tastes a freshly roasted cup of coffee, most people become aware of how bad the coffee they have been drinking all their lives has been. Truly, it really is that much better. Yes it is more work than buying coffee either in beans or ground. But it is cheaper and tastes better.

I think the same thing about open source and commercial software. Today's open source offerings are excellent, I suspect that once you 'taste' them, you will have a hard time going back to commercial software.

My introduction to FOSS was a small project we had to keep track of about 2,500 publications that needed to be created, proofed, sent for regulatory approval printed and re-printed throughout the year. It is a lot of little steps on each document and lots of little corrections. The price of getting it wrong could be an inconvenience of a wrong phone number or could be expensive when a price was significantly wrong.

We looked into the standard solution for corporate project management, Microsoft Project. But to make it work the way we wanted we would need Project Server installed. All in all, the price was approaching $70K to put up this solution, far more than the solution justified.

That's when I discovered DotProject. In about 1 week, we had a DotProject Server installed on OpenSuse with MySQL on a spare workstation and started training the users to create templates for the publications. For the first time management could actually see just how much work was going on in the Business Communications department and why there was so much turn over there.

Even 5 years ago, I was amaazed of the quality of the Linux implementation, Apache Web Server, the DotProject PHP application and MYSQL. It was eye opening coming from a world where databases and applications are licensed for hundreds or thousands of dollars per seat. And these guys were doing it for fun and recognition!

It has been an excellent five years of watching the FOSS industry, grow and mature to the point that companies should really be thinking seriously about how FOSS fits into their long term strategic plans.

A great tool for IT Departments

The Sharpie Permanent marker is a device that all IT Departments should have plenty of on hand. They are great for labeling the black (or white for Mac) power cords that just seem to collect and get separated.

Considering the damage that can be caused by plugin in the wrong voltage or amperage cord into the wrong device, it is a cheap insurance solution.

How many times hours ar wasted trying to match up power supplies, especially with so many companies using generic AC/DC converters. Also, the voltage and amperage is often printed in extremely small font on the power supply and can be hard to read.

So just label the power supplies with your Silver Sharpie!