I put the milk in the freezer for the week we were gone. When I got home I put it back into the fridge. It ended up taking 2 days to completely thaw. But the important question, what did it taste like? It tasted like it always does. I couldn't taste a difference, the texture was the same. So as far as I'm concerned, if you need to freeze skim milk it comes out fine in the end. Maybe if you freeze it for more than a week problems develop (such as funky flavors from the freezer). Also, make sure the container you freeze in has enough head room as most liquids expand when you freeze them.
Monday, December 31, 2012
Freezing Skim Milk
One of my favorite things in life is milk. There's nothing like a tall glass of cold milk. And one of the worst things is wasted milk. We recently left town for the holidays, but the day we left I still had several cartons of milk in the fridge. They were going to be bad by the time we got back, we couldn't take it with us, and I can't drink that much milk before we left. So I Googled to see if you could freeze milk. A lot of people said it worked, but that it changed the texture of the milk, giving it a grainy texture. But these people also said that it was the fat in the milk that caused this. Well I drink fat free (a.k.a. skim) milk. With no fat it should be fine, right? I figured it was worth a try.
Repairing Scratched Discs
Recently I bought a used Wii game, but when I tried the game out it wouldn't load. Looking at the disc is had quite a few scratches on the disc. Am I out of luck, or is there anything I can do to fix this? I've seen tons of fixes on the Internet using polish, toothpaste, wax, etc. I've tried some on the past with no success, so I wasn't wanting to try that again. But I have seen sellers on eBay that use professional machines to resurface damaged discs. I decided to give this a try and blog the results.
The process is simple. You buy the auction on eBay, they give you an address to mail your scratched disc to, they resurface the disc and mail it back to you. Pretty simple, and the turn around was quick too. I got my disc back in a few short days. But would it work? I put the disc back into my Wii and it works perfectly! Looking at the disc I'm not surprised it works, the process took away every single scratch. I wish I took a before picture, but now the disc looks brand new.
The best part is, this process is pretty cheap. It only costs $2.50 which includes resurfacing the disc and mailing it back to you. There are several sellers on eBay that offer this service, but I went with "euro-am." If you have scratched discs, keep this in mind as a relatively cheap way to fix the disc.
The process is simple. You buy the auction on eBay, they give you an address to mail your scratched disc to, they resurface the disc and mail it back to you. Pretty simple, and the turn around was quick too. I got my disc back in a few short days. But would it work? I put the disc back into my Wii and it works perfectly! Looking at the disc I'm not surprised it works, the process took away every single scratch. I wish I took a before picture, but now the disc looks brand new.
The best part is, this process is pretty cheap. It only costs $2.50 which includes resurfacing the disc and mailing it back to you. There are several sellers on eBay that offer this service, but I went with "euro-am." If you have scratched discs, keep this in mind as a relatively cheap way to fix the disc.
Sunday, December 30, 2012
SSID - to hide or not to hide?
If you have a home wireless network then you're probably familiar with the SSID field, and most wireless routers offer the option to hide the SSID for increased security. But is this really worth it?
When it comes to computers in general, and wireless networks specifically, I prefer to have as strong a security as possible. So I always use the most secure encryption and long complex passwords. By the same token I would choose to hide my SSID (or network name). I would never rely on a hidden SSID alone, as security through obscurity is not sufficient. But is a hidden SSID really any more secure? I've recently found programs like Inssider that will show you all networks in range, whether or not they are broadcasting their SSID. So a hidden SSID does not mean no one else can see your network nor does it mean they can't try and hack in.
So a hidden SSID is not any more secure. And as it turns out, a hidden SSID has negative side-effects.
1. Connection time
When your laptop, phone, tablet, etc. connects to the network it can actually take longer. This is because the device has to try additional tests to make sure the hidden network is indeed the network it's trying to connect to.
2. Battery life
It sounds odd at first, but hidden networks can actually use up more battery in your device. Your device is constantly searching for hidden networks that match the list of known hidden networks and trying to cnnect to them. This consumes processing power and wastes precious battery life.
Given this I've recently switched from hidden SSIDs to publicly visible SSIDs. Since the SSID is visible, I would make a recommendation. Don't put your name and/or street address in the SSID. If someone else sees a network "JamesSmith" or "17ElmStreet" then they know exactly whose network it is. Choose something obscure like "DeathStar" or "CherrySoda."
When it comes to computers in general, and wireless networks specifically, I prefer to have as strong a security as possible. So I always use the most secure encryption and long complex passwords. By the same token I would choose to hide my SSID (or network name). I would never rely on a hidden SSID alone, as security through obscurity is not sufficient. But is a hidden SSID really any more secure? I've recently found programs like Inssider that will show you all networks in range, whether or not they are broadcasting their SSID. So a hidden SSID does not mean no one else can see your network nor does it mean they can't try and hack in.
So a hidden SSID is not any more secure. And as it turns out, a hidden SSID has negative side-effects.
1. Connection time
When your laptop, phone, tablet, etc. connects to the network it can actually take longer. This is because the device has to try additional tests to make sure the hidden network is indeed the network it's trying to connect to.
2. Battery life
It sounds odd at first, but hidden networks can actually use up more battery in your device. Your device is constantly searching for hidden networks that match the list of known hidden networks and trying to cnnect to them. This consumes processing power and wastes precious battery life.
Given this I've recently switched from hidden SSIDs to publicly visible SSIDs. Since the SSID is visible, I would make a recommendation. Don't put your name and/or street address in the SSID. If someone else sees a network "JamesSmith" or "17ElmStreet" then they know exactly whose network it is. Choose something obscure like "DeathStar" or "CherrySoda."
Monday, December 17, 2012
XBox controller - Windows driver
In my last post I showed how I modded an original XBox controller for use on a PC. In this post I'll talk about the Windows driver. When you connect the controller to a computer, Windows recognizes the USB device but without a driver the controller is useless. If you search on the Internet you'll quickly find XBCD by redcl0ud. This is the original XBox controller driver, currently at version 1.07. According to the author this driver works on Windows XP, which is my OS of choice. So I downloaded the driver and tried it out. Unfortunately, the driver wouldn't load for me. XP accepted the driver, but after installation it said there was a problem with the device. I was convinced my soldering was fine, something must be wrong with the driver itself.
As it happens, the author provides the source code for the driver, and at work I recently had to write a device driver, so I have all the tools necessary to compile the driver. The first thing I noticed is the source is rather old - it hasn't been updated since 2005. Even if the driver works on XP, I can guaranty the driver won't work on 64-bit Windows. I decided to take the time to update the driver and produce version 1.08. Using newer tools from Microsoft I was able to fix a few problems in the driver's source code, correct issues in the driver INF file, and recompile for both 32-bit and 64-bit Windows. This updated driver works, I've tested it on XP, 2003, Vista, and Windows 7, both 32-bit and 64-bit. I'll make this new driver available to anyone who wants a copy, including the updated source code. You can download the driver here (link updated). This 7Zip file contains the unsigned 32 and 64-bit versions, the modified source code, and the tools necessary to sign the driver if you have your own digital certificate (read on).
No discussion of the driver would be complete without mentioning 64-bit drivers. Starting with Vista, Microsoft made a change to 64-bit Windows. All device drivers must be digitally signed using a what's called a cross-certificate. These certificates cost at least $100, and quite frankly I'm not going to spend my own money for a certificate so I can sign a free driver. So if you want to run this driver on 64-bit Windows Vista, 7, or 8 then you have two choices.
As it happens, the author provides the source code for the driver, and at work I recently had to write a device driver, so I have all the tools necessary to compile the driver. The first thing I noticed is the source is rather old - it hasn't been updated since 2005. Even if the driver works on XP, I can guaranty the driver won't work on 64-bit Windows. I decided to take the time to update the driver and produce version 1.08. Using newer tools from Microsoft I was able to fix a few problems in the driver's source code, correct issues in the driver INF file, and recompile for both 32-bit and 64-bit Windows. This updated driver works, I've tested it on XP, 2003, Vista, and Windows 7, both 32-bit and 64-bit. I'll make this new driver available to anyone who wants a copy, including the updated source code. You can download the driver here (link updated). This 7Zip file contains the unsigned 32 and 64-bit versions, the modified source code, and the tools necessary to sign the driver if you have your own digital certificate (read on).
No discussion of the driver would be complete without mentioning 64-bit drivers. Starting with Vista, Microsoft made a change to 64-bit Windows. All device drivers must be digitally signed using a what's called a cross-certificate. These certificates cost at least $100, and quite frankly I'm not going to spend my own money for a certificate so I can sign a free driver. So if you want to run this driver on 64-bit Windows Vista, 7, or 8 then you have two choices.
- The follow website has 4 different methods of loading uncertified drivers under Windows. The intent is this is used by developers who need to test their code. So it's up to you to make these changes to your own system. http://www.raymond.cc/blog/loading-unsigned-drivers-in-windows-7-and-vista-64-bit-x64/
- You can sign the driver yourself. Assuming you have access to a valid certificate, cross certificate from Microsoft, and know how to use the signtool.exe application then you can sign your own driver.
Sunday, December 16, 2012
XBox controller modded for PC use
Recent I was given an original XBox controller, specifically the Contoller S for XBox. This is the model 2 controller for the original XBox, the second model was slightly smaller and more ergonomic. The thing is, I don't have an XBox nor do I know anyone with an XBox, so I wasn't sure what to do with it. What's more, this controller lacked the other half of the breakaway cable, so it's not very useful even if I had an XBox. But then I learned the original XBox controllers are basically a USB controller and it's really easy to mod the controller for use on a computer. All you need to do is add a USB connector and load up a special driver.
To add the connector, there are several options. You can cut the cable and solder in a new end. You could solder in an entirely new cable. You could get the breakaway cable and solder in a new connector on that end. Looking in my box of spare parts I found a USB cable from an old keyboard, so I decided to solder in a completely new cable. After opening the controller you'll find the connector on the circuit board from the cable. The wires will be red, white, green, yellow, black (thin), and black (thick) in that order. If you look at a standard USB cable it will have red, white, green, black, and black. Literally you wire up the new connector color for color - i.e. red to red, white to white, and so on. As for the yellow cable which is a part of the XBox cable but not in a USB cable, you leave that wire empty. Lastly, not all USB cables will have two black wires, and that's alright. The black wires are the ground wires. If your USB cable doesn't have two black wires, just connect the one black wire you have to the controller. It doesn't matter which of the two you connect to.
Here's a picture of the controller after I soldered in the new wire. You can see the empty slot where the yellow wire was.
And here's a picture of the back side of the board, again note the empty hole where the yellow wire was.
Here's what the finished product looks like - an XBox controller with a USB plug.
In my next post I'll talk about loading the driver for Windows to recognize the controller.
To add the connector, there are several options. You can cut the cable and solder in a new end. You could solder in an entirely new cable. You could get the breakaway cable and solder in a new connector on that end. Looking in my box of spare parts I found a USB cable from an old keyboard, so I decided to solder in a completely new cable. After opening the controller you'll find the connector on the circuit board from the cable. The wires will be red, white, green, yellow, black (thin), and black (thick) in that order. If you look at a standard USB cable it will have red, white, green, black, and black. Literally you wire up the new connector color for color - i.e. red to red, white to white, and so on. As for the yellow cable which is a part of the XBox cable but not in a USB cable, you leave that wire empty. Lastly, not all USB cables will have two black wires, and that's alright. The black wires are the ground wires. If your USB cable doesn't have two black wires, just connect the one black wire you have to the controller. It doesn't matter which of the two you connect to.
Here's a picture of the controller after I soldered in the new wire. You can see the empty slot where the yellow wire was.
And here's a picture of the back side of the board, again note the empty hole where the yellow wire was.
Here's what the finished product looks like - an XBox controller with a USB plug.
In my next post I'll talk about loading the driver for Windows to recognize the controller.
Wednesday, December 12, 2012
Sugar
With kids in the house I find I'm more careful about reading labels in the grocery store. No big surprise, pretty much everything has too much sugar in it. But I recently came across several food items that shocked me.
Applesauce
I was shocked to learn that most applesauce brands add sugar. It's so bad in fact that it's very difficult to find applesauce without added sugar or corn syrup, unless you're shopping at a healthfood store or someplace like Trader Joes. Seriously, why do they add sugar to applesauce? Isn't applesauce sweet enough without added sugar? I guess the answer is no or else they wouldn't do it.
Peanut Butter
For a long time now I've only used "natural" peanut butter. Natural peanut butter can be made with a single ingredient - peanuts. Although sometimes they add salt or even a little bit of oil (to help stabilize it). I was recently on a trip shopping in a major chain grocery store for peanut butter. One major brand of natural peanut butter (I don't remember which one) boasted on the front of the label that it contained 90% peanuts. Um, natural peanut butter should be 100% peanuts, so what is this other 10%, and why are they so proud of it? Reading the ingredients the other 10% was sugar! Seriously, they put sugar in peanut butter!?! I couldn't believe it.
Applesauce
I was shocked to learn that most applesauce brands add sugar. It's so bad in fact that it's very difficult to find applesauce without added sugar or corn syrup, unless you're shopping at a healthfood store or someplace like Trader Joes. Seriously, why do they add sugar to applesauce? Isn't applesauce sweet enough without added sugar? I guess the answer is no or else they wouldn't do it.
Peanut Butter
For a long time now I've only used "natural" peanut butter. Natural peanut butter can be made with a single ingredient - peanuts. Although sometimes they add salt or even a little bit of oil (to help stabilize it). I was recently on a trip shopping in a major chain grocery store for peanut butter. One major brand of natural peanut butter (I don't remember which one) boasted on the front of the label that it contained 90% peanuts. Um, natural peanut butter should be 100% peanuts, so what is this other 10%, and why are they so proud of it? Reading the ingredients the other 10% was sugar! Seriously, they put sugar in peanut butter!?! I couldn't believe it.
Monday, November 26, 2012
Computer Slideshow
I recently needed to create a slideshow of images on the computer set to music. I've never created a slideshow before so I didn't even know what software to use. Of course, I want free and/or open source whenever possible. I researched software to use and I came across several good free pieces of software I wanted to share with others.
Microsoft Photo Story 3
Photo Story is the software I used to actually create the slideshow. I was very impressed with this piece of software. Very easy to use and it does a great job. The finished product was very professional; panning and zooming slides, transitions effects, overlayed text, mixed audio track, etc. And it's free.
Gimp
Some of the images for the slideshow needed editing; e.g. cropping, color correction, removal of certain elements, etc. That's where Gimp (free open-source) came in very useful. This extremely powerful image editor can do just about anything, once you've taken the time to learn this tool.
Audacity
I also needed to edit and mix the audio tracks together for the slideshow. For this I used Audacity, a great free and open-source program. Very easy to use, no steep learning curve with this program.
MP3MyMP3
One of the audio tracks I needed for the slideshow, I could not find the audio anywhere except in the background of a youtube video. I tried to record it using Audacity but that apparently doesn't work for streaming audio/video. Enter MP3MyMP3. This free program (with a funny name) allows you to record the audio that is being played out of your sound card. That may sound like a strange thing to do, but that's the best way to capture streaming audio. This program worked great, my only complaint with this program was it's a skinned application and I don't particularly care for skinned apps.
VLC
I think the only downside to Photo Story is the output was in Microsoft's proprietary WMV format using a codec that few programs can use. So I needed to convert this into something a little more common, like MP4. Fortunately VLC (which I've talked about before) can play WMV using this codec and is even able to convert the file into other formats.
DVD Flick
With the slideshows saved as an MP4 file, I next needed to create a DVD from that video. Doing some searches I came across DVD Flick. This great free open-source project allows you to create DVD ISO images from existing video files (e.g. MP4).
ImgBurn
The final step is to burn the DVD ISO onto blank DVDs. For this I used to tried and true ImgBurn. Easily the best CD/DVD burning software I've come across.
So there you have it. A 100% free way to create a slideshow and burn it onto a DVD.
Microsoft Photo Story 3
Photo Story is the software I used to actually create the slideshow. I was very impressed with this piece of software. Very easy to use and it does a great job. The finished product was very professional; panning and zooming slides, transitions effects, overlayed text, mixed audio track, etc. And it's free.
Gimp
Some of the images for the slideshow needed editing; e.g. cropping, color correction, removal of certain elements, etc. That's where Gimp (free open-source) came in very useful. This extremely powerful image editor can do just about anything, once you've taken the time to learn this tool.
Audacity
I also needed to edit and mix the audio tracks together for the slideshow. For this I used Audacity, a great free and open-source program. Very easy to use, no steep learning curve with this program.
MP3MyMP3
One of the audio tracks I needed for the slideshow, I could not find the audio anywhere except in the background of a youtube video. I tried to record it using Audacity but that apparently doesn't work for streaming audio/video. Enter MP3MyMP3. This free program (with a funny name) allows you to record the audio that is being played out of your sound card. That may sound like a strange thing to do, but that's the best way to capture streaming audio. This program worked great, my only complaint with this program was it's a skinned application and I don't particularly care for skinned apps.
VLC
I think the only downside to Photo Story is the output was in Microsoft's proprietary WMV format using a codec that few programs can use. So I needed to convert this into something a little more common, like MP4. Fortunately VLC (which I've talked about before) can play WMV using this codec and is even able to convert the file into other formats.
DVD Flick
With the slideshows saved as an MP4 file, I next needed to create a DVD from that video. Doing some searches I came across DVD Flick. This great free open-source project allows you to create DVD ISO images from existing video files (e.g. MP4).
ImgBurn
The final step is to burn the DVD ISO onto blank DVDs. For this I used to tried and true ImgBurn. Easily the best CD/DVD burning software I've come across.
So there you have it. A 100% free way to create a slideshow and burn it onto a DVD.
Monday, November 5, 2012
Free Partition and File Management Software
Today I wanted to talk about some free partition and file management software that I think every computer techie should know about. I've mentioned this before on my blog in other posts, but I wanted to highlight them in their own post.
Back in the last 90s into the early 2000s if you wanted to change partitions on a computer hard drive you typically had to back up all the data, blow away the partitions, create the new partitions, and restore the data - a process that took a long time. So when this product called PartitionMagic from PowerQuest allowed you to restructure partitions without having to back up and restore the data came along, it seemed just like it's name... magic. The thought of moving, resizing, changing the type, etc. of partitions on a computer with live data on them was unheard of. Of course, PartitionMagic wasn't cheap for this cool feature. Fast forward to today and now there are several good free options for moving, resizing, and otherwise editing partitions. My favorite is Partition Wizard Home Edition. This product is built on top of the Linux kernel and is available for download as a bootable CD. There's also a Windows version, but I recommend the bootable Linux CD. I use this tool a lot, both at home and work and I've never once had a problem.
Another similar utility is DiskCopy by EaseUS. This tool allows you to clone partitions and disks which is great if you're replacing on hard drive with another. I don't use this nearly as much as Partition Wizard, but it's a useful tool to keep around.
If you're looking to destroy data on your hard drive so you can sell/give away your hard drive, look no further than DBAN (Darik's Boot And Nuke). DBAN is a bootable CD (or floppy) that will securely erase all data on your hard drive. Most people don't know this, but deleting a file, even reformatting a hard drive, does NOT destroy the data. There are tools out there that allow you (or someone else) to recover deleted data from a hard drive. But if you use a tool like DBAN the data cannot be recovered.
Similar to DBAN is SDelete from SysInternals. SDelete is a command line utility for Windows that allows you to securely delete a single file, multiple files, or entire directories. If you need to wipe an entire disk use DBAN, but if you want to delete some files and not others, use SDelete.
And finally, assuming you accidentally deleted a file/folder and didn't use a tool like SDelete or DBAN, you can try and recover those files using a recovery tool. My favorite is NTFSUndelete.
Back in the last 90s into the early 2000s if you wanted to change partitions on a computer hard drive you typically had to back up all the data, blow away the partitions, create the new partitions, and restore the data - a process that took a long time. So when this product called PartitionMagic from PowerQuest allowed you to restructure partitions without having to back up and restore the data came along, it seemed just like it's name... magic. The thought of moving, resizing, changing the type, etc. of partitions on a computer with live data on them was unheard of. Of course, PartitionMagic wasn't cheap for this cool feature. Fast forward to today and now there are several good free options for moving, resizing, and otherwise editing partitions. My favorite is Partition Wizard Home Edition. This product is built on top of the Linux kernel and is available for download as a bootable CD. There's also a Windows version, but I recommend the bootable Linux CD. I use this tool a lot, both at home and work and I've never once had a problem.
Another similar utility is DiskCopy by EaseUS. This tool allows you to clone partitions and disks which is great if you're replacing on hard drive with another. I don't use this nearly as much as Partition Wizard, but it's a useful tool to keep around.
If you're looking to destroy data on your hard drive so you can sell/give away your hard drive, look no further than DBAN (Darik's Boot And Nuke). DBAN is a bootable CD (or floppy) that will securely erase all data on your hard drive. Most people don't know this, but deleting a file, even reformatting a hard drive, does NOT destroy the data. There are tools out there that allow you (or someone else) to recover deleted data from a hard drive. But if you use a tool like DBAN the data cannot be recovered.
Similar to DBAN is SDelete from SysInternals. SDelete is a command line utility for Windows that allows you to securely delete a single file, multiple files, or entire directories. If you need to wipe an entire disk use DBAN, but if you want to delete some files and not others, use SDelete.
And finally, assuming you accidentally deleted a file/folder and didn't use a tool like SDelete or DBAN, you can try and recover those files using a recovery tool. My favorite is NTFSUndelete.
Thursday, November 1, 2012
How to crask WPA/WPA2 wireless routers
It's long been know that wireless routers with WEP might as well be wide open. This form of "security" can be cracked in seconds or minutes. That's why anyone with half a brain has their wireless router set to WPA/WPA2. So imagine my surprise when I read an article recently detailing the steps to cracking WPA/WPA2 in under 10 hours. What's more, it doesn't matter how long your wireless password is, whether you're using TKIP or AES, etc. The hack uses a security flaw the gain access to the network. Here's how to do it.
First, you need to download Backtrack Linux version 5 R2 or greater (version 5 R3 is the latest version as of writing this). Download an ISO and burn that ISO onto a DVD. Or if you wish you can follow their guide to create a bootable USB drive.
Next you need to boot your laptop off the DVD (or USB drive). Thanks to Linux's live CD, you don't have to install Backtrack Linux, you can run it in memory.
Once Linux has loaded, run the command "iwconfig" to list available wireless adapters in your computer. For most computers your wireless adapter will be "wlan0."
Next run "airmon-ng start wlan0" to place your wireless card into monitor mode. Once successful, it will print out the name of your monitor session, which is typically "mon0."
Now we need to find the BSSID of the router you wish to attack. Type "airodump-ng wlan0" to list available wireless networks. (If this command fails, use "airodump-ng mon0" instead). The first column is the BSSID. Once you see your router, press Ctrl+C to stop the refreshing and write down the BSSID.
Now you're ready to attack. Run the command "reaver -i mon0 -b BSSID -vv" where 'BSSID' is the value for your router. Sit back and let it run. This would be a good thing to run overnight as it can take upwards of 10 hours.
So how does this work you ask? Well it takes advantage of a convenience feature called WPS or "WiFi Protected Setup." WPS is a feature to allow you to add new devices to your network without having to type in the wireless password. But as is usually the case, convenience and security are on opposite ends. If you want convenience you give up security. Me personally, I'd rather have a secure network, especially since I've never used WPS. So the way to protect yourself from this attack is to disable WPS on your router. But be warned, not all routers with WPS allow you to disable this feature. What's more, some routers that do support disabling WPS are still vulnerable even when WPS is disabled (in other words disabling WPS doesn't truly disable WPS). I was pleased to discover my new Linksys E3200 wireless router does allow me to disable WPS and I was not able to hack my wireless network. Before you check your router's settings, I suggest you visit the manufacturers webpage and look for an updated firmware.
To learn more about this WPA/WPA2 crack, read this LifeHacker article.
First, you need to download Backtrack Linux version 5 R2 or greater (version 5 R3 is the latest version as of writing this). Download an ISO and burn that ISO onto a DVD. Or if you wish you can follow their guide to create a bootable USB drive.
Next you need to boot your laptop off the DVD (or USB drive). Thanks to Linux's live CD, you don't have to install Backtrack Linux, you can run it in memory.
Once Linux has loaded, run the command "iwconfig" to list available wireless adapters in your computer. For most computers your wireless adapter will be "wlan0."
Next run "airmon-ng start wlan0" to place your wireless card into monitor mode. Once successful, it will print out the name of your monitor session, which is typically "mon0."
Now we need to find the BSSID of the router you wish to attack. Type "airodump-ng wlan0" to list available wireless networks. (If this command fails, use "airodump-ng mon0" instead). The first column is the BSSID. Once you see your router, press Ctrl+C to stop the refreshing and write down the BSSID.
Now you're ready to attack. Run the command "reaver -i mon0 -b BSSID -vv" where 'BSSID' is the value for your router. Sit back and let it run. This would be a good thing to run overnight as it can take upwards of 10 hours.
So how does this work you ask? Well it takes advantage of a convenience feature called WPS or "WiFi Protected Setup." WPS is a feature to allow you to add new devices to your network without having to type in the wireless password. But as is usually the case, convenience and security are on opposite ends. If you want convenience you give up security. Me personally, I'd rather have a secure network, especially since I've never used WPS. So the way to protect yourself from this attack is to disable WPS on your router. But be warned, not all routers with WPS allow you to disable this feature. What's more, some routers that do support disabling WPS are still vulnerable even when WPS is disabled (in other words disabling WPS doesn't truly disable WPS). I was pleased to discover my new Linksys E3200 wireless router does allow me to disable WPS and I was not able to hack my wireless network. Before you check your router's settings, I suggest you visit the manufacturers webpage and look for an updated firmware.
To learn more about this WPA/WPA2 crack, read this LifeHacker article.
Tuesday, October 30, 2012
How to cook rice
Whether you're having Asian, Indian, or Mexican food - a very common side dish is rice. I feel like rice should be one of the easiest things in the world to cook, I mean there are literally billions of people in this world who eat rice with every meal. But for whatever reason, rice has long been one of the hardest things for me to cook. Every time I cooked rice it ended up as this sticky gooey substance that looked more like paste and less like food. About a year ago I decided to do something about it and so I researched how to properly cook rice. Ever since then I've been making rice worthy of serving in the finest of restaurants. And I wanted to share the secrets with everyone.
Really it comes down to two tricks to yield perfect rice.
Step 1
Before you cook the rice, you need to rinse or wash the rice. You can do this in a colander, sieve, or strainer. The other method (what I do) is to wash the rice in the pot you're going to cook it in. Place your rice in the pot and fill with lots of water. Use your hands (or a spoon) to stir the rice. Let the rice settle and pour out as much of the water as you can. Then add the measured amount of water for cooking.
What you're doing in step 1 is removing the excess starch on the rice. If you cook the rice without doing this the excess starch actually thickens the water as the rice cooks preventing all the water from evaporating cleanly.
Step 2
The second step, when the rice is cooking do NOT stir the rice. Put the rice and water in a pot and bring to a boil. Once it boils, turn the heat down to low and let it simmer. But do NOT stir the rice during cooking. If you stir the rice you release starch which again will result in a thick gooey mess.
If you follow these two simple steps you two will make wonderful rice you can be proud of.
Really it comes down to two tricks to yield perfect rice.
Step 1
Before you cook the rice, you need to rinse or wash the rice. You can do this in a colander, sieve, or strainer. The other method (what I do) is to wash the rice in the pot you're going to cook it in. Place your rice in the pot and fill with lots of water. Use your hands (or a spoon) to stir the rice. Let the rice settle and pour out as much of the water as you can. Then add the measured amount of water for cooking.
What you're doing in step 1 is removing the excess starch on the rice. If you cook the rice without doing this the excess starch actually thickens the water as the rice cooks preventing all the water from evaporating cleanly.
Step 2
The second step, when the rice is cooking do NOT stir the rice. Put the rice and water in a pot and bring to a boil. Once it boils, turn the heat down to low and let it simmer. But do NOT stir the rice during cooking. If you stir the rice you release starch which again will result in a thick gooey mess.
If you follow these two simple steps you two will make wonderful rice you can be proud of.
Friday, September 28, 2012
Transferring files over the Internet using torrents
Recently I needed to copy several gigabytes of pictures and videos from a family member's computer. My initial attempt was to run an FTP server (FileZilla) and transfer the files that way. This failed because the Internet connection on the other end is kind of flaky. Their DSL connection has a tendency to briefly drop-out, sometimes as often as every 5 minutes. So I needed to find a reliable way to transfer these files, some method that is fault-tolerant of frequent connection losses. I know I could use Dropbox, Google Drive, or some other form of online storage as an intermediary location, but I'd prefer to direct PC to PC transfer. On the suggestion of someone else, I decided to give torrents a try. This seemed like a great idea - below is how I got the transfer to work using torrents.
First let me say I'm by no means an expert when it comes to torrents. This was my first real exposure to torrents, so much of the technology and terms is new to me. But I do know enough about the torrent design to know that it should handle a flaky connection.
The first thing you need is a torrent client and server. Far and away the most popular and used program for Windows is uTorrent (free). I started to use this program and it would have worked, but this program has some really annoying ads, nagware, whatever you want to call it. I then discovered qBitTorrent (also free) which in my opinion is a much better program. It does pretty much everything of uTorrent but without the nags, and it's open-source which is nice.
After you start qBitTorrent, click Tools then Options. On the "Behavior" page enable "Inhibit system sleep" at the bottom. You don't want your computer going to sleep during the transfer.
On the "Connection" page take note of the port being used. You may need to open holes in your firewall later on. Also, UPnP is very convenient if your home router supports it.
On the "Speed" page uncheck the "Upload" field at the top. We don't want to limit the transfer speed, we want it to go as fast as possible.
And finally, on the "Advanced" page scroll down and enable the embedded tracker. Also take note of the tracker port.
You're now ready to create the torrent on the computer with the files to send. Click on Tools then Torrent Creator. At the top enter the path to the file or folder containing the files to be sent. Under "Tracker URLs" you need to manually type the URL used to identify the new torrent. The form is "http://<public_ip>:<port>/announce" Public IP is your IP address on the Internet, which is likely different than the IP address of your computer. To get your public IP address you can Google "what's my IP" As for port number, that's the embedded tracker port from the Advanced page in the options. Lastly, enable "private" and "start seeding" at the bottom. When you click "Create and Save" it will ask for a location to save the torrent file, and it will begin "hosting" the files. You need to email or otherwise transfer this torrent file to the receiving computer.
Receiving the files is much easier. Just start any torrent client (again, I recommend qBitTorrent) and open the torrent file created by the sending machine. If you did everything correctly it will begin to download the files.
If the torrent doesn't connect, then chances are the firewall(s) on the sending side are blocking things. There are likely two firewalls on the sender-side, the Windows firewall and the router. You need to open up exceptions in both, for both the connection port (connection page of the options) and tracker port (advanced page). If your router doesn't support UPnP then you need to setup port forwarding for these two ports.
First let me say I'm by no means an expert when it comes to torrents. This was my first real exposure to torrents, so much of the technology and terms is new to me. But I do know enough about the torrent design to know that it should handle a flaky connection.
The first thing you need is a torrent client and server. Far and away the most popular and used program for Windows is uTorrent (free). I started to use this program and it would have worked, but this program has some really annoying ads, nagware, whatever you want to call it. I then discovered qBitTorrent (also free) which in my opinion is a much better program. It does pretty much everything of uTorrent but without the nags, and it's open-source which is nice.
After you start qBitTorrent, click Tools then Options. On the "Behavior" page enable "Inhibit system sleep" at the bottom. You don't want your computer going to sleep during the transfer.
On the "Connection" page take note of the port being used. You may need to open holes in your firewall later on. Also, UPnP is very convenient if your home router supports it.
On the "Speed" page uncheck the "Upload" field at the top. We don't want to limit the transfer speed, we want it to go as fast as possible.
And finally, on the "Advanced" page scroll down and enable the embedded tracker. Also take note of the tracker port.
You're now ready to create the torrent on the computer with the files to send. Click on Tools then Torrent Creator. At the top enter the path to the file or folder containing the files to be sent. Under "Tracker URLs" you need to manually type the URL used to identify the new torrent. The form is "http://<public_ip>:<port>/announce" Public IP is your IP address on the Internet, which is likely different than the IP address of your computer. To get your public IP address you can Google "what's my IP" As for port number, that's the embedded tracker port from the Advanced page in the options. Lastly, enable "private" and "start seeding" at the bottom. When you click "Create and Save" it will ask for a location to save the torrent file, and it will begin "hosting" the files. You need to email or otherwise transfer this torrent file to the receiving computer.
Receiving the files is much easier. Just start any torrent client (again, I recommend qBitTorrent) and open the torrent file created by the sending machine. If you did everything correctly it will begin to download the files.
If the torrent doesn't connect, then chances are the firewall(s) on the sending side are blocking things. There are likely two firewalls on the sender-side, the Windows firewall and the router. You need to open up exceptions in both, for both the connection port (connection page of the options) and tracker port (advanced page). If your router doesn't support UPnP then you need to setup port forwarding for these two ports.
Friday, September 21, 2012
Farewell Shuttle Endeavour
Today was the last flight of the Space Shuttle Endeavour. It left this morning from Edwards AFB on a flying tour of California before landing at LAX, where it will be rolled to it's new home at the California Science Center.
The shuttle first flew by Sacramento, then onto San Francisco for shots in front of the Golden Gate Bridge. After that it flew down the coast, past Vandenberg AFB, over some LA landmarks, and onto LAX. As it flew down the coast it passed our house and I was able to snap a few pictures. Unfortunately the morning fog had just burned off, so there was still some foggy haze in the air. As a result the pictures aren't the best, but you can clearly see the shuttle, the 747 carrier, and the F15 escort.
This isn't the first time I've seen the shuttle flying overhead, although this is the first time I've seen it on top of the 747 carrier. Growing up I lived near Edwards AFB which is where the shuttle landed for the first decade or so of it's career. So I got to see the shuttle fly overhead on final approach to Edwards many times. But seeing it on top of the 747 slowly (relatively speaking) flying down the coast was a nice treat.
The shuttle first flew by Sacramento, then onto San Francisco for shots in front of the Golden Gate Bridge. After that it flew down the coast, past Vandenberg AFB, over some LA landmarks, and onto LAX. As it flew down the coast it passed our house and I was able to snap a few pictures. Unfortunately the morning fog had just burned off, so there was still some foggy haze in the air. As a result the pictures aren't the best, but you can clearly see the shuttle, the 747 carrier, and the F15 escort.
This isn't the first time I've seen the shuttle flying overhead, although this is the first time I've seen it on top of the 747 carrier. Growing up I lived near Edwards AFB which is where the shuttle landed for the first decade or so of it's career. So I got to see the shuttle fly overhead on final approach to Edwards many times. But seeing it on top of the 747 slowly (relatively speaking) flying down the coast was a nice treat.
Friday, September 14, 2012
Windows 8 - is it Vista all over again?
Microsoft will start selling Windows at the end of October. But in the meantime, as a Microsoft partner and Windows developer I have access to the final version of Windows 8. So have installed and used Windows 8 on several machines over the past week.
I'm making my prediction right now, I think most computer users are going to hate Windows 8. It is so radically different that I think most computer users will find it difficult and frustrating to use, and therefore won't upgrade. When Vista came it there was severe backlash and users and corporations refused to upgraded choosing to stay with Windows XP instead. I think the same thing will happen here, most people will choose to stay with Windows 7.
The main problem is the new Metro interface and the loss of the start menu on the desktop. Anyone who has used a Windows computer in the last 15 years will find Windows 8 difficult to use. Case in point, when I first used Windows 8 it literally took me 5 minutes to figure out how to turn off the computer. I shouldn't have to search for 5 minutes to find the power button. That's a big problem.
The second biggest problem, which is related to the Metro interface, is Microsoft needs to realize who users are. I don't know the percentages, but the vast majority of Windows computers have a keyboard and mouse. Probably much less than 1% of Windows computers are on tablets with touchscreens. Yet Metro is designed for and geared around touchscreen. So if you're using a keyboard and mouse prepare to be frustrated with Windows 8.
If you must use Windows 8, then do yourself a HUGE favor and download and install Classic Shell. This is a free open-source program that restores the start menu to Windows 8. This won't make Windows 8 the perfect OS, but it will at least take some of the sting out of switching.
Monday, August 20, 2012
Bits versus bytes
Time for another computer rant. In computers the amount or size of data is often times measured as either bits or bytes. A "bit" is a single piece of data - either a 0 or a 1, binary, on or off, true or false, etc. It is the smallest size of data you can have. But it's not very useful as you can only store 2 values, 0 or 1. But if you string multiple bits together you can store increasingly larger pieces of data. A "byte" is 8 bits together. Whereas a bit is 2 values, a byte is 256 values. Bytes, just like bits, can be strung together to store larger blocks of data.
What really annoys me is when companies insist on using bits instead of bytes. And they do it for one simple reason, it makes there product/service sound better. After all what sounds better, DSL at 200 Kbps or DSL at 1600 KBps? USB at 480 Mbps or 5000 Mbps?
So why does this bother me so much? Simple, a bit might be the smallest representation of data, but in modern computers everything is byte orientated. It is impossible to have anything other than even number of bytes. You cannot have a file that is 1 bit in size. You cannot transmit 8001 bits of data over the network. Everything MUST be an even number of bytes - period. So anytime you see something expressed in bits they are doing it for one reason - someone in marketing is trying to trick you into thinking you're getting more than you really are. So the next time you see something represented in bits, someone in marketing just insulted your intelligence and you should be offended.
What really annoys me is when companies insist on using bits instead of bytes. And they do it for one simple reason, it makes there product/service sound better. After all what sounds better, DSL at 200 Kbps or DSL at 1600 KBps? USB at 480 Mbps or 5000 Mbps?
So why does this bother me so much? Simple, a bit might be the smallest representation of data, but in modern computers everything is byte orientated. It is impossible to have anything other than even number of bytes. You cannot have a file that is 1 bit in size. You cannot transmit 8001 bits of data over the network. Everything MUST be an even number of bytes - period. So anytime you see something expressed in bits they are doing it for one reason - someone in marketing is trying to trick you into thinking you're getting more than you really are. So the next time you see something represented in bits, someone in marketing just insulted your intelligence and you should be offended.
Tuesday, August 14, 2012
Project TG-16 - Modding part 2
In addition to the previously discussed audio/video mod, I also added a reset switch and power LED mod to the TurboGrafx-16. Much to my amazement, the TurboGrafx-16 did not come with either a reset switch or a power light.
Reset Switch
Adding a reset switch is fairly easy, all you need is the switch and two pieces of wire. Again, here's the pinout of the back connector of the TurboGrafc-16.
In column 22 is a "/RST" switch. We need to solder one wire onto this point. The second wire gets soldered onto any ground potential point in the system. This can be any of the large copper traces around the edge. You connect these two wires to your switch - but you can't use any old switch. You need what's called an "off-mom" switch. This means the switch is off by default, but momentarily the switch is on while you press it. But as soon as you let go, the switch goes back to off. I used Digikey part number 509PB-ND.
To mount the switch I drilled a single hole in the side of the case. The switch works as you'd expect, press the switch and the system resets. Here's a picture of the final product.
Power LED
I've seen a number of power LED mods for the TG-16. But I think my favorite was one that lights up the logo on the top. Since the logo has color in it, the best would be a white LED mounted behind it.
For this mod we need 1) a power source, 2) the LED, 3) a resistor, and 4) some wires. Most LEDs take between 2 and 3.5 volts to light up, so we need to find a power source that is at least a volt or two above that. Although ideally not too much higher. Fortunately the TG-16 has a 5 volt regulator (highlighted below).
Turn the TG-16 on, and using a multimeter identify which pins are ground and 5V. Then solder a wire onto each. Here's a closeup of the voltage regulator after attaching the wires.
Next you need to solder the LED and resistor onto these wires to make one big loop (don't forget about LED polarity). It is true the LED will run off of 5V without the resistor, so why add the resistor? If you run an LED off of more volts than it was designed for, the LED will 1) generate more heat, 2) burn out much quicker, and 3) may even shine at a different color. But what value resistor do we need?
To calculate the resistor value we need 3 pieces of info. First we need to know the total volts being used to power the LED (let's call it Vt). Second we need to know the voltage of the LED, usually called the Forward Voltage (let's call it Vf). And finally we need to know the current in amps of the LED (let's call it I). Using my multimeter I tested the 5 volt regulator and got a value of 5.03V, so this is my Vt value. For my LED, I chose Digikey part number 1080-1006-ND. According to the datasheet on this LED, it has a forward voltage of 3.2 (Vf) and a current of 20 milliamps (I).
Our total voltage is 5.03, but we only want 3.2 for the LED, So we need to "burn off" 1.83V in the resistor (let's call that Vr). We only need one formula, V=IR (volts equal amps * resistance). Vr = I * R. We know Vr and I, so the formula becomes 1.83 = .02 * R. When you divide that out you end up with 91.5 ohms. So you need to use a resistor close to that value. I used a 91 ohm resistor.
Next solder it all up. Be sure and cover the exposed LED and resistor leads with heat shrink or electrical tape to prevent shorts. I then taped the LED onto the top of the metal RF shield around the circuit board.
The final step is to enlarge the hole for the light to illuminate the underside of the logo. If you use a razor blade you can very easily remove the TG-16 logo. I then used both a Dremel and razor blades to cut a square hole in the case. Be sure to leave a lip around the opening so you can glue the logo back down. Here is a picture of the opening. Notice the LED inside the hole.
The last thing to do is glue the logo back down. It looks pretty cool when you turn the system on.
This was a fun project to work on. I have a nicely modded TG-16, and with the exception of the reset switch in the side it looks completely stock. Now it's time to turn it on and enjoy some great retro games!
Reset Switch
Adding a reset switch is fairly easy, all you need is the switch and two pieces of wire. Again, here's the pinout of the back connector of the TurboGrafc-16.
To mount the switch I drilled a single hole in the side of the case. The switch works as you'd expect, press the switch and the system resets. Here's a picture of the final product.
Power LED
I've seen a number of power LED mods for the TG-16. But I think my favorite was one that lights up the logo on the top. Since the logo has color in it, the best would be a white LED mounted behind it.
For this mod we need 1) a power source, 2) the LED, 3) a resistor, and 4) some wires. Most LEDs take between 2 and 3.5 volts to light up, so we need to find a power source that is at least a volt or two above that. Although ideally not too much higher. Fortunately the TG-16 has a 5 volt regulator (highlighted below).
Turn the TG-16 on, and using a multimeter identify which pins are ground and 5V. Then solder a wire onto each. Here's a closeup of the voltage regulator after attaching the wires.
Next you need to solder the LED and resistor onto these wires to make one big loop (don't forget about LED polarity). It is true the LED will run off of 5V without the resistor, so why add the resistor? If you run an LED off of more volts than it was designed for, the LED will 1) generate more heat, 2) burn out much quicker, and 3) may even shine at a different color. But what value resistor do we need?
To calculate the resistor value we need 3 pieces of info. First we need to know the total volts being used to power the LED (let's call it Vt). Second we need to know the voltage of the LED, usually called the Forward Voltage (let's call it Vf). And finally we need to know the current in amps of the LED (let's call it I). Using my multimeter I tested the 5 volt regulator and got a value of 5.03V, so this is my Vt value. For my LED, I chose Digikey part number 1080-1006-ND. According to the datasheet on this LED, it has a forward voltage of 3.2 (Vf) and a current of 20 milliamps (I).
Our total voltage is 5.03, but we only want 3.2 for the LED, So we need to "burn off" 1.83V in the resistor (let's call that Vr). We only need one formula, V=IR (volts equal amps * resistance). Vr = I * R. We know Vr and I, so the formula becomes 1.83 = .02 * R. When you divide that out you end up with 91.5 ohms. So you need to use a resistor close to that value. I used a 91 ohm resistor.
Next solder it all up. Be sure and cover the exposed LED and resistor leads with heat shrink or electrical tape to prevent shorts. I then taped the LED onto the top of the metal RF shield around the circuit board.
The final step is to enlarge the hole for the light to illuminate the underside of the logo. If you use a razor blade you can very easily remove the TG-16 logo. I then used both a Dremel and razor blades to cut a square hole in the case. Be sure to leave a lip around the opening so you can glue the logo back down. Here is a picture of the opening. Notice the LED inside the hole.
The last thing to do is glue the logo back down. It looks pretty cool when you turn the system on.
This was a fun project to work on. I have a nicely modded TG-16, and with the exception of the reset switch in the side it looks completely stock. Now it's time to turn it on and enjoy some great retro games!
Saturday, August 4, 2012
Project TG-16 - Modding
The final step with this project is to mod the system, to make it better than it was originally. I decided on 3 mods for this system; 1) audio/video mod, 2) power LED mod, and 3) reset switch mod. For the audio/video mod, the TG-16 natively spits out composite video and stereo audio. The problem is it's from a proprietary connector which means you can't just connect it to your TV. But if you add standard audio and video connectors you can easily connect to your TV. Here's a pinout of the TG-16 rear connector.
From column 1 we want "SNDR" and "SNDL" for right and left audio. And from column 22 we want "Vid" for the composite video. Here's a picture with the wires attached. I soldered onto the bottom side of the board then fed them through the holes to the top side. The orange and orange/white stripe are for audio, and the green is for the video. Ignore the other wires for now.
The last thing we need is a place to mount the video and audio connectors. I've seen a lot of similar mods on the Internet and they usually drill holes in the side or rear of the case. I decided to go a different route. Since I'm no longer using the RF output, I'll remove the RF box and mount the connectors there. Here's a picture with the RF box desoldered.
Next I took a video connector (digikey part number CP-1403-ND). I bent the center pin aft, and I bent one side pin out flat. Lastly I bent the video pin straight back. When I was done the connector looked like this.
On the TG-16 motherboard, I scraped some of the solder mask off where I removed the RF unit from.
Now I can place the connector onto the motherboard and solder it up. One leg of the connector goes through the existing hole, plus the two bent pins can be soldered onto where I removed the solder mask on the circuit board. This gives me 3 solid solder points so I doubt this connector will ever break off.
To mount the audio connector, I first needed to raise the connector up. If I mounted it flush on the board it did not line up with the existing hole in the side of the case. I found a hex nut that was just the perfect thickness. I used epoxy to attach the nut to the board.
Next I used epoxy to attach the stereo audio connector (CP1-3513-ND). I soldered up the audio and video cables. For the video cable I soldered a 220uF/16V bi-polar cap inline, and for the audio I soldered a 10uF/16V bi-polar cap inline. Lastly, I soldered the ground connector onto the motherboard.
When the system is put back together, this is what it looks like from the outside. I think it has a very clean and professional appearance.
But more importantly, what does the video quality look like? It's pretty darn sharp, especially compared to the RF (before I removed it). This picture doesn't do it justice, I was having a hard time getting good pictures of the TV screen. But the image is sharp and crisp.
In the final post I'll cover the additional mods to the system.
From column 1 we want "SNDR" and "SNDL" for right and left audio. And from column 22 we want "Vid" for the composite video. Here's a picture with the wires attached. I soldered onto the bottom side of the board then fed them through the holes to the top side. The orange and orange/white stripe are for audio, and the green is for the video. Ignore the other wires for now.
The last thing we need is a place to mount the video and audio connectors. I've seen a lot of similar mods on the Internet and they usually drill holes in the side or rear of the case. I decided to go a different route. Since I'm no longer using the RF output, I'll remove the RF box and mount the connectors there. Here's a picture with the RF box desoldered.
Next I took a video connector (digikey part number CP-1403-ND). I bent the center pin aft, and I bent one side pin out flat. Lastly I bent the video pin straight back. When I was done the connector looked like this.
On the TG-16 motherboard, I scraped some of the solder mask off where I removed the RF unit from.
Now I can place the connector onto the motherboard and solder it up. One leg of the connector goes through the existing hole, plus the two bent pins can be soldered onto where I removed the solder mask on the circuit board. This gives me 3 solid solder points so I doubt this connector will ever break off.
To mount the audio connector, I first needed to raise the connector up. If I mounted it flush on the board it did not line up with the existing hole in the side of the case. I found a hex nut that was just the perfect thickness. I used epoxy to attach the nut to the board.
Next I used epoxy to attach the stereo audio connector (CP1-3513-ND). I soldered up the audio and video cables. For the video cable I soldered a 220uF/16V bi-polar cap inline, and for the audio I soldered a 10uF/16V bi-polar cap inline. Lastly, I soldered the ground connector onto the motherboard.
When the system is put back together, this is what it looks like from the outside. I think it has a very clean and professional appearance.
But more importantly, what does the video quality look like? It's pretty darn sharp, especially compared to the RF (before I removed it). This picture doesn't do it justice, I was having a hard time getting good pictures of the TV screen. But the image is sharp and crisp.
In the final post I'll cover the additional mods to the system.
Wednesday, August 1, 2012
Project TG-16 - Recap
The next phase in Project TG-16 is to "recap," or replace all the electrolytic capacitors in the system. Electrolytic capacitors tend to go bad over time, they are one of the biggest causes of electronics failure. If you're trying to extend the life of a system then replacing the caps is a good thing to do. And it's fairly inexpensive given that high-quality caps cost only about 75 cents each delivered - soldering skill not included.
The TG-16 contains 16 electrolytic capacitors inside. Here is a picture of the motherboard with all cap locations identified.
And here's a list of capacitor values for each location (for now ignore the last 4 columns):
For the replacement caps I used all Panasonic brand FC series caps. This brand and series is regarded as being very high quality and long life. Another benefit is most audiophiles consider Panasonic FC series caps to be the best "general purpose" caps for audio applications. Some audio purists use different brand caps for audio applications. But by sticking with Panasonic FC series I avoid the need to worry about audio caps versus other use.
The next step is to bust out the soldering iron and get to work. This was relatively easy for me, but then I have a lot of experience recapping circuit boards.
One of the biggest questions is, was this worth all the effort? Before I recapped the system I knew it worked, so why bother. Well this system is 20+ years old, it may work now but for how much longer? So recapping it helps to ensure a long useful life. As it turns out, I can quantify how good/bad the existing caps are. There are two main ways to test a capacitor - capacitance and ESR. Capacitance is the number rating on the cap - so a 100uf capacitor should have a capacitance at or near 100. The second method is ESR or equivalent series resistance. This is a measure of how freely a capacitor gives up the electrical charge stored in the capacitor - the lower the ESR the better. As it turns out, ESR is a much better way of testing caps than capacitance. But I went ahead and tested capacitance and ESR for both the old caps coming out of the system as well as the replacement caps. If you look at the table above, I include the capacitance of the old cap (existing uf), ESR of the old cap (existing ESR), capacitance of the new cap (new uf), and ESR of the new cap (new ESR).
In all cases the capacitance was fine, both old and new. And in almost every instance the ESR of the new cap was significantly lower than the old cap - on average half as much. The one exception were the 10uf/16v caps. Much to my surprise the original caps had a lower ESR value even after 20 years. Those must have been an excellent batch from the factory.
I didn't stop at recapping the system either. I also have two controllers and a turbo tap which I also recapped. These were easy - each controller and the turbo tap contained a single 10uf/35v capacitor. The capacitance and ESR values were in line with what I saw in the system; the capacitance numbers were fine and the ESR of the new cap was about half that of the old cap.
Next we'll begin modding the system.
The TG-16 contains 16 electrolytic capacitors inside. Here is a picture of the motherboard with all cap locations identified.
And here's a list of capacitor values for each location (for now ignore the last 4 columns):
The next step is to bust out the soldering iron and get to work. This was relatively easy for me, but then I have a lot of experience recapping circuit boards.
One of the biggest questions is, was this worth all the effort? Before I recapped the system I knew it worked, so why bother. Well this system is 20+ years old, it may work now but for how much longer? So recapping it helps to ensure a long useful life. As it turns out, I can quantify how good/bad the existing caps are. There are two main ways to test a capacitor - capacitance and ESR. Capacitance is the number rating on the cap - so a 100uf capacitor should have a capacitance at or near 100. The second method is ESR or equivalent series resistance. This is a measure of how freely a capacitor gives up the electrical charge stored in the capacitor - the lower the ESR the better. As it turns out, ESR is a much better way of testing caps than capacitance. But I went ahead and tested capacitance and ESR for both the old caps coming out of the system as well as the replacement caps. If you look at the table above, I include the capacitance of the old cap (existing uf), ESR of the old cap (existing ESR), capacitance of the new cap (new uf), and ESR of the new cap (new ESR).
In all cases the capacitance was fine, both old and new. And in almost every instance the ESR of the new cap was significantly lower than the old cap - on average half as much. The one exception were the 10uf/16v caps. Much to my surprise the original caps had a lower ESR value even after 20 years. Those must have been an excellent batch from the factory.
I didn't stop at recapping the system either. I also have two controllers and a turbo tap which I also recapped. These were easy - each controller and the turbo tap contained a single 10uf/35v capacitor. The capacitance and ESR values were in line with what I saw in the system; the capacitance numbers were fine and the ESR of the new cap was about half that of the old cap.
Next we'll begin modding the system.
Saturday, July 28, 2012
Project TG-16 - Repair
The first step of this project is to repair the TG-16. It was sold on eBay as "broken" mainly because the person did not have the power cord so they couldn't test it. So at the worst this system may be so busted inside it's impossible to fix, or it may be as easy as buying a replacement power cord. Older electronics like this tend to be very robust, so I'm leaning towards the latter.
Before I even think about trying to power up the system, I want to have a look at the circuit board, to look for any obvious signs of damage. But immediately I ran into a problem. The TG-16 uses security screws. To open it up you need to order a "4.5mm security bit" easily found on eBay. Although the technical name is "4.6 line head screw." I ordered mine from ifixit.com. After you open the case, you discover the circuit board has an RFI metal shield soldered onto both sides. I used a lot of solder wick to get these metal plates off.
Having a look at the circuit board I saw no obvious signs of damage. So I connected it up to my Elenco power supply and turned it on. Success! It works just fine. So all I need is to buy a power supply. If you read my post on power cords, you know you can use other power cords so long as you know what you're looking for, it doesn't have to be an original part. The TG-16 is rated at 10.5 V at 730 mA, so I looked on eBay and found a 10 V at 1 A supply for a few bucks delivered. Even though the volts is a little lower, because of the difference between regulated and unregulated it won't matter, and the fact the amps is higher helps as well.
Next time I will cover recapping the system.
Before I even think about trying to power up the system, I want to have a look at the circuit board, to look for any obvious signs of damage. But immediately I ran into a problem. The TG-16 uses security screws. To open it up you need to order a "4.5mm security bit" easily found on eBay. Although the technical name is "4.6 line head screw." I ordered mine from ifixit.com. After you open the case, you discover the circuit board has an RFI metal shield soldered onto both sides. I used a lot of solder wick to get these metal plates off.
Having a look at the circuit board I saw no obvious signs of damage. So I connected it up to my Elenco power supply and turned it on. Success! It works just fine. So all I need is to buy a power supply. If you read my post on power cords, you know you can use other power cords so long as you know what you're looking for, it doesn't have to be an original part. The TG-16 is rated at 10.5 V at 730 mA, so I looked on eBay and found a 10 V at 1 A supply for a few bucks delivered. Even though the volts is a little lower, because of the difference between regulated and unregulated it won't matter, and the fact the amps is higher helps as well.
Next time I will cover recapping the system.
Project TubroGrafx-16
Just as I had "Project Genesis" where I repaired and modded a Sega Genesis, this is Project TG-16 where I repair and mod a TG-16. The plan is to repair the TG-16, perform some preventative maintenance, after which I will add a number of mods to the system to improve upon the original design. I'm going to add an audio/video mod, a power LED mod, and a reset button mod. I will document each step along with way with pictures.
Sunday, July 22, 2012
Cleaning TV/Monitor Screens
One thing that really bugs me is when people touch my monitor with their fingers. You can point at the screen, but don't touch it. But even if you don't touch the screen, eventually the screen will get dirty and need to be cleaned. For starters, do not use household cleaners like Windex, they contain ammonia which is bad for electronics. You can buy dedicated screen cleaners, but they charge a lot of money for a small bottle. Instead make your own at home for really cheap. All you need is 1) a spray bottle, 2) rubbing alcohol (the highest percentage you can find), and 3) distilled water. Pour the water and rubbing alcohol into the spray bottle about 50/50. For the water, do not use tap, filtered, or even bottled. It needs to be distilled water. Anything else will leave streaks. If you don't have distilled water, pretty much every grocery store and drug store carries it, and it usually costs about $1 for a gallon.
To clean a screen you need a clean cotton T-shirt. Lightly wad up part of the shirt, spray the cleaner onto the wadded part, then gently wipe the surface of the screen. You may need to do this several times. Do not spray directly onto the screen, it may run down and get into the electronics. Also, do NOT use paper towels, newspaper, tissue, bath towels, etc. These may feel soft to you and I, but they will leave fine scratches on the screen. As it turns out a clean cotton T-shirt is one of the softest fabrics out there. Finally, use very light pressure. Firm pressure could damage the screen, especially LCD panels.
If you follow these steps you can clean your screen as good as the day you bought it, and with no streaks.
Friday, July 20, 2012
DSL filters
If you saw my recent Ooma posts you know I recently ditched my home phone and switched to VOIP. Before the switch I had phone and DSL through AT&T, now I just have DSL through AT&T. When you run DSL, they provide you a DSL filter for each phone jack. These DSL filters come in different shapes and sizes, but often times they are a pigtail you plug into the wall. On the other end of the pigtail are two female phone plugs, one for the DSL modem and one for your house phone.
Now that I no longer have a house phone, I only have DSL, the question is do I still need the DSL filter? The answer is no. The purpose of the DSL filter is to "filter out" the DSL frequencies from the standard voice frequencies. Voice frequencies do not interfere with DSL communications, but without the filter you can hear a high-pitched squeal on the line.
About a year ago one of my DSL filters went bad and I had to replace it. But being the nerd that I am, I took apart the old one. I was surprised how simple it was inside. There were just a few passive components (coils and capacitors) inside to filter out the unwanted frequencies. It looked something like this.
I followed the traces on the circuit board. The input line was immediately split. One pair went straight to the DSL output jack, the other pair went through the passive components and then onto the output phone jack. This is why I suspected the DSL filter is not necessary for DSL only (a.k.a. dry-loop DSL).
Of course the real test is, if I remove the filter does it still work. So I removed my DSL filter and the Internet still works. I'm a firm believer in simplify everything. If you don't need it, get rid of it. So if you're running DSL only without a standard phone line, you do not need the DSL filters.
Now that I no longer have a house phone, I only have DSL, the question is do I still need the DSL filter? The answer is no. The purpose of the DSL filter is to "filter out" the DSL frequencies from the standard voice frequencies. Voice frequencies do not interfere with DSL communications, but without the filter you can hear a high-pitched squeal on the line.
About a year ago one of my DSL filters went bad and I had to replace it. But being the nerd that I am, I took apart the old one. I was surprised how simple it was inside. There were just a few passive components (coils and capacitors) inside to filter out the unwanted frequencies. It looked something like this.
I followed the traces on the circuit board. The input line was immediately split. One pair went straight to the DSL output jack, the other pair went through the passive components and then onto the output phone jack. This is why I suspected the DSL filter is not necessary for DSL only (a.k.a. dry-loop DSL).
Of course the real test is, if I remove the filter does it still work. So I removed my DSL filter and the Internet still works. I'm a firm believer in simplify everything. If you don't need it, get rid of it. So if you're running DSL only without a standard phone line, you do not need the DSL filters.
Tuesday, July 10, 2012
Ooma
Last time I talked about switching our home phone from a standard landline to a VOIP (or Internet) phone through Ooma. In short, I couldn't be happier with the switch. The sound quality with Ooma is as good, if not better, than it use to be. Before buying the Ooma I was a little hesitant, at work we have a VOIP system and whereas it works good, from time to time the call breaks up. But so far with Ooma that hasn't happened. Ooma's marketing dept. likes to boast about how they have gone to great lengths to ensure the best sound quality in the industry. So far their claims appear to be true.
The Ooma Telo itself is a very cool looking device. It clearly has a modern look to it that is pleasant. The buttons use capacitance touch so they are not physical tactile buttons at all. Just touch the light to activate the button. My only complaint with the Ooma Telo is the LED lights. All of the buttons are blue LEDs which are always on and very bright. At night it lights up the room it's in. You wouldn't want this in the same room where you sleep. What Ooma needs to do is A) decrease the brightness of the LEDs and B) only activate the lights for the buttons when someone is using them. I've seen TVs with capacitance touch lighting similar to this. When you press the buttons they light up and stay lit for several seconds. That's what Ooma should do. The Ooma logo can remain lit 24/7 as that's an indicator if the Ooma is connected to the Internet. But turn off the lights for the buttons. Overall this is a fairly minor gripe for such a great product.
The last thing I'll talk about is configuring the Ooma in my network. The Ooma itself is fairly flexible; you can place the device between your cable/DSL modem and your router/firewall and Ooma will automatically apply QoS to ensure the best sound quality. Or you can put Ooma behind the firewall, which is what I chose to do. Doing so means Ooma has to compete with everything else for bandwidth, so if you're downloading a large file on another computer it could interfere with call quality. So I manually configured QoS on my router.
My router is a Linksys with the 3rd party Tomato firmware installed. There are a lot of sites that talk about how to configure QoS for VOIP; prioritize these ports and protocols, etc. But I decided to go the easy route. First I found the MAC address of the Ooma. Second I configured any and all traffic to/from that MAC address to have the highest priority. So I don't bother isolating port ranges and protocols, I just do one classification for the Ooma device's MAC address. So far this configuration is working great!
Bye bye landline. Hello VOIP!
Unlike most people I do not have (nor have I ever had) a cell phone, so a landline at home is my only phone. However, I've noticed my home phone bill was slowly creeping up each month. A recently bill was $31.93. Now this may not sound like a lot, but you have to realize I haven't had a long distance carrier on my home phone for well over 10 years. So $32 is for the absolutely basic local-only phone package with no additional features.
I started looking into other options and a friend recommended a phone system called Ooma. Ooma is a VOIP (Voice Over IP) phone - or put simply an Internet phone. They've been around since 2004 and have really become popular as of the last several years. The way Ooma works is you buy the Ooma Telo for a one-time fee of $200. After that all you pay is the federally-mandated monthly taxes which are about $3.50 (they vary depending on where you live). So for a few bucks a month you get a phone with free unlimited local and long distance calling plus features like caller-Id and voicemail. Ooma also offers an optional "Premier" account that adds additional features like up to four active phones at one time on the same phone number, three-way calling, integration with Google Voice, etc. for $10/month.
So let's recap. Old phone with AT&T; local-only, no long distance, no caller-id, about $30/month. New phone with Ooma, unlimited local and long distance, includes caller-id, about $3/month. Hmm, seems like a no-brainer to me.
As an added bonus, our DSL Internet got cheaper as well. Previously DSL cost $43/month, but to drop the phone line AT&T had to cancel the account and create a new DSL-only account, and they signed me up at $25/month for the same speed level.
The hardware cost $200, and it was another $40 to port our existing home phone number to Ooma - but we're saving about $45 a month. At that rate it's just over 5 months until we break even, and after that it's nothing but savings!
Next time I'll talk about the hardware itself, the sound quality, and my opinions of the system.
Star Wars parody videos
Time for some Star Wars parody videos.
Original video - "Somebody That I Used to Know" by Goyte
Parody video - "The Star Wars That I Used to Know" by Teddie Films
Original video - "Friday" by Rebecca Black
Parody video - "Primeday" by Teddie Films
Original video - "Somebody That I Used to Know" by Goyte
Parody video - "The Star Wars That I Used to Know" by Teddie Films
Original video - "Friday" by Rebecca Black
Parody video - "Primeday" by Teddie Films
Is Thunderbird going to die?
Mozilla's justification for this is a lack of interest in Thunderbird. They say most people use web-based email access. Who are these idiots out there checking their email using web-based programs, at least from a desktop computer? Seriously, if you are using the native web-based UI for services like gmail, hotmail, etc., give Thunderbird a try. It's a LOT better, not to mention more secure. The only time I use the web-based interface is if I'm checking my email from a friend's computer.
This really frustrates me because Thunderbird is my email client of choice. When it comes time to find a new client, I'm not sure what I'm going to switch to. If anyone can recommend a good standalone email client for Windows please do so. The client must support IMAP as well as POP3.
Monday, June 18, 2012
Password Security - Why limit me?
I wasn't planning another post in the password security series, but I felt I just had to. If you read my previous posts you know that I recently went through and changed all my passwords (close to 100) to long complex password. For example, a new password might look like "\mFYZWLbCc:bmf^Pe/cJ"
One annoying problem however, I was shocked by how many online sites would reject these new complex passwords. It's normal for sites to reject passwords that do NOT contain mixed uppercase and lowercase as well as a number, because these passwords aren't complex enough. But a shockingly large number of sites rejected my new passwords because they were too complex, which makes absolutely no sense! For the most part the rejections fell into one of two categories.
1. Passwords were rejected because they contained symbols (oh, got to watch out for those pesky symbols). Seriously, you're rejecting my password because I used symbols like #, %, &, <, etc.? As a user I should be allowed to use any letters, numbers, or symbols I want in my password. The more possible characters to choose from the more secure my password, so they should be encouraging me to use these symbols, not preventing me.
2. Passwords were rejected because they were too long. A lot of sites limited my password to 12, 16, or 20 characters. As I previously said, the longer the better, so they should not only allow long passwords but they should encourage them. One site even limited me to 8 characters as a maximum length!
In both of these cases, these online sites need to take a lesson from Microsoft Windows. Microsoft got password security right. Windows passwords can contain ANY character, including things like high-ASCII characters. Also, the Windows password can be up to 256 characters in length. This is how online sites should be. Obviously they shouldn't force you to have such long complex passwords, but they definitely shouldn't prevent it.
There is one last thing which I just couldn't believe. One site allowed me to change my password to a long 20 character password. After setting my new password, I would always log off and then log back in, just to make sure it worked. When I tried to log back in I got an error message saying "You cannot enter a password longer than 16 characters." Huh, you just let me set a 20 character password, but you won't let me login with anything more than 16. Where is QA at this place? Clearly the right hand doesn't know what the left is doing. And what's really sad, this was a VERY large organization (multi-billion dollar), they should have one of the best systems available. But this didn't exactly inspire confidence in me.
One annoying problem however, I was shocked by how many online sites would reject these new complex passwords. It's normal for sites to reject passwords that do NOT contain mixed uppercase and lowercase as well as a number, because these passwords aren't complex enough. But a shockingly large number of sites rejected my new passwords because they were too complex, which makes absolutely no sense! For the most part the rejections fell into one of two categories.
1. Passwords were rejected because they contained symbols (oh, got to watch out for those pesky symbols). Seriously, you're rejecting my password because I used symbols like #, %, &, <, etc.? As a user I should be allowed to use any letters, numbers, or symbols I want in my password. The more possible characters to choose from the more secure my password, so they should be encouraging me to use these symbols, not preventing me.
2. Passwords were rejected because they were too long. A lot of sites limited my password to 12, 16, or 20 characters. As I previously said, the longer the better, so they should not only allow long passwords but they should encourage them. One site even limited me to 8 characters as a maximum length!
In both of these cases, these online sites need to take a lesson from Microsoft Windows. Microsoft got password security right. Windows passwords can contain ANY character, including things like high-ASCII characters. Also, the Windows password can be up to 256 characters in length. This is how online sites should be. Obviously they shouldn't force you to have such long complex passwords, but they definitely shouldn't prevent it.
There is one last thing which I just couldn't believe. One site allowed me to change my password to a long 20 character password. After setting my new password, I would always log off and then log back in, just to make sure it worked. When I tried to log back in I got an error message saying "You cannot enter a password longer than 16 characters." Huh, you just let me set a 20 character password, but you won't let me login with anything more than 16. Where is QA at this place? Clearly the right hand doesn't know what the left is doing. And what's really sad, this was a VERY large organization (multi-billion dollar), they should have one of the best systems available. But this didn't exactly inspire confidence in me.
Wednesday, June 13, 2012
Password Security - Tying it all together
Previous I listed the different categories of passwords I have. Prior to that I talked out how programs like KeePass and LastPass are great for storing passwords, and the password manager built into your web browser is convenient but has flawed security. Now it's time to tie it all together and talk about the new password scheme I have implemented to protect me and my privacy on the Internet.
First, I decided each and every site will get a unique password - no more shared passwords. I don't want a compromised password at one site compromising any other sites. Second, each password (with a few notable exceptions) will be a long complex password that is difficult to remember. When I say long complex passwords, I mean something like "f2FQumZoxwP64qMgy2v1." All of these long complex passwords will be stored in KeePass, so I don't have to try and remember them. And even though the password manager built into the web browser has proven weaknesses, I will use it because of it's convenience factor for some of the passwords. I want to keep as few of passwords in the web browser password manager as possible, that way if it is compromised I have limited exposure. So I will only put a password into the web browser's password manager if A) I've deemed that site to be a low security risk and B) it's a site I access frequently. In all other instances I will manually copy the password from KeePass into the browser.
So here's how this scheme affects the categories I previously discussed:
Banking
Banking and financial sites are considered high security. So they will get the longest most complex passwords, none of which will ever get stored in the browser's password manager. When I do need to log in I will copy the password from KeePass.
Online Stores
Just like above, long complex passwords that I will not store in the web browser. I will copy them from KeePass anytime I want to order something.
Utilities
Utilities will be treated the same, long complex passwords that I will not store in the web browser. Since I only login monthly, I will copy them from KeePass anytime I pay a bill.
email
Email is the fly in the ointment if you will. I want a really long complex password because I consider the info in my email to be sensitive, but I want to be able to check my email from any computer which means I need to be able to remember my password. So I've gone with the longest most complex password that I was able to remember. Most of the time I check my email using Thunderbird which handles passwords for me. So I only need to remember the password for checking email from a strange computer.
Social media
These sites will get medium-length complex passwords. I don't use social media that often, so when I do I will manually copy my passwords from KeePass.
Work
Work sites I only access from work (surprise surprise). And the data stored there isn't very sensitive. I will still use medium-length complex passwords, but I will allow the web browser's password manager to remember them.
Forums and everything else
Any finally the bulk of my accounts. I will use medium-length complex passwords for all of them. If I access the site frequently I'll allow the web browser's password manager to remember them, else I'll copy them manually from KeePass.
So that's my new password scheme. All complex and unique passwords, with the exception of email passwords which I need to be able to remember. And most of these passwords are stored only in KeePass, the browser is only allowed to remember passwords for low-risk but frequently used sites. Yes, this new scheme is less convenient. But it protects me better in the event a password is compromised in the future.
First, I decided each and every site will get a unique password - no more shared passwords. I don't want a compromised password at one site compromising any other sites. Second, each password (with a few notable exceptions) will be a long complex password that is difficult to remember. When I say long complex passwords, I mean something like "f2FQumZoxwP64qMgy2v1." All of these long complex passwords will be stored in KeePass, so I don't have to try and remember them. And even though the password manager built into the web browser has proven weaknesses, I will use it because of it's convenience factor for some of the passwords. I want to keep as few of passwords in the web browser password manager as possible, that way if it is compromised I have limited exposure. So I will only put a password into the web browser's password manager if A) I've deemed that site to be a low security risk and B) it's a site I access frequently. In all other instances I will manually copy the password from KeePass into the browser.
So here's how this scheme affects the categories I previously discussed:
Banking
Banking and financial sites are considered high security. So they will get the longest most complex passwords, none of which will ever get stored in the browser's password manager. When I do need to log in I will copy the password from KeePass.
Online Stores
Just like above, long complex passwords that I will not store in the web browser. I will copy them from KeePass anytime I want to order something.
Utilities
Utilities will be treated the same, long complex passwords that I will not store in the web browser. Since I only login monthly, I will copy them from KeePass anytime I pay a bill.
Email is the fly in the ointment if you will. I want a really long complex password because I consider the info in my email to be sensitive, but I want to be able to check my email from any computer which means I need to be able to remember my password. So I've gone with the longest most complex password that I was able to remember. Most of the time I check my email using Thunderbird which handles passwords for me. So I only need to remember the password for checking email from a strange computer.
Social media
These sites will get medium-length complex passwords. I don't use social media that often, so when I do I will manually copy my passwords from KeePass.
Work
Work sites I only access from work (surprise surprise). And the data stored there isn't very sensitive. I will still use medium-length complex passwords, but I will allow the web browser's password manager to remember them.
Forums and everything else
Any finally the bulk of my accounts. I will use medium-length complex passwords for all of them. If I access the site frequently I'll allow the web browser's password manager to remember them, else I'll copy them manually from KeePass.
So that's my new password scheme. All complex and unique passwords, with the exception of email passwords which I need to be able to remember. And most of these passwords are stored only in KeePass, the browser is only allowed to remember passwords for low-risk but frequently used sites. Yes, this new scheme is less convenient. But it protects me better in the event a password is compromised in the future.
Password Security - Password theory
This post will be a tangent from my password security thread. I wanted to discuss some of what I consider to be interesting facts about passwords and security.
The "strength" of a password is determined by several factors. For example, a lot of sites require your password to contain lowercase (a-z), uppercase (A-Z), numbers (0-9), and symbols (!, @, #, $, etc.). The more of these different categories you use the more "secure" your password is. If you use a lot of repetitive letters that weakens your password. So "1$eDDDD" is weaker than "aB#d63r" They are both the same length, but because the first repeats the letter 'D' it is considered weaker.
Another aspect that weakens passwords is the use of words and names. For example "3David@" is a weak password, as is "!32House" Passwords like this, with words and names in them, are more susceptible to what's called a dictionary attack. Basically the attacker uses a list of works and names in an effort crack your password.
However, the way to make the strongest password possible is actually overlooked the most. It has been shown that the overall length of a password is by far the best way to improve password security. Let's compare the following two passwords; "e$5Ty_Q" and "chocolate bear house river" The first contains lowercase, uppercase, symbols and numbers whereas the second only contains lowercase. The first does not contain real words whereas the second is nothing but real words. Despite all this, the second password is far more "secure" simply because it's 26 characters long whereas the first only contains 7. Now, if the first password were longer it would be more secure. So "05gFxiTCrpsWADudUckJ" is more secure than "chocolate bear house river" although the second is easily remembered by a human. So what's the take home lesson? If you need a secure password, think less about complexity which is hard to remember, and think more about length.
The "strength" of a password is determined by several factors. For example, a lot of sites require your password to contain lowercase (a-z), uppercase (A-Z), numbers (0-9), and symbols (!, @, #, $, etc.). The more of these different categories you use the more "secure" your password is. If you use a lot of repetitive letters that weakens your password. So "1$eDDDD" is weaker than "aB#d63r" They are both the same length, but because the first repeats the letter 'D' it is considered weaker.
Another aspect that weakens passwords is the use of words and names. For example "3David@" is a weak password, as is "!32House" Passwords like this, with words and names in them, are more susceptible to what's called a dictionary attack. Basically the attacker uses a list of works and names in an effort crack your password.
However, the way to make the strongest password possible is actually overlooked the most. It has been shown that the overall length of a password is by far the best way to improve password security. Let's compare the following two passwords; "e$5Ty_Q" and "chocolate bear house river" The first contains lowercase, uppercase, symbols and numbers whereas the second only contains lowercase. The first does not contain real words whereas the second is nothing but real words. Despite all this, the second password is far more "secure" simply because it's 26 characters long whereas the first only contains 7. Now, if the first password were longer it would be more secure. So "05gFxiTCrpsWADudUckJ" is more secure than "chocolate bear house river" although the second is easily remembered by a human. So what's the take home lesson? If you need a secure password, think less about complexity which is hard to remember, and think more about length.
Password Security - Part 3
After reading my last post, hopefully you figured out all the passwords you have and entered them into a program like KeePass. For me, when I collected them all in one place, I was surprised to realize I have almost 100 different sites with passwords. The next goal is to group all these different sites into categories. At first I didn't know what the different categories would be, I just had to look at what I had and logically arrange them. Once I had the categories, I considered what level of security I wanted for that category. I also looked at how frequently (or infrequently) I accessed the sites in that category. To me, daily or weekly is considered frequent and monthly or greater is considered infrequent. And lastly, I took into consideration where I access that site from. The vast majority of the time I'm "surfing" the Internet from either my home computer or my work computer. But what if I'm using a friend's computer, a computer in the library, Internet cafe, etc. Do I want to be able to log in to my accounts from these less trusted sites?
Category: Banking
Description: This categories is pretty straight forward - it's banking, credit, and financial sites.
Security: Highest
Frequency: Infrequent (monthly at best)
Location: Home and work only. I wouldn't trust any other computer to log in to these sites. I would hate for a virus or key logger to compromise my banking accounts.
Category: Online Stores
Description: This group is all the online stores I have an account with.
Security: High - most of these sites store credit card info which I don't want compromised.
Frequency: Most infrequently (many of the sites I only have a password because I needed to create an account for a one-time purchase), but a select few are frequent.
Location: Home and work only. I don't order things when traveling or from someone else's house.
Category: Utilities
Description: All of my monthly bills; e.g. gas, water, power, trash, etc.
Security: High - utilities, like online stores, persist financial account info.
Frequency: Infrequently (monthly)
Location: Home only. I'm not going to want/need to pay a bill from a computer other than my own.
Category: email
Description: Like many people I maintain several email accounts.
Security: High - I consider email to be a very high security, probably higher than most people would. Most email sites these days keep all your old emails. That's a lot of personal info about me I don't want compromised, including emails from my banks, utilities, etc. There is easily enough info in there to commit identity fraud.
Frequency: Frequent (daily)
Location: Anywhere - I would like the ability to log in and check my email from any computer; home, work, friend or family, strange computer in the airport, etc.
Category: Social media
Description: Although I don't have many, I have a few "social media" account.
Security: Medium - whereas they don't have financial info about me, typically social media sites do have a lot of personal info which would be useful for someone trying to commit identify fraud.
Frequency: Frequent (weekly)
Location: Anywhere - Like email, I would like the ability to log in to social media sites from any computer.
Category: Work
Description: I have a small number of sites that I access for my job. From a personal standpoint the security level should be low, but I'll bring it up to medium since some of the sites might contain company secrets.
Security: Medium
Frequency: Frequent
Location: Work
Category: Forums and everything else
Description: I have tons of forums, bulletin boards, and other informational sites with accounts to. Often times these are read-only, the site just requires you to create an account to access the info and/or download the files. I consider all of these sites to be low security. Do I really care if someone logs in as me to download trial software from VMWare? No.
Security: Low
Frequency: Frequent (for some of the forums) and infrequent for many of the others.
Location: Home and work only. Most of these accounts are forums, and you can still read posts without logging in. So I can still access them read-only from any computer, but I'm fine only posting from my home and/or work computers.
There you have it, a break down of the categories I came up with. Each of my almost 100 sites fits into one of these categories. In my next post I'll discuss the password scheme I've come up with to be able to access these sites while maintaining an acceptable level of security.
Category: Banking
Description: This categories is pretty straight forward - it's banking, credit, and financial sites.
Security: Highest
Frequency: Infrequent (monthly at best)
Location: Home and work only. I wouldn't trust any other computer to log in to these sites. I would hate for a virus or key logger to compromise my banking accounts.
Category: Online Stores
Description: This group is all the online stores I have an account with.
Security: High - most of these sites store credit card info which I don't want compromised.
Frequency: Most infrequently (many of the sites I only have a password because I needed to create an account for a one-time purchase), but a select few are frequent.
Location: Home and work only. I don't order things when traveling or from someone else's house.
Category: Utilities
Description: All of my monthly bills; e.g. gas, water, power, trash, etc.
Security: High - utilities, like online stores, persist financial account info.
Frequency: Infrequently (monthly)
Location: Home only. I'm not going to want/need to pay a bill from a computer other than my own.
Category: email
Description: Like many people I maintain several email accounts.
Security: High - I consider email to be a very high security, probably higher than most people would. Most email sites these days keep all your old emails. That's a lot of personal info about me I don't want compromised, including emails from my banks, utilities, etc. There is easily enough info in there to commit identity fraud.
Frequency: Frequent (daily)
Location: Anywhere - I would like the ability to log in and check my email from any computer; home, work, friend or family, strange computer in the airport, etc.
Category: Social media
Description: Although I don't have many, I have a few "social media" account.
Security: Medium - whereas they don't have financial info about me, typically social media sites do have a lot of personal info which would be useful for someone trying to commit identify fraud.
Frequency: Frequent (weekly)
Location: Anywhere - Like email, I would like the ability to log in to social media sites from any computer.
Category: Work
Description: I have a small number of sites that I access for my job. From a personal standpoint the security level should be low, but I'll bring it up to medium since some of the sites might contain company secrets.
Security: Medium
Frequency: Frequent
Location: Work
Category: Forums and everything else
Description: I have tons of forums, bulletin boards, and other informational sites with accounts to. Often times these are read-only, the site just requires you to create an account to access the info and/or download the files. I consider all of these sites to be low security. Do I really care if someone logs in as me to download trial software from VMWare? No.
Security: Low
Frequency: Frequent (for some of the forums) and infrequent for many of the others.
Location: Home and work only. Most of these accounts are forums, and you can still read posts without logging in. So I can still access them read-only from any computer, but I'm fine only posting from my home and/or work computers.
There you have it, a break down of the categories I came up with. Each of my almost 100 sites fits into one of these categories. In my next post I'll discuss the password scheme I've come up with to be able to access these sites while maintaining an acceptable level of security.
Subscribe to:
Posts (Atom)