Given the massive security breach of the Gawker network of websites this weekend, it is a good opportunity to review password security. Users tend to accrue many accounts across a variety of services and sites as they use the internet. You might have one username and password for your web-based e-mail (HotMail, Yahoo, GMail, etc.) and another for your online shopping (Amazon, eBay, Red Envelope, etc.). You could also have accounts for your online banking and credit accounts. Add to those the social services you use (Twitter, Facebook, MySpace, FourSquare, etc.) and you can have more accounts than you know what to do with. The easy thing to do is to give up trying to remember different usernames and passwords across all of these sites and use the same one every time. This is very, very dangerous behavior, and I encourage everyone to move towards better online account security.
First, a brief discussion of why this behavior is dangerous. Let's say your name is Janet Weiss and your e-mail address is janetweiss@hotmail.com. For all of the sites you visit you use the username: janetweiss@hotmail.com. On every site you use the same password: 10041946 (your birthday). You use this same account information on every site you use on the internet: everything from your bank's website to the local message board for movie enthusiasts. Let's say that the folks running that message board aren't entirely on the up-and-up, and rather than hashing your password like they are supposed to, they store it in clear text in their database of users. One of the folks with access to this database, let's call him Floyd, can't resist the temptation and prints off a list of usernames and passwords, including yours. Floyd spots your username is your e-mail address, and tries logging into your account with the same password you used on the message board. Success, Floyd is now into your mailbox! Here, Floyd does a quick search to see what other accounts you might have. He turns up old mail that tells him all about the places you do your banking, shopping, and other online activities. He tries that same username and password at your bank and he's in! He quickly sets up a few major transfers between your bank account and anonymous accounts he has set up for himself. He regularly checks your mail and deletes any notifications you get about the transfer. A few days later, once the transfer is complete, Floyd is walking around with a pocketful of your savings.
Ouch! So what can you do to protect yourself from this sort of thing? The obvious answer is to not use the same password on all of your accounts. This can seem like a daunting task, especially if you enjoy using many services on the web. How are you supposed to remember all of those usernames and passwords?
As a first step, I recommend picking two or three passwords that you can remember. Make one a really difficult password, like a jumble of numbers, letters, and symbols that has no meaning to you. This is your 'high security' password. Only use this password on sites that you absolutely trust, and that protect your most important information, such as your bank. Be sure that if you are using this password that the site you are entering it on is using an SSL Certification (an easy way to check is to verify the web address starts with https:// not http://). Your browser might also put a lock symbol next to the URL. Your other password(s) is your insecure password. Use this on sites that you don't necessarily trust, but need an account to access. Using this password is a reminder that anything you enter on the site is probably insecure, so act accordingly. Also, assume that every place you use this password, someone else is going to figure it out and get access to the account. Never, under any circumstance, enter your critical account information (such as bank account or credit card number) on a site that does not use a security certificate (https).
Better, but still not a great feeling, right? If someone manages to figure out that 'high security' password, they will still have access to *all* of your sensitive accounts. The next step is to use different passwords on every service you use. That can be really intimidating if you use a lot of services. Fortunately, there are some tools available to help you. First, find a password manager you like, and start using it. I use KeePass, and I highly recommend it. KeePass allows you to save a username and password for all of the different sites and services you use. The information is stored in a secure, encrypted file. You can only open this file by entering a password. Pick a really strong password for this file, as it protects all of your other account information. KeePass will also generate strong passwords for you. Definitely take advantage of this feature. Once you start using KeePass (or any other password manager) there really isn't any reason to remember your individual site passwords. Just pull up the password manager and copy the password for the service you want to use to the clipboard, then paste it on the login screen.
This works great from one computer, but what do you do when you move between several computers in a day? One solution is to store the encrypted password file on a site that you can access from anywhere. I recommend Dropbox. You can install Dropbox on as many computers (and your smartphones as well) as you like and get 2GB of storage for free. Dropbox will synchronize the files you store with it across all of these machines. That way, when you add a new password to your list at work, you still have access to it when you get home. KeePass and DropBox both have apps for Android and iPhone as well, so you can load it on your smartphone and carry your passwords with you anywhere. If you don't have a smartphone, consider purchasing a cheap USB memory stick and putting it on your keychain. You can install KeePass to the memory stick and save your password file there, allowing you to carry it with you wherever you go. That way, if you stop in an internet cafe or library, you can still have access to all of your passwords.
Online security can be confusing, and it is easy to make yourself vulnerable to attack. Taking the step of using a password manager and different passwords on every site you use is a big step towards limiting your risk when using the web.
Password Security
Posted by Adam Jones Labels: security at 9:40 AM 1 comments
YAGRAC
I've been wanting to learn how to develop for the Android platform, and I recently took some time to start a project to do just that. YAGRAC is Yet Another GoodReads Android Client. I've made the source code open source, so feel free to take a look or download the client and let me know what you think.
GoodReads is a social book reading service that I am a huge fan of. You can keep track of books that you have read, want to read, or are currently reading. Your friends can follow your list of books to see what you are up to. It is great for finding like-minded readers and discovering new books to enjoy. The GoodReads site is great, but when I'm away from my desk the mobile site leaves me wishing for more. GoodReads does not have an official app for iPhone or Android, so I though, why not make one myself! So far I have implemented the ability to read updates from friends, browse books on my own shelves or someone else's shelves, search for books, and review my list of social contacts (friends, followers, and following).
This project has proven to be a very good and effective learning opportunity. As I encounter interesting bits I will be sure to share them here.
Posted by Adam Jones Labels: android, books, development, gadgets, java, mobile, programming at 5:34 PM 0 comments
Exercise Tracking Applications
I enjoy going out for a jog a few times each week. It is a good way to keep in shape, and it it gives me some personal time to zone out, listen to a podcast or music, or just collect my thoughts. I'm also a geek, and I love stats. I love collecting stats from my runs. I've used a number of different run tracking gadgets and applications, and I thought I would share my thoughts on each.
Posted by Adam Jones Labels: applications, fitness, gadgets at 10:00 AM 4 comments
Effective Presenting
I've given a number of presentations to a variety of audiences. Over time I've developed a mental list of things to look for in providing an effective presentation.
Posted by Adam Jones Labels: business, work at 10:00 AM 0 comments
eBook Readers
I enjoy reading books from time to time, and the amount of reading I have done over the past few years has really increased. Maybe it is a sign of getting older, but I find myself spending less time on video games and more time on movies and books. A number of my friends are avid readers as well, and it is nice to keep up with what everyone is reading through the GoodReads website. One of my friends, @asniksch, is an avid reader and was an early adopter of the Sony eReader products. I scoffed with derision at the idea: paying hundreds of dollars for the privilege to pay double the regular price of a book, and then to be limited to battery life? It seemed ludicrous. He liked the product, but noted a number of major drawbacks that resulted in disuse after a period of time.
Posted by Adam Jones Labels: books, gadgets at 9:31 AM 0 comments
Quit Pushing Buttons!
For some time now I have been accusing my wife of pressing buttons on the phone in the middle of our conversations. At least once in every phone our conversation is interrupted by the distinctive tone of a button press. I'm not the only one to notice this either, as other folks she speaks with regularly also remark on how, occasionally, they hear a button press mid-call. My wife is certain that she isn't pressing anything, and is perplexed as to how this is happening. In investigating a solution to a different problem, I think I might have found the answer.
Posted by Adam Jones Labels: gadgets, google at 8:31 AM 0 comments
Indianapolis Water
How much attention do you pay to your bills? Do you go through them line by line? Do you save the invoice? I drive my wife bonkers because I save all of the invoices from every bill. I also go through them line by line. I've gotten into the habit of scanning the invoices and destroying the originals to save on stored paper in the house, but at any time I can go through our old bills and make comparisons.
I'm also a nut for maintaining a budget in our house. I know how much to expect on a bill for any given period, and when a bill is off from that expectation I go through it line by line to find out why. Our cable and internet bill is usually the one that gets the most attention as I'm always watching for those introductory discounts to fall off. I was a bit surprised over the course of the last year to find that the Indianapolis Water bill was also fluctuating in seeming erratic fashion.
For those of you in the Indianapolis area serviced by Indianapolis water, go take a look at your bill. You'll notice that there are a few factors that make up your bill: a base rate, volume of water used (in 100's of cubic feet), rate applied to that volume usage, and a tax percentage. The Indianapolis Water utility folks come out from time to time and take a look at the meter leading into your house to get a reading on how much water you have used. They don't do this every month, so you may notice some bills marked with an 'E' to indicate that the volume usage was estimated for the month, and that the next month they will come out for a proper measurement.
Over the course of the last year I've noticed a significant increase in our bill. I was curious why: were we using more water, had the rate gone up, or was it some combination of both. I naturally suspected that our summer bills would be a bit higher as we watered the lawn and filled the inflatable pool for the kids, but I was very surprised to see that our winter bills were higher than those from the summer. What was going on?!
I went through all of those saved bills (huzzah!) and made a spreadsheet looking at our usage and costs throughout the year. Here is what I found:

This chart shows our bill from 01/30/2009 through 02/25/2010. For the first half of 2009 the trend was fairly level, but then we see that increasing trend, even through the winter. That concerned me. So what about my usage?

Well, that explains part of it. Our usage did go up through the winter months. I have a couple of theories on that. One, we have three kids, and in August our youngest hit the one year mark. Three young kids get dirty, no matter what time of year, and that means lots of baths. It also means lots of laundry and lots of dishes. So this could conceivably account for our usage increase. Still, our bill increased by nearly 50%, while our usage only increased by around 30%. Where did the additional cost come from? The Indianapolis Water bill indicates the base rate (what you pay regardless of how much water you use), but does not indicate the usage rate (what you pay for each 100 cubic feet of water). So I charted those as well.
.png)
Yuck, our base rate went up by about a dollar each month.

Whoah, and we had a 20 cent increase per 100 cubic feet. Double whammy!
So that explains why my bill has increased: increased usage coupled with increased base and variable rates. All together, the bill breaks down as follows:
| Item | Jan 2009 Rate | Jan 2010 Rate |
| Base Rate | $8.21 | $9.10 |
| Cost per 100 cubic feet | $1.82 | $2.02 |
| Tax | 7% | 7% |
The only part of this bill that remained constant over that period was the tax rate of 7%. I'm still curious why the base rate and variable rates fluctuated from May through September of 2009. I would have expected a clean cut-over from one rate to another, but instead we see it bobble up and down until it settles on a rate in October. Have you noticed similar behavior in your bills?
An interesting bit of trivia - Indianapolis Water provides the water, and Hamtilton Southeastern Utilities takes care of sewage. In this same period, my Hamilton Southeastern Utilities bill remained a constant $33.55.
Posted by Adam Jones Labels: economy, government, life at 12:28 PM 2 comments
2010 Shamrock Run
I've been pretty good about regularly jogging over the past year. At least twice a week I would be on the treadmill at night getting in about 5K. I kept telling myself that I was going to enter at least one 5K race in 2009, but it never happened. A few weeks ago I saw that my friend Chris had completed a 5K as part of the training series for the Indy 500 Mini Marathon. I remembered how I had failed on my promise to myself in 2009 and resolved to make it happen in 2010.
My first task was to find a way to start running outside. Running on a treadmill is convenient, and it is good exercise, but it is definitely not the same as running outside. My typical day was to wake up a little before 8am, get prepped and out the door by 8:30 and into the office around 9:30am. Most evenings I left work between 6:30 and 7:00. Getting home so late meant that, even if the sun were still out, my family wasn't going to wait around on me to run before having supper. So my running time didn't come up until after dinner and getting the kids to bed, which means 9pm at the earliest. It's pretty dark at 9pm in Indiana, especially in February. Most nights I don't get to bed until 2 or 3 in the morning. I've been like that all my life - I've always had trouble going to bed at a decent hour, but I seem to operate just fine on only a few hours of sleep each night. I'm definitely not a morning runner, so I had to find a way to be able to get home with a enough time to run before dinner, and while the sun was still up.
My solution was to shift the start of my day back. Now my alarm goes off at 6am and I'm usually at the office by 7 or 7:30am. An added benefit of this early wake is that traffic is much lighter. I leave from work around 4:30, which again helps to avoid traffic but it also gets me home with enough time to run before dinner. I've been running outside these last two weeks and getting my legs in road run shape.
This is all in preparation for my first road race of 2010: The Indianapolis St. Patrick's Day Celebration Shamrock Run. It is a 4 mile race in downtown Indy.
I pushed my distance past 4 miles on Friday, and I've got two more weeks to continue prep for this race. I don't intend to put in anything like a competitive time, but I would be really pleased if I finished in under 45 minutes. The registration information says that runners are expected to keep a minimum of a 12 minute per mile pace, and that is pretty close to my jogging pace. Hopefully I don't irritate some poor race volunteer by puttering through this course.
Posted by Adam Jones Labels: fitness at 12:08 PM 0 comments
New Blog
I've been neglecting this blog for going on seven years now. In that time I've posted just about anything that seemed to hit my brain. The result is that, while this blog does present a diary of my life and thoughts, it lacks a central focus. If a reader were regularly visiting my blog in hopes of seeing coding and gadget posts, they would be frustrated by the movie reviews, book reviews, game reviews, political rants, and other detritus that periodically appears here. So to solve that issue, I've started a new blog that will be focused only on the techy type stuff I do. I still intend to post here whenever I gut a burr in my saddle, but if the topic of the post has to do with coding, computing, or some other technical subject I'll be posting it here instead. I've already copied over my existing technical posts, and I hope I can provide interesting content there in the future.
Posted by Adam Jones at 9:54 AM 0 comments
Ink
I received a lot of fantastic gifts over Christmas time, and the two that have gotten the most use are the water cooler and Netflix subscription. I don't have much more to say about the water cooler (aside from how awesome it is to have hot and cold, good tasting water in the basement). The Netflix subscription has given me an opportunity to watch a lot of films, and the one I watched tonight left me with some thoughts.
Posted by Adam Jones Labels: movies at 12:51 AM 0 comments
Exit 5 is Broken
Posted by Adam Jones at 10:37 PM 3 comments
HP Mini 1000 - Upgrading the Transcend JetFlash T3
A while back I posted about the HP Mini 1000 and some of the ways it can be upgraded. Probably the easiest upgrade is to the Transcend JetFlash T3 drive that comes with the machine, and fills the recessed USB slot. The Mini comes with a 2GB drive, and the easiest upgrade is to simply purchase a higher capacity Transcend drive in the same line. The 4GB unit is priced at $16.70 on the Transcend store website, or $16.29 from Amazon.
Posted by Adam Jones Labels: computing, gadgets at 8:58 PM 0 comments
Geocaching
I've recently gotten into the sport / hobby of geocaching. What is geocaching? Think of it like a treasure hunt, or the world's biggest easter egg hunt, and it is going on every day all over the world. The way this sport works is that someone out there hides a container, call the cache, that holds, at a minimum, a logbook for those who find it to sign. The person who hides the cache locates a clever hiding location, and then gets a GPS fix of the location. The hider then registers the cache on a website such as http://www.geocaching.com/ and publishes the lattitude and longitude from the GPS fix of the cache. Once published, anyone else is welcome to use that location data to try to track down the cache. Given this basic description it sounds pretty simple, but clever hiders can make it really fun and interesting to find the cache, even when you know exactly where it should be.
Posted by Adam Jones Labels: fitness, fun at 2:51 PM 0 comments
Angel Investors and Charging for the Pitch
Posted by Adam Jones Labels: business, ethics at 1:06 PM 1 comments
Proud of my Grandmother (You Go GG!)
I love my grandmother, very much. We don't see eye to eye on most political issues though. Leading up to the election last year we both said some things that rubbed each other the wrong way. We're family, though, and we love each other, so this was water quickly under the bridge.
Posted by Adam Jones Labels: politics at 4:02 PM 0 comments
Rural Internet
My family and I are preparing to move out of the city and into a more rural setting. As part of that move, I've been researching what sorts of internet service will be available to us. At our current residence we have a number of different options for high speed internet service. We currently use the U-Verse service offered by AT&T. We are using the 1.5Mbps service, which adds $15 / month in cost to our U-Verse television bill. Comcast also offers high speed internet service, and I'm sure we could get DSL from any number of folks. Go a few miles outside of a dense residential area and your options quickly become limited.
- Dial-Up
- Satellite
- Cellular Wireless
- Microwave Wireless
Posted by Adam Jones Labels: computing, web applications, wireless at 11:30 AM 1 comments
Proactive Budgeting with Double-Entry Bookkeeping
I am a nut about maintaining a budget in our house, and even more so now that we are planning to build a new home. I've used tools in the past, such as Microsoft Money, that allow me to tracker where the money went and to get an idea of what my regular expenses are. The problem I have with these tools is that they are reactive. They are only useful to me after I have spent my cash, not before. In my opinion, systems that give you a postmortem on your finances are not really useful. I want to feel the pain before I spend, not after. If I feel pain before, I have a chance to avoid spending at all, thus alleviating the pain of deviating from our budget (and potentially running into debt).
The system that I've come to use is decidedly low tech, but very effective. Using Google Docs I created a spreadsheet and added worksheets for all of our regular expenses, both monthly and annually. There are additional worksheets for our accounts: credit, checking, savings, loans, etc. Finally, there are worksheets for each of the things we would like to save for throughout the year. I use these worksheets to perform double-entry bookkeeping. Here is the full list of worksheets:
- Checking
- Savings
- Credit Card
- Television
- Internet
- Food & Gas
- Electricity
- Water
- Sewage
- Phones
- Trash
- Car Payment
- Mortgage Payment
- Life Insurance
- Car Insurance
- Plates and Tags
- Christmas Fund
- Birthday Fund
- Personal Allowances
- Slush Fund
Posted by Adam Jones Labels: business, economy, life at 9:18 AM 4 comments
HP Mini 1000 Internal Microphone on WIndows 7
One of the only complaints I had about my HP Mini 1000 netbook when I purchased it was the lack of a dedicated microphone jack. The Mini has a combined headphone/microphone jack. You can plug in a set of headphones and get sound, or plug in a mic and record, but not both at once. I like to use Skype, ooVoo, Ventrillo, and other voice applications, and this seemed like an unnecessary limitation.
Posted by Adam Jones Labels: computing, gadgets at 10:02 AM 6 comments
The Hoosier Plate Debate
Here in Indiana, you have a few options when it comes to your license plate. Assuming you are driving a car (not a commercial vehicle, truck, motorcycle, RV, or some other vehicle which requires a different plate) you can choose among the plates shown below..jpg)
.jpg)
.jpg)
There is no difference in cost between these. By default, the license branch is supposed to offer the simple blue background plate first, and offer the other two as options upon request. If you would prefer, you may pay extra for a plate that benefits the organization of your choice, such as your favorite university, or perhaps Habitat for Humanity, with a portion of the extra fee given to the organization represented on the plate. Further, Indiana permits personalized license plates (PLPs) with some restrictions on what is allowed on the plate. I'm paraphrasing, but the essence of the restrictions are that the common man will not find your combination of seven letters and numbers offensive.
If you live in Indiana, you've probably seen these plates already, and you may remember that the "In God We Trust" plate got some attention when it debuted. The ACLU brought suit against the state, not for the content of the plate, but to contend that it should carry an extra fee. The ACLU lost the case, and the plate continues to be available to anyone who asks for it at no additional charge.
Now, a bit of trivia. Do you consider the phrase "In God We Trust" to be a religious message? If you said no, the Indiana and US courts would agree with you. You see, "In God We Trust" is the official motto of the United States, and as such, is not considered religious speech. Way back in 1782 the phrase E Pluribus Unum ("out of many, one") was chosen as the text to appear on the Great Seal of the United States. This became the de facto motto for our nation, although there was never any action taken to make it official. In 1956, the lack of an official national motto was apparently a major concern, so congress worked on a bill and President Eisenhower signed into law that "In God We Trust" would become our national motto. This wasn't the first use of the phrase in our government, as it had appeared on our coins and bills since the late 1800's.
That effectively kills any religious argument against the "In God We Trust" plate, but what about speech on PLPs? Should I be able to reserve a PLP with the text "LUVSGOD", "BE GODS", or "NO GODS"? That's exactly what Jason Borneman wants to know. Jason, an atheist, applied for a PLP with the text "NO GODS". His application was rejected on the grounds that it might be offensive, and he is pursuing this through an appeal. Some have suggested that a more positive message might have been accepted, such as "GODFREE" rather than the negative statement "NO GODS". What do you think? If a "BE GODS" PLP is allowed, should a "NO GODS" plate be allowed too?
UPDATE: Mr. Bourneman received notice from the BMV that his PLP application has now been approved, and he will receive his "NO GODS" plate in February.
Posted by Adam Jones Labels: government, politics at 2:56 PM 2 comments
Selling Out
I like Extra Life Radio, and listen to it as often as I can. Occassionally something comes up in the discussion that gets me thinking, and this week's episode did just that. The host, Scott Johnson, mentioned that one of the things that really irritates him is when he hears folks use the saying "oh, they totally sold out". He mentioned this in response to criticism of the recent Mt. Dew ads featuring a World of Warcraft tie in.
Posted by Adam Jones Labels: business, opinion at 9:33 AM 0 comments
When Does a Quarter Cost More than 25¢
I had an interesting experience at lunch yesterday. My coworkers and I often go out for lunch, and often to the same places. It was on one of these trips that I realized a quarter can be worth a lot more than 25¢ given the right circumstances. There were seven of us heading to the restaurant, so we took two cars. After being seated, we ordered drinks: five waters, a coke, and a diet coke. The waitress (we'll call her "Kay"), returned with the drinks and a scowl on her face. She put all seven drinks at the corner of the table, then unceremoniously dropped seven straws in the center of the table. Not a big deal, but usually a waiter/waitress will pass around drinks and straws individually rather than asking the guest to do it. We placed our food orders and waited for it to arrive...
Posted by Adam Jones Labels: life, opinion at 9:11 AM 1 comments
Should Secretly Tracking Vehicles with GPS Require a Warrant?
There is a really interesting case in Wisconsin that got a write-up in the Chicago Tribune. In the case, the judge ruled that the police did not violate the suspect's 4th amendment privacy rights when they acquired a warrant for and placed a GPS tracking device on his vehicle. The defendent in this case was suspected of stalking a woman. The police received a warrant, although there is no law that requires that they do so, in order to place the tracker on the defendent's vehicle. It was retrieved a few weeks later and the data on the tracker used to get a warrant to search his home and vehicle for further evidence of stalking. He was later found guilty.
Posted by Adam Jones Labels: government, law at 1:41 PM 0 comments
HP Mini 1000 Upgrades
Own an HP Mini 1000, or looking to buy one, and want to know what parts can be upgraded? I've been poking around to see what is available for this great little netbook, and here are some of the things I've found.
Posted by Adam Jones Labels: computing, gadgets, mobile at 10:59 PM 0 comments