Will a password manager let me check my email in a cybercafe?

In my last post, I said that it's basically impossible to know you're safe when using a public computer to access password protected sites (including your email), since your account information including password could be captured by a keylogger. Now I'm trying to find out if password managers provide enough security to let me go ahead and log on to my gmail account or even my bank account (now that won't happen any time soon!).

Secure password managers such as RoboForm, PassPack, and ClipperZ may allow us to safely access our password-protected accounts on a public computer. It seems to be generally accepted that they do provide protection. I'm trying out the three products above (all have a free version) but will avoid putting any financial or really important passwords online until I find out more.

These products all work by encrypting your passwords so that no one else can read them, then storing them somewhere. Offline password managers like RoboForm store your encrypted data on your own computer or a flash drive that you can take with you to another computer. PassPack and ClipperZ are online password managers. They save your encrypted passwords (and only the encrypted form) online so you can retrieve them from anywhere you have internet access. They also give you a way to save the information on your own computer for when you don't have a connection.

It sounds quite promising and the products are well-established. I just want to learn a little more to be sure that there aren't any known ways that malware could copy my passwords even if I don't physically type them.

Danger Ahead: Using the Cybercafe

Summary

Using a public computer is risky business and cannot made safe for entering or reading sensitive information including accessing your email account. You must consider the risks and benefits in any situation. The best alternatives in a cybercafe are to use a secure laptop (preferably your own), or to boot the public computer from a live Linux CD or flash drive.

---

We all know that net cafes are not ideal and that they have security issues. Sometimes, though, there doesn't seem to be a good alternative. Maybe you're traveling and don't have any other way to connect. Maybe you have a home connection but it has been down for several days. Whatever the reason, you may find yourself in a cybercafe.

If you read no further, just remember this one point: never enter or access any personal or confidential information on a public computer.

Personal data that you must not enter or access includes

• Bank information, account numbers, credit card numbers and so on
• Personal identifying data such as date of birth, social security, drivers license, passport, national id, mother's maiden name, or phone number
• Email accounts and passwords
• Any other user names and passwords

This might seem too extreme, especially when you realize it will prevent you from even accessing your email. You must realize, though, that there is nothing you can do to make that public computer completely safe. Anything you type or view could be stored or transmitted to people who would love to add your information to their files. This danger is no longer an occasional problem, but common and serious.

Even if you boot from your own CD or flash drive (see below), anything you type could still be captured by a hardware keystroke logger.

Besides the risk of your personal data being captured, there is also the risk, or inevitability depending on the location, of your flash drive being infected with malware if you insert it into a public computer. Always use a clean computer with an up-to-date virus and malware scanner to clean your flash drive after using it in a cybercafe (or, for that matter, in any computer).

What to do?

Balance the risks and benefits

As in any situation, you should always balance risks and benefits. If you access your email on a public computer, there is a risk that your email account will be compromised. That means someone could gather the addresses of your contacts, email them from your own account, send spam under your name, view sensitive information (financial records, orders, addresses ...), and potentially steal your identity. That's a pretty big risk.

On the other hand, if you access your email account on a public computer in a "reputable" cybercafe and can then change your password soon afterward on a secure computer, the risk would be decreased. My own assessment of that risk-benefit balance for case would be that (a) I would only want to take the risk if it was very urgent to access my email and (b) I would try other alternatives first: SMS messages, phone contact, or whatever I could think of.

Use your own laptop

If it's possible to connect your own laptop at a cybercafe, you will avoid the problem of all the malware that could be on a public computer. Needless to say, you won't want to do this unless your own laptop is well protected with at least a software firewall (like the one built-in to XP and Vista, or an add-on) and an up-to-date antivirus program. (There are portable hardware firewalls available that plug into your USB port. But you can probably do almost as well with free software.)

Use a Linux Live CD

Using a Linux live CD or flash drive, you reboot the public computer from your own copy of Linux designed to run only in memory. The hard drive is not used and does not even need to be present. This means that drive infections are no longer a risk.

It's easy to make such a CD; you just download the file (called an iso image) and burn it to a CD or DVD. See the good article, Why you want a Linux Live CD, for some more information, or just google "Linux Live". Many current Linux installation CDs will work as well. Ubuntu (~ 700 MB) and Slax (~ 200 MB), are two examples. As these are large downloads if you have limited, expensive Internet access, you may want to copy a friend's disc or get someone to send you one (Ubuntu will mail you a free copy).

Don't be scared off by the word "Linux," either. You need no experience with Linux to use these. Just boot the computer from the CD or flash drive, and you'll see a familiar desktop with a web browser (usually Firefox), text editor, and others depending on the exact version.

Limitations of Linux Live

• The computer must be configured to boot from a CD or flash drive. If it is not, a co-operative cybercafe manager may be able to set it up for you (or you could do it yourself if you know how).
• While web browsing is almost always supported, it may be tricky to connect to the cafe's printer. But you could save what you need to a flash drive and print it later.
• Hardware keyloggers could still intercept your typing. These are devices intentionally installed between the keyboard and main computer box; I have no idea how common they are but certainly much less common than malicious software.

If you have no other alternative ... making the computer safer

It's important to stress that you cannot make the public computer safe. You can only reduce some of the risk. Kris Littlejohn lists and explains "10 things you should do to protect yourself on a public computer" including:

• Delete your browsing history
• Don’t save files locally
• Don’t save passwords
• Don’t do online banking
• Don’t enter credit card information
• Delete temporary files
• Clear the pagefile
• Reboot
• Boot from another device
• Pay attention to your surroundings and use common sense

Apart from booting from another device, as I discussed above, none of these measures will stop keyloggers from spying and reporting on everything you type. As long as you don't type anything sensitive, you'll be fine, so these precautions would help in a situation where, for example, you need to print an existing document with sensitive information, since you wouldn't be using the keyboard. And they will help in a situation where there happen to be no keyloggers or other malware intercepting what you type.

Shooting themselves in the foot? Blocking customers from your website.

Why do some sites make it so hard to do business with them? Is it because they want customers hardy enough to jump through the hoops? Perhaps if the customers prove their stamina and cleverness by making it through to order a product, they will be the ones less likely to need support?

I've gotten some good deals from TechForLess.com, so it is taking me longer than usual to give up on them. My first bad episode was when I ordered a laptop, got the confirmation, then the next day got a message that the order was canceled--seems they didn't like my being in Nigeria even though the order was paid from and shipped to the US, as well as sealed by one of those "prove your identity" credit-card pop-ups. However, their customer service was very helpful and made sure that the order got filled eventually.

Turns out that one of the laptops I bought from them as a Vista system actually had been downgraded to XP, and badly done so that the right drivers were missing. Oh well, mistakes happen.

Now, though, I can't even browse their web site! Since switching our hospital system from transparent to non-transparent proxy (so that we can force user logins), I just get an error message on their site, "Sorry, but the activity from your computer has tripped an alert on our server. This maybe because you are using some form of web browsing accelerator software. If this is the case, please disable this software while browsing our site." There is a bypass -- type "GO" and press the button, be patient for a 30 second delay -- but it doesn't work.

Now, is this business really so swamped by bots or web accelerators or whatever that it can't manage, and has to block legitimate customers? Are they so far above their competitors that they can afford to annoy their customers and actually ask them to disable their web browsing accelerators? Since those possibilities are hard to to accept, I can only conclude that TechForLess is trying to screen out customers who don't fit their mould, who might just say "oh well" and go on to NewEgg where at least they can start shopping. TechForLess is by no means unique ... at least for international shoppers, there are many other businesses that seem more interested in keeping us away than in getting our business.

For ease international shopping, I have to give the prize to Amazon. In fifteen years and with hundreds of purchases on Amazon, I have never had a problem. If I want to ship to a new address, no problem. If my ip address is in Nigeria, or Kenya, or South Africa, no problem. No surprise cancellations, no denied credit cards, just good service (ok, now and then a little problem, but 99% good).

Broken Bridges

We still remember Bevelyn's restaurant here in Jos as the "Broken Bridge Restaurant," since through the '90s it featured the beautiful mural shown on the right, of a long bridge (across San Francisco Bay??). As you can see, there was one small problem with the way the panels were placed, thus giving the restaurant its nickname.

That name has been going through my mind in the past couple of weeks as I've spent nearly half my time dealing with a certain type of network problem, the kind where you're on one side (usually the wrong side) of a broken bridge.

The problem is, you have to have both sides of a communication bridge working properly if they're going to function. When there is a breakdown in a local setting such as an office, it's not much trouble to go from one end to the other to sort out the problem. But what happens when one end of the bridge is a block or two away at another site, and there is no one there to help (and no good way to communicate even if there was someone)? The result is a lot of walking back and forth, trying one thing on one end, something on the other end, until the two sides can talk together again, to mix my metaphors.

Worse yet, our internet connections via satellite have broken down twice recently, both at Evangel and the SIM office. The network technicians could not solve or even diagnose the problem from their side, so I spent many, many hours following their instructions given over a barely intelligible cell phone, waiting and waiting to see what happened next, reporting back, and so on. If only we had the luxury of two connections, so that we could use the working "bridge" to get to the other side of the broken "bridge" and fix it.

In yet another metaphor, I'm learning (trying) to pay attention to which part of the branch I'm sawing off -- the part I'm sitting on or the far end. It's always tempting, when working over a remote connection, to change something and hope that it will work. It's often a risk worth taking, but sometimes I fall with the branch.

Suppose I am working over a wireless bridge, with one end in the office and another across the street, and I want to reconfigure the radios to talk to each other in dialect Y instead of dialect X. I have to first tell the far radio to change to language Y, then tell the local one to make the same change. If it works, fine. If it doesn't, I've sawn off the branch I was sitting on. I can change the local radio back to the way it was, because I'm connected to it, but the far radio is now dangling in never-never land--"I'm not hearing you, I'm not hearing you!" I have to walk to wherever it is and directly connect to it, to tell it "never mind, we'll stick with dialect X."

A simple solution, which I've never seen or heard of being actually implemented, would be for the radios to have a trial period whenever you make a change that might break the connection. In effect, the radio would say, "ok, I'll switch to dialect Y, but if I don't hear from you in 5 minutes, I'll assume that this didn't work and I will go back to dialect X." Operating systems like Windows do that when they change your graphics settings, with a button that says "Click to accept these settings, or I'll revert in 30 seconds" That saves you from the problem of having a totally messed up display and no way to change it back. Alas, with all their amazing technology, wireless network devices don't seem to have figured this out. But then, many don't even allow you to save and restore the settings that it took you so long to figure out.

As I finished writing this and sat wondering what the point was, it struck me that the greatest broken bridge story is the way God relates to people. He created a perfect world, including people, and loved his creation wholeheartedly, especially the people, but then they went and broke the relationship, the bridge. In the end, no kind of remote troubleshooting would to, and God put on his shoes and took a long journey to the other side of the broken bridge, to a zone barren and devastated by the long loss of contact. It cost his life, but the bridge was restored.

(cross posted from my main blog)

Top Ten Reasons for Switching to Vista

Since I needed a new computer, I left my old laptop in Nigeria and had a new one waiting for me when I got to the US in early December. I intended to use Windows XP on it, but as it would cost more to order that way (i.e., more than getting it with Vista installed), I was going to use my personally-licensed XP Professional on the new one. Some complications prevented me from making that switch so I have been using the pre-installed Vista. I'd like to share what I see as the top ten reasons I can see why you, too, should upgrade to this new operating system.

1. You're having a quiet vacation and need something to do.
2. You're getting bored of the stability of Windows XP or your Mac, and want to try something more challenging. You like an interesting OS that keeps you guessing what will happen next, or you miss the fun of lockups and reboots you used to have with older versions of Windows.
3. Your current computer is running too fast, not giving you enough time to make and drink your coffee.
4. When you try to run a program, you'd like your system to ask you if you really want to run the program.
5. You'd like to have Google desktop, but don't want the bother of installing that free program. Plus, the Vista version has a picture puzzle you can play with.
6. You need an excuse to pay to upgrade to the latest version of your programs (otherwise, some won't run on Vista).
7. All your friends are will laugh at you if you stick with XP (actually, they're jealous).
8. You've got to have transparent menus and windows (though for this, I think, you'll need more than Vista Home Basic ... so be ready to pay a little more).
9. You need a way to use all those dozens of gigabytes of memory you have installed on your new machine.
10. You want to show Microsoft your support and appreciation.

Seriously, I'm quite convinced that Vista is a superior operating system, at least for businesses. Hopefully in a year or two the bugs will be worked out and it will be ready for me to try again. Meanwhile, when I get back to Nigeria, I'll be dusting off my XP Professional CD-ROM and starting another re-install.

(BTW, don't tell me to try Linux. I've got that installed also, in the Ubuntu flavor, but I still have too much invested in software and experience to abandon Windows.)

Juice Podcast Receiver Problem Solved

Friends, don't bother reading this unless this is why you have come the blog. I'm only posting this here because it's the solution to a software problem and the answer doesn't seem to be found by Google, not easily at least.

Problem: Juice podcast receiver (a great freeware program) running on Windows platform suddenly stops working. It crashes while loading and gives a message "OSError: [Errno 2] No such file or directory - see c:\program files\juice\juice.exe.log" or something similar. If you check the log, you'll see something like:

Traceback (most recent call last):
File "gui.py", line 4, in ?
File "iPodderGui.pyc", line 3573, in main
File "ipodder\configuration.pyc", line 468, in __init__
File "os.pyc", line 153, in makedirs
File "os.pyc", line 154, in makedirs
OSError: [Errno 2] No such file or directory

Great help, isn't it? The short answer AFAIK is 1 of 2 things:

• The drive letter has changed for the drive where the Juice program is installed, or


• The download directory, where the podcasts are to be stored, is not available. In my case, this was because it's on a network share that was unavailable at one point, and had to be accessed by Windows Explorer (or a "net use" command) before it was made available again.

For more information, see this post in the Juice support forum.