Installing Ubuntu - Part 2

My special interest is computers. Let's talk geek here.
User avatar
yogi
Posts: 9978
Joined: 14 Feb 2015, 21:49

Re: Installing Ubuntu - Part 2

Post by yogi »

You don't have to worry about public keys. They are after all, public. Everyone should have access to them. The private keys that work alongside the public ones should be created in house. That is to say, you and only you know what it is. You need both to make the system work if you are transporting your data across the Internet. I'm with you and would not trust anybody to provide a private key for me to use. I'd change it immediately or find a different way to do things.

You and i are committing the same flaws with our passwords. LOL I have a few hundred passwords documented in an encrypted file and there is a pattern. Most of them have the same root combination of characters with site specific characters added on. This is a big mistake because it's a common practice. Thus anybody who uncovers your root phrase, or the mechanism by which you create it, has much less work to do if they want to break into to those other sites you visit. The golden rule is for every password to be unique. No repetitions at all. Ever.

There is much ado about making passwords complicated and hard to crack. It's not as complicated as the warnings would want you to believe. As I've stated elsewhere, the key to secure passwords is the length and not the combination of characters. The suggestion is to convert to pass-phrases instead of passwords. Eye_M_logging-N2-Dennis's_Brain4mayshun is way more secure than ||g2R8!brg~@X for example. Your idea is even better where the first letter of each word is used instead of something human readable. But, it is a mistake to repeat patterns regardless of what method you use.
User avatar
Kellemora
Guardian Angel
Guardian Angel
Posts: 7494
Joined: 16 Feb 2015, 17:54

Re: Installing Ubuntu - Part 2

Post by Kellemora »

I think one problem was, back when I first starting having to use passwords, we were limited to I think it was 7 characters, which could be any character on the keyboard, including symbols and numbers.
I know my first website on Inlink was limited to 12 character passwords and we could not use any symbols at all only alpha/numeric and that was it.
My wife's first account required the use of an underscore and at least two numbers.

I don't think hackers just keep trying peoples passwords. Seems like they would hack the website database and then try to find the encoding used, and once they break that, then they would have everyone's password no matter how long or short it is. I could be wrong, but it makes sense to me thinking that way.
Now it could be that every single letter of a password is given a different encryption code by the website, but I sorta doubt it.
Also there is the RESET feature, so if someone forgets their password, it can be reset. Why couldn't a hacker just get into that area and reset the passwords of the users accounts he wants to get into?

However, you did get me thinking about this, and I have an idea, that is to use my common word in the middle and a different beginning and ending for each password. That would work for the way I'm already doing it by appending it to the end. I'll just append half to the front and half to the back.
User avatar
yogi
Posts: 9978
Joined: 14 Feb 2015, 21:49

Re: Installing Ubuntu - Part 2

Post by yogi »

From what I understand brute force hacking of passwords is passé. That is to say, hackers don't go around trying every combination of characters to get into your account. They buy lists of hashes that have already been broken. Then they steal you password file and compare the hash codes to what they already have. Way more than 50% of the login credentials are discovered that way. I read how they do the other half but didn't quite get a full understanding. The hash can often be used to decode part of the password. That's why it's not good to repeat a common phrase. If they have the hash for it then finding the rest of the pass phrase is a lot easier.

The "reset password' is an old hack that was figured out long ago. When I went through my list recently I found a couple places that still allow that kind of thing. They send you to a web page, of all things, so that you can update your password. The more enlightened web sites will require that you enter a temporary security code that they send you either by e-mail or text message. The assumption is that only you would have that telephone or extra e-mail account as a form of TFA (two factor authentication). They may send you a link in an e-mail that has some POST coding attached to prove it's really you. Some financial sites go one step beyond all that and require answers to questions that validate your identity.

Back in the DOS days 8 characters was the limit. When processors started using more than 16 bits for data, things changed. The main methods used for hashing (encrypting) passwords and data are pretty well known. To get around that some places will "pepper" their passwords prior to hashing them. That is to say they add a secret value to the given password and then hash it. Thus if the bad actor has the decryption algorithm (and what decent hacker would not?) it won't decode the password because it was altered before it was hashed. That added value could be many characters in length so that brute force decoding would be impossible. Hashes can also be salted where the same idea of adding something extra is employed. The salt method has a database that goes along with the original password so that the extra bits can be extracted if you know where they are. Not so with pepper. It's all very spicey. :lol:

Then there are exotic schemes that government actors and the likes tend to use. They split the hash for your lengthy password between, say, ten different servers. Thus no one server has your entire password on it. Keeping track of where all the pieces are has got to be a nightmare, but then again it's very secure.
User avatar
Kellemora
Guardian Angel
Guardian Angel
Posts: 7494
Joined: 16 Feb 2015, 17:54

Re: Installing Ubuntu - Part 2

Post by Kellemora »

I'm sure security is a big issue and gets improved upon quite often.

I know when they first came out with wireless keyboards. I could use one of my ham rigs to capture the keystrokes, then use a simple software program to convert the code bursts to what actual letter was pressed.

As an aside: When they came out with push button telephones using tones. I used to publish songs in sheet music format on the BBS open forum showing the numbers to press on the phone to play the song. Had to be careful none of the songs started with a 0 or 1, hi hi. One usually could not get through a whole song without someones phone starting to ring or getting a recording that it was not a working number, hi hi. I don't remember anymore, but I figured out if you dialed a two digit number like 78 first and wait for the beep, then you could keep playing songs to your hearts delight. Don't quote me on that number though, I don't remember which two numbers it was we discovered that worked to do that with.

Some of the websites I go to, I get logged out of by them, and I have to log back in again.
Then I get an e-mail from them saying an unrecognized computer just logged into my account, if it was me I can disregard the message. It gives the date and time and name of the computer.
It's the SAME computer I always log into their system from.
It is sorta scary that they don't recognize the same computer I've used for years now.
Tells me their security is not up to snuff as it should be, and they are losing their own data.
User avatar
yogi
Posts: 9978
Joined: 14 Feb 2015, 21:49

Re: Installing Ubuntu - Part 2

Post by yogi »

It's possible your web site's are losing it, but more than likely they have a profile on you that consists of more than just your computer credentials. If you change something, like updating your browser for example, that changes your ID. Changing certain hardware will mess up your ID as well. Then, too, they may be kicking you out on purpose just to be certain you can log in correctly twice in a row. You know, if you left your computer on and I came in and started using it I could do some serious damage. So they break the connection to be certain you can actually log in as who you claim to be. This is actually standard routine with some CAPCHA front ends. You never get logged in the first time regardless of the fact that you got the code correctly entered. They want to be sure you are not a bot and can do the code three or four times in a row.

When I want more security than Windows 7 has built into it, I will use a virtual box. In essence that is a whole new computer that nobody has in their database. If I keep using the same box they will eventually profile me, but I make of point of not allowing them to "remember" me and my computer plus I change VM's and browsers as often as is practical. I must log in more frequently that way, but it tends to keep everybody honest. I'd use the TOR browser for all my financial transactions but most places won't even let you connect if they can't identify you. LOL

We played with those DTMF telephone tones when I worked at Motorola. We had our own test equipment and didn't have to worry about accidentally dialing up a long distance number. There were various service codes that I knew the Telco's used and they were fun too. There was one combination that would generate a call back for example. I guess that tested the connectivity of the lines or something.
User avatar
Kellemora
Guardian Angel
Guardian Angel
Posts: 7494
Joined: 16 Feb 2015, 17:54

Re: Installing Ubuntu - Part 2

Post by Kellemora »

I though I read somewhere that Google Chrome would send a log-in without your credentials about once every three months or more often to force you to log-in manually. Was supposed to protect your security. But since this did not affect all web sites, I finally figured what I heard was not correct.

Capcha's, some are OK, but most I hate with a passion. Many are unreadable, even after selecting different ones. And when you do finally get one you can read, it claims you entered it wrong try again.
Every time I've had to use a Capcha to get into a business website, they got a nasty letter from me regarding it, especially if it was unreadable or did not work right. A couple of them that had it learned fast I took my business elsewhere.

If I try to log into my bank from a different computer than I used the previous time, I have to go through several security questions before I get in. Not so much of a problem now since I only do certain things on certain computers.

I used to know a few of those telephone codes as well. And yes, one of them would ring my phone back after ten second delay, so you had time to hang up.
Although this did not have anything to do with the phone company themselves. I had a list of phone numbers I could call, then wait until I heard a second dial tone, then dial the person to whom I wanted to be connected to. I didn't do it often because long distance rates applied to the calls and you could only dial a local number to the phone number you first called. When my cousin moved to Colorado, rather than dialing him direct long distance, I called the long distance number I had within his area code, then dialed his number as a local number. As soon as he knew it was me, he asked if I was in town, because they had caller ID there I suppose and he saw it was a local call. We ended up talking much longer than we should have because of it too. So I think that's the only time I ever used the system.
The system was soon shut down after that, because the telephone numbers worked both ways, and with caller ID, everyone was getting those numbers and passing them to outstate friends.

There was another MaBell Code also that was used heavily by collection agencies. If you hung up on them, they could hit a two digit number that would ring your phone back with short fast rings continually. Back then, you technically could not hang up on someone you called. If the party you called didn't hang up, your line would remain active. I remember telling an old girlfriend, you can't hang up on me, you called me remember. What this two digit number did was pulse the 90 volts to make your ringer ring, I think they could also hold down the second digit and keep the ringer going constantly.
Although that feature was disabled, collection agencies have only got worse over the years in what they do, hi hi.
User avatar
yogi
Posts: 9978
Joined: 14 Feb 2015, 21:49

Re: Installing Ubuntu - Part 2

Post by yogi »

I don't know what Google is doing, but I do know the login session for this site is set for 90 days. While that's what is on the control panel, I'm not sure it actually works. My point is that many web sties do that kind of thing but I'm not exactly sure what the security issue is. The reiteration of CAPCHA entries is a direct response to robot crawlers with optical recognition. That's why some of the codes are hard to read for humans. I happen to know from experience that it doesn't fool many bots. When you send off a complaint about the CAPCHA that is looked upon as a positive. That means the system is working; for humans anyway.

Now that you bring it up I also recall those days when the phone did not disconnect unless both parties hung up. As far as those nasty forced ring pulses go, every phone I ever saw has a way to turn of the ringer. Even those old dial phones had a lever to silence the bell.
User avatar
Kellemora
Guardian Angel
Guardian Angel
Posts: 7494
Joined: 16 Feb 2015, 17:54

Re: Installing Ubuntu - Part 2

Post by Kellemora »

Yeppers, a little dial on the bottom would turn the ringer down or off.
I don't recall ever having to relog in here, but I may have and just forgot.
At least it is not on the same day all the rest seem to land on.

Speaking of Google Chrome, the latest version 132 has a serious bug, and it only seems to affect those using Windows 7 Home Premium. Works fine on Windows 7 Home and Pro, Windows 8 and Win 10.
Makes one wonder what is different about Win 7 Home Premium that it fails with Google Chrome, but not with Firefox or Internet Explorer?
You go to a website and parts of the website work just fine, yet other parts don't work at all.

You think Google was paid by Mickey$oft to make a glitch to force folks to downgrade to Win 10?

There must be other companies out there besides Captcha.
A website where you can buy things, has a scrolling banner during log-in.
You get a message to type in the name of the third or fourth object that appears after the windmill, or whatever.
It's usually something simple like a Nose or a Button or a Car. So I suspect Car, Auto, or Vehicle may work.
I'm trying to remember who it was to get the URL, but for the life of me I don't remember.

Don't know if this is true or not, but one guy told me when you hit a Captcha, if you are a registered user of their system, just type in the first word of your user name if on the same computer you normally log-in from.
I've tried it a few times, it didn't work but one time, but not again after that.
I got to thinking and perhaps if you get the first letter or number right it works at some places?
I say that because it seems like, the one time it did work, the first letter of the Captcha was the same as my log-in user names first letter. Coincidence or dumb luck, hi hi.
User avatar
yogi
Posts: 9978
Joined: 14 Feb 2015, 21:49

Re: Installing Ubuntu - Part 2

Post by yogi »

There are several plug-ins I can add to this site regarding login verification. CAPCHA comes in several levels of obfuscation and I, as administrator, only get to choose the dept of the clarity. That's all I'm told. When an attempt is made to login it doesn't seem to matter how obscure that code is. Nearly all the bots figure it out and request membership. At one time I thought they were just bypassing the CAPCHA check somehow, but that's not the case. They actually read the image and are damn near perfect at getting it right the first time.

At that point I abandoned CAPCHA because I was getting tired of deleting member requests. I found a plug-in where I can generate a list of related words. There were six or eight words in the list and the individual requesting membership had to drag the words describing food over the the right hand column. It could have been any logical set of words, but I choose food. If all the words ended up where they should be, then the registration was accepted. Bots can't figure that out. If it requires thinking, they are lost. Unfortunately, as the site software was updated, the plug-in was not. It no longer works with the version of software we must now use.

Now there is a list of questions that require thinking to answer. Of the list of words I provide, which one has three vowels? Since that answer cannot be gleaned from a Google search, the bots don't know what to do. If you guess wrong and enter the wrong word, there are a dozen other questions of similar ilk.

We don't have RE-CAPCHA but I've used sites that do. They will display a picture with a grid overlay. The challenge is to select the squares containing... automobiles, for example. That one is like the original CAPCHA in that your correct answer isn't enough. You must complete the challenge three consecutive times in order to be accepted. The best RE-CAPCHA I've seen is also a picture in pieces, but the pieces are like a jig-saw puzzle. The challenge there is to drag the pieces over to the adjacent square and compose a picture of the object. I'm not sure why, but in order to use RE-CAPCHA one must get in bed with Google. I chose not to do that which is why we have questions instead of pictures.

None of the above matters much. Only one person signed up so far this year. I think that's about the quota for any given 12 month period.
User avatar
Kellemora
Guardian Angel
Guardian Angel
Posts: 7494
Joined: 16 Feb 2015, 17:54

Re: Installing Ubuntu - Part 2

Post by Kellemora »

It's a shame we don't have more people here.
I've mentioned this site to several, mostly authors I know.
And they all, like me, have the same excuse. No time to write now, much less add something else that takes away my time.
It took Glenn several tries before he convinced me to join, and I only did so because we were working together on a story, and we actually met on a BOINC forum board when I was getting out of BOINC. I only stayed there long enough to get my credits passed to his account, and then came here to continue our association with each other.
I tried really hard at first to get more authors to come over here, and you even set aside a forum for that purpose, yet nobody came. Sad really!
User avatar
yogi
Posts: 9978
Joined: 14 Feb 2015, 21:49

Re: Installing Ubuntu - Part 2

Post by yogi »

There are a thousand reason why we don't have more active members. The essence of it all is that we are not active enough to attract a crowd. If we had a couple dozen people posting new material all day long, then even some stray authors might take an interest. But nobody wants to be in on the ground floor. Nobody wants to start fresh. I even offered to host and manage sites for people who were all grateful for the offer, but there too nobody wanted to populate a ghost town. I thought we might get some visibility on Farcebook, but the same group of people have been fans for many years now. No new interest in ages. When you and I discuss politics, it's the kind of material that draws interest like rotting meat draws flies. Some of those topics get an inordinate number of views, but no new members join the battle. It would be different if twenty of us were trolling each other. LOL

I think of Glenn often. He was our PR agent as well as my inspiration to explore Linux. I'm certain he would have a lot to say about my current adventures.
User avatar
Kellemora
Guardian Angel
Guardian Angel
Posts: 7494
Joined: 16 Feb 2015, 17:54

Re: Installing Ubuntu - Part 2

Post by Kellemora »

I wish I had the time to start adding articles, not just about writing but about other topics as well.
As it is, I'm spending too much time in this forum each day, and it cuts into the time I should be eating lunch, whenever I get a chance to eat that is. It is already after 1pm and I have to eat, feed my parrot and give him water, check my BG, and O2 plus have a Nebulizer treatment, before I can come back up here and get back to work. Also Three days a week I have to do a 1/2 hour exercise routine that usually takes more than a half hour by the time I do each step, especially if I have to stop to use oxygen or connect it to use while I'm exercising. Everything I have to do each day eats into my writing time.
User avatar
yogi
Posts: 9978
Joined: 14 Feb 2015, 21:49

Re: Installing Ubuntu - Part 2

Post by yogi »

You must be getting old. I recognize the symptoms. :lol:

At my age the priorities in life have dwindled down to those which keep me healthy and happy. If you're not doing likewise, I strongly encourage you to focus on your own personal well being before you consider entertaining the invisible audience on this website. I get excited over trivial things and literally have nobody else to share them with. That's why you see some of the weird posts I publish. All that is peculiar to me and only could be of passing interest to anyone else. I understand that. I realize that I get carried away sometimes and create way too much reading material. Unfortunately, my rants can only be posted here or spoken to the dog. Most of the time she falls asleep when I talk to her.
User avatar
Kellemora
Guardian Angel
Guardian Angel
Posts: 7494
Joined: 16 Feb 2015, 17:54

Re: Installing Ubuntu - Part 2

Post by Kellemora »

I actually love our back and forth banter!
I do learn a lot from you. You have excellent incite into a lot of things.
Despite the many diverse jobs I've had over the years, and the many small businesses I started and sold. Most of them were out of necessity. I never wanted to be rich, just comfortable, and I was for a long time. I never wanted to be as low as I am right now, trying to eke by on 89 bucks a month. If it wasn't for a little bit from my product, I wouldn't be able to keep my head above water. The frau can't afford her Insulin and had to go back to work to cover some of it. What little extra money I do get, usually goes to help her out. And my declining health prevents me from trying to take on any more than I am already doing. I'm basically forced to stay in a chair as any exertion wears me out. I even have to use oxygen while doing my exercises, which are required to keep the heart muscle working as best as it can.
Old age appears to be our punishment for a long life, hi hi.
Post Reply