ProFox May 2017

profox@leafe.com

56 participants
78 discussions

RE: [NF] Friday Afternoon Discussion: Passwords
by Gene Wirchenko 08 May '17

08 May '17

At 11:54 2017-05-08, "Paul H. Tarver" <paul(a)tpcqpc.com> wrote: [snip] >Woohoo! All this time I thought I was normal and today Ken confirmed I AM a >computer geek because I use LastPass! > >I'm a member of a community! YEAH! :) I just use a Word document. There goes *my* geek status. Sniff, sniff. Good-bye, cruel world! No, wait. I do not have to do what every other geek does. After all, I use VFP. Sincerely, Gene Wirchenko

3 3

Re: [NF] Friday Afternoon Discussion: Passwords
by Ken Dibble 08 May '17

08 May '17

>Not so silly. There are password processes that depend on gestures >that are under testing. The ability to click and swipe through a >series of images is somewhat unique due to biomechanical parameters or >personal habits. I've also seen proposed some sort of facial >recognition. The sooner we get through remembering a dozen random >characters, the better. That's just a waste of time. Not likely to be accessible to people with visual disabilities, or disabilities that reduce fine-motor skills. >I use a password manager that syncs encrypted data over the internet >so I have the same set of passwords on different machines of different >OSes (Windows, Linux, ChromeOS, Android) and browsers. But none of >these make it easy for desktop or console applications; you need to >query the manager, prove you're you, copy the password to the >clipboard (insecure!) or try to manually type longish random strings. >Double-bonus goes to sites that double-check with an SMS or similar. >"Something you know (password) and something you have (cellphone)" >makes for good two-factor authentication. Pretty much, only computer geeks (broadly construed) use password managers. Not only do most ordinary computer users not use them, they have never even heard of them. Ken

2 1

Re: [NF] Friday Afternoon Discussion: Passwords
by Gene Wirchenko 08 May '17

08 May '17

At 15:35 2017-05-05, Ken Dibble <krdibble(a)stny.rr.com> wrote: [snip] >Read the article. The data does not support the contention that >these are important enough vectors to justify the downside that >these recommendations have for users. I did read the article. I do not agree with it. >Anybody who's got a dictionary, by now, also has a brute-force >"guessing machine" and a botnet. Yup, they get through the >dictionary in a few seconds. Within only a few more minutes, the >botnet loops through every possible combination of characters in a >10-character password, and then they move on to 11 characters. The >only thing that slows them down at all is a much longer password, >and the only really effective defense involves measures on the >server side. There is very little that a user can do to a password >to make it significantly safer in the modern age, and there is huge >amount of aggravation that can be caused to users over passwords >that, in the end, has very little benefit. Not putting a password on a Post-It Note is not a total solution, but it is the equivalent of not putting the house key under the mat. Would you put your house key under the mat? I suspect that answer would be a resounding no. Just because there is no ultimate solution does not mean we should ignore things that can help. >This isn't just me, or just me and O'Reilly. Now it's me, O'Reilly, >and the NIST. > >Of course, I know, I'm a low-status person. No matter how right I >am. or how often I am right, nobody listens to me until a >high-status person repeats what I said. > >I am just enjoying the gratification of being proven right. No, of someone agreeing with you. There have been proclamations before about solutions to the password problem. I think they are premature. Look, I know that keeping track of passwords is a bother, but if access to something matters, changing your password occasionally is a good idea for the reason I stated. Pick a password that you can remember. I do not have a solution for the cognitive load of having [too] many passwords. set silly on Hey, maybe we can have cameras watching for body motions as passwords. Since throwing up one's hands about the password problem is not workable, throwing up one's hands can be the new equivalent of having a password of "PASSWORD". set silly off Sincerely, Gene Wirchenko

3 2

Odd Display Bug
by Gene Wirchenko 06 May '17

06 May '17

Hello: I was running a program with test output and saw an odd bug. I do not know that anything can be done about it, but heads up. I might have written this up before. My monitor is running at 1024x768. The program prints "processed" and then goes through a bunch of data. Every thousand rows processed, it ?? prints the number of rows so far. Here is what happens on my system. When the printing gets to 12000, it does not fit on the line. "1200" is printed at the right and the remaining "0" is wrapped onto the next line. So far, so good. When the 13000 prints, it overwrites that "0" at the start of the line. Here is a test program that replicates the problem (at least, on my system). *** Start of Test Program *** * tmpscrn * Screen Experimentation * Last Modification: 2017-05-06 ? "*** Execution begins." ? program() close all clear all declare Sleep in win32api integer * ? "processed" local i for i=1000 to 20000 step 1000 =Sleep(1000) ?? i endfor * clear dlls "Sleep" close all clear all ? "*** Execution ends." return *** End of Test Program *** Sincerely, Gene Wirchenko

2 2

Re: [NF] Friday Afternoon Discussion: Passwords
by Gene Wirchenko 06 May '17

06 May '17

At 10:17 2017-05-05, Ken Dibble <krdibble(a)stny.rr.com> wrote: >What I've been saying for years .... > > From the O'Reilly Security Newsletter: > >https://venturebeat.com/2017/04/18/new-password-guidelines-say-everything-w… > >1. Forcing people to frequently change passwords is not helpful. It >just makes it more likely that they will stick the password on a >Post-IT on their monitors because they can't remember it. It does help some. If someone has your password but has not changed it, because it would alert you, and you change your password, he no longer has access. (Yes, he could possibly break in again.) If security is upped on the system he has access to and he has your password, the security improvement does not help you at all. >2. Imposed password complexity does not help either (As I keep >telling people, the only way that a user can make his/her password >harder to "guess" in the modern age is to make it longer. It is just >as easy for a brute-force botnet application to "guess"#51aQ4@5)?" >as it is to guess "YourMomma!") What about a dictionary attack? dictionary.com has both "your" and "momma", but it does not have "#51aQ4@5)?". >Maybe I should start my own security newsletter.... Sincerely, Gene Wirchenko

5 4

GetFile() problem (VFP9, Win 10)
by Paul Newton 05 May '17

05 May '17

Hi all Users are complaining that when running the following code more than once, GetFile() displays the contents of the folder the user last browsed to despite the code changing the default directory to the My Documents folder before calling GetFile(). I simply do not see how this could happen but I have had the issue demonstrated to me and I have seen it with my own eyes .... I am completely stumped and cannot reproduce the problem myself. FWIW this is a VFP9 app running under Windows 10 #Define CSIDL_PERSONAL 0x0005 Local lcDocumentsPath, lcOriginalPath lcOriginalPath = SET("Default") + SYS(2003) lcDocumentsPath = Space(255) Declare SHORT SHGetFolderPath In SHFolder.Dll ; INTEGER hwndOwner, Integer nFolder, Integer hToken, ; INTEGER dwFlags, String @pszPath SHGetFolderPath(0, CSIDL_PERSONAL, 0, 0, @lcDocumentsPath) lcDocumentsPath = Alltrim(lcDocumentsPath) Set Default To (lcDocumentsPath) ? GetFile() SET DEFAULT TO (lcOriginalPath) Any ideas anybody? Thanks Paul Newton

5 10

RE: {NF] Error with VmwPlayer
by Charles Hart Enzer, M.D. 05 May '17

05 May '17

Shut down But some VMware processes ongoing per Task Manager Copied to iDrive "Restored " to laptop Opened on laptop VMware Told Wizard I was COPYING Shai / שי Charles Hart Enzer, M.D., FAACAP Volunteer Associate Professor of Psychiatry University of Cincinnati Medical Center On May 2, 2017 12:03 PM, "Aida I. Rivera-Benítez, MSMIS" <air(a)airispro.com> wrote: Hi Charles: Just checking things... did you power down the Virtual Machine before copying the files and when restoring selected I Moved it ? Regards, Aida I. Rivera-Benítez, MSMIS Air Information Systems, Inc. San Juan, Puerto Rico -----Original Message----- From: ProFox [mailto:profox-bounces@leafe.com] On Behalf Of Charles Hart Enzer, M.D. Sent: Sunday, April 30, 2017 9:33 PM To: Profox Subject: {NF] Error with VmwPlayer Copying the Virtual Player folder to a new machine, I get this error trying to mount the virtual drive: A disk read error occured Press Ctrl-Alt-Del to restart I have not found an answer on the Vmware site nor with google. Thank you. *Shai / שי Charles Hart Enzer, M.D., FAACAPVolunteer Associate Professor of PsychiatryUniversity of Cincinnati Medical CenterWebSite: http://homepages.uc.edu/~enzerch/ <http://homepages.uc.edu/~enzerch/>* *“And after all this, what would I say to those who ask me the secret of a fulfilled life? Mine is really quite a simple philosophy. Try to live every day as if it is your last, but plan your future as though there were endless tomorrows.”David Rubinger (Hebrew: דוד רובינגר‎‎; 29 June 1924 – 2 March 2017)* --- StripMime Report -- processed MIME parts --- multipart/alternative text/plain (text body -- kept) text/html --- [excessive quoting removed by server]

2 4

[NF] Friday Afternoon Discussion: Passwords
by Ken Dibble 05 May '17

05 May '17

What I've been saying for years .... From the O'Reilly Security Newsletter: https://venturebeat.com/2017/04/18/new-password-guidelines-say-everything-w… 1. Forcing people to frequently change passwords is not helpful. It just makes it more likely that they will stick the password on a Post-IT on their monitors because they can't remember it. 2. Imposed password complexity does not help either (As I keep telling people, the only way that a user can make his/her password harder to "guess" in the modern age is to make it longer. It is just as easy for a brute-force botnet application to "guess"#51aQ4@5)?" as it is to guess "YourMomma!") Maybe I should start my own security newsletter.... Ken Dibble www.stic-cil.org

1 0

Re: [OT] Excessive Bounces E-mails
by Gene Wirchenko 05 May '17

05 May '17

At 22:57 2017-05-04, you wrote: > > I got another of these today. Did anyone else? > >No, but who knows what I've inadvertently missed? > > > I ended up getting nothing for today. How do I get the missing > > posts? (I assume there were some.) > >Check the archive. http://leafe.com/archives/search/profox I am asking how do I get the E-mails. I have all my ProFox E-mails saved locally where I can look at them should I wish. I would like this set to be complete. Sincerely, Gene Wirchenko

1 0

[NF] Microsoft Surface Pro 3 for sale -- what's a good fair price?
by mbsoftwaresolutions＠mbsoftwaresolutions.com 05 May '17

05 May '17

I've been needing a replacement laptop for awhile now. My old Dell Latitude 5530 is about 5-6 years old I think. Got a buddy of mine (so friend's discount to be included!) who's got an extra Windows Surface Pro 3 laptop he's willing to sell me. Told me to tell him what's a fair price. He's not a techie. Hardly used; maybe 2 months. Specs: Microsoft Surface Pro 3 Intel Core i7 6650 U CPU @ 2.2GHz 8 GB RAM 64-bit OS Windows 10 Pro "Pen and Limited Touch Support" 238 GB hard drive No CD/DVD docking station with plenty of ports Thoughts?

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

ProFox May 2017