Windows 8 Boot Recovery

A bizarre day of hard drive tinkering.

So one of Amber's hard drives started making the telltale grinding noises of impending doom. "It sounds like my computer is driving over a gravelly road... and now it's stuck at the Windows loading screen." she says. I groan; I know that particular sound means I'm probably already too late, and that the odds are distinctly not in my favor for getting any data off, but I promise to try to extract the data that evening.

So, I take the drive from her computer, connect it to one of my many SATA ports, and power up. Sure enough, the drive is sounding truly awful. But sadly, the presence of this drive has apparently confused the Windows 8 boot loader.

Lets take a step back. I have an "interesting" configuration. I run a 100GB RevoDrive, plus a 1TB SATA3 drive; System Partition is on the former. However, the latter is divided into three partitions. First is the "System Reserved" partition (which Windows always insists on putting on the SATA drive for some reason), then my data partition. Due to experimentation back in the Windows 8 Release Preview days, my third partition is a functional Win8RP partition. The configuration is by nature fragile, since the RevoDrive needs non-standard drivers, but I've never had install problems.

Back to the boot process. Windows 8 startup for some reason REALLLLLLLY wants to do stuff with the dying drive, and kicks off some repair. The repair freezes at 100%, the drive is sounding worse and worse. I can't exit back to the normal boot process, so I hard reset. Now this just makes Windows MAD! They decide that it's time to do "automatic repair", and decides to give the old Windows 8 RP build supremacy, presumably for being on the same physical disk as the reserved partition.

Now I'm totally screwed. RP has control, isn't showing any other boot options, and wants to reboot hourly to discourage me from using the pre-release OS any more. The standard recovery tools (notably bootrec.exe) are not actually available live, only in the recovery environment. So I write my Win8 ISO to a USB stick, reboot, and enter a repair command prompt. The recovery tools in Windows 8 should have no problem fixing me up, but unfortunately, the recovery paths that let you load drivers are mutually exclusive with the recovery paths that let me fix repair my boot sequence.

Well, reboots, and further frustration ensure. Long story short:

1. Copy RevoDrive drivers to a second USB stick.
2. Reboot to Windows 8 install. Choose "Repair my System".
3. Find Windows 8 RP mounted on SATA drive.
4. Run pnputil -i -a J:\path\to\driver.inf
   This loads the drivers from the command prompt! The tool isn't in the recovery environment for some reason, but seems the RP version worked fine.
5. Run bootrec /fixmbr
6. Run bootrec /RebuildBcd
   This is the magic. It scans all the fixed disks, and writes out the BCD to boot them properly. Now that the drivers are loaded, it's suddenly not even interested in RP anymore and finds my Windows 8 Pro release build.

After this, a quick reboot and my machine is functional again.

Needless to say, I've permanently deleted the RP partition, so Automatic Repair doesn't get smart with me again. Next up, proper backup recovery.

Want to know the funniest thing? After all that, the dead drive turned out to not be Amber's system drive (or even her data drive). It was just a leftover drive from when she needed the extra space for MMO clients. Her OS, and practically all the data she cared about was intact!  Who knows why Windows 7 refused to boot when the system partition was intact, but once the dying drive was removed, her computer was fine like nothing happened.

Lumia 920 win

My Samsung Focus rather unceremoniously bit the bucket today - it decided suddenly to stop accepting a battery charge. Thankfully, this occurred to the day of my upgrade cycle with AT&T, so I decided to upgrade to the Nokia Lumia 920 (black), one of the new Windows Phone 8 devices.

Admittedly it's hard to say I'm unbiased, but Windows Phone 8 is truly a work of genius. Ecosystem be damned, this thing is way better than even the mighty iPhone.  Nokia also adds a respectable amount of value.

A short list of why the Lumia 920 (and Windows Phone in general) is the best phone ever:

• Nokia Drive. FREE MAPS, and not the crappy homebrew ones from Apple, but proper Navteq. Of course, with voice turn-by-turn. The big surprise - OFFLINE maps - now I can finally navigate in Canada! Did I also mention "completely free"?
• Free ringtones. None of this charging for ringtone nonsense from iTunes; just drag a song from your computer to "Ringtones".
• Forget re-buying all the accessories (*cough* iPhone 5 *cough*), my Lumia plugs in with *gasp*.... micro-USB. Wherever will I find a cord that fits?
• Skydrive sync. Zune was always behind iTunes in terms of phone syncing... but now it's irrelevant. Windows Phone 8 just does away with Zune entirely. Your texts and app list are backed up, and your photos back up directly to SkyDrive.
• Uberscreen. 4.5" of HD, with jet black blacks (both bigger and higher resolution than iPhone 5).
• Really fast - noticeably faster than the Focus.
• Childproof. Now with a "Kids Corner", a mode where kids can access games or apps you choose, but not dial Russian sex lines.
• Resizable tiles. Yes, it may sound like a dumb thing to get excited about, but once you start customizing your start screen, you realize how satisfying it is to turn your start screen into a proper information hub.
• Ready for business. Mobile Office pre-installed; automagic sync to both SkyDrive and SkyDrive Pro (didn't even have to set them up). Email and calendaring to Exchange (and Google, and Hotmail) retains the utter perfection achieved in Windows Phone 7.

... and I haven't even tried some of the best stuff yet, like the "Lens" feature (or the camera in general), tap-sync, or the legendary pillow charger. I suspect the next few days will be fun.

While I'm disappointed with the loss of Zune sync support, the fact that you can simply copy stuff with Explorer or a variety of other sync apps more than makes up for it. While the new Windows 8 "Windows Phone" app is obviously primitive and feature-anemic, it did copy media to the phone as advertised with no issues.

For my token negative comments... seriously, AT&T, is the crapware really necessary? Why would I pay monthly for your navigation, TV or music, when it's given away for free by apps built in to the phone? You cost me entire minutes deleting it all!

UPDATE 1/23:
More cool stuff discovered while using the phone.

• Separate volume for each Bluetooth device. This was a complaint I had with WinPhone 7.0, and its resolution makes my morning commute way easier.
• Visual voicemail. About time!
• Emotion added in text-to-speech! It's pretty minor, but you can hear that the 8.0 voice actually sounds happy that you've received a text message, while the 7.5 voice is carefully neutral.
• Nokia Music. Actually pretty good - perhaps redundant to Zune Pass holders, but you can offline your "mixes" with less effort than Xbox Music.

How do I protect my Paypal account?

A friend of Amber's recently asked an interesting question - how can you protect your Paypal account from being hacked?

Well, I may not work for Paypal (or any Internet finance company), but I do know a thing or two about security, so I figured I'd give a shot at providing some tips to keeping your account secure. The same tips can apply to just about any valuable Internet account you want to protect.

1. Use a unique password.
Your password should be something:

• NOBODY else knows. Yes, not even your spouse, your kids, your tech support guy, or even your Mother. The more people that know, the higher the chances that at least one person will abuse the access, or even if they don't, will make a completely unintentional mistake that ends up exposing your password.
• Is not used at ANY OTHER WEBSITE. It turns out that financial institutions (usually) do a pretty good job of protecting their users' passwords. However, FarmCityVampireTownVille, written entirely in Edgar's Mom's basement, is likely not quite as careful. Any two-bit hacker cracks the game's password file, then tries those passwords on more valuable websites like Paypal.
• Is not blatantly obvious. While hackers may not know the name of your dog or your birthday, that angry ex-girlfriend probably remembers it acutely, and is eager to use that knowledge to steal every cent you have.
• Is not written somewhere easy to access. Sticky notes (the real world kind) on the monitor are bad. A Notepad file on your desktop (the virtual kind now) is worse. Having the browser remember your password is just asking to get robbed. If you really want to save your passwords somewhere, there are specialized applications, eg. 1Password, which will allow you to save your passwords encrypted on your computer or phone. These applications can be a mixed blessing - the idea is that saving all your passwords under a single master password is worth the risk because it is then practical to use unique passwords for every website.

I specifically omitted any tips about having a "strong" password. While your password shouldn't be excessively short or common ("abc" or "dog" are probably not good choices), the gains from adding a bunch of numbers and punctuation are modest at best, and changing a password frequently (more than once every few months) is often more counter-productive than helpful. In my humble opinion, it's more important to have a unique password you can remember than what some security experts consider a "strong" password.

2. Use only computers you trust.
A compromised computer or device can easily steal your password.

• Run anti-virus, and keep it up-to-date. You are susceptible to computer viruses. Period. I don't care how safe you think you are. I don't even care if you only surf news sites, or if you don't even have the Internet. You WILL eventually be exposed to a virus, and an effective anti-virus can protect you from most of them (blocking rates for most good anti-virus programs are in the mid-90%'s).
  If you don't have an anti-virus (or let your subscription lapse on the one you have), and don't feel like paying for one. Microsoft gives away a free anti-virus. Alternatively, if you have Windows 8, you already have anti-virus built in.
• Don't use anyone else's computer to access your account. Don't log into Paypal from your friend's computer. Or your Mom's computer. Especially not an Internet kiosk, or at a store. I'd even warn against using your account on a shared computer at home, if you can avoid it. It is simply too hard for you to be sure that the computer you are using is trustworthy to not steal your passwords.
• If your computer is behaving strangely, don't access your account. This is a bit more subjective - computers can often seem to act 'strangely' in completely normal circumstances. However, if your computer is displaying unexpected pop-ups, redirecting your Internet searches, running (unusually) slow, you should consider at least a virus scan before using your account. If you have been told that you have a virus, *never* use your account until your computer has been successfully cleaned by anti-virus software - and if possible, inspected by a professional.

What I didn't say here is "trusted networks". Go ahead and use your account on any Internet connection you can get - home, work, your hotel room, even public wireless. Any credible financial website these days will use encryption ("https"... usually indicated by some sort of padlock icon in your browser address bar). This means that, assuming your computer is otherwise trustworthy, that even if somebody is listening in on your connection, they can't see your password.

Note: while Paypal protects your entire session using encryption for privacy, other websites (eg. Gmail) only protect your password, then switch to an unencrypted connection. This means that anyone listening in will be able to see whatever you're browsing (for example, your emails), particularly on a wireless connection. If you value privacy, the EFF makes a great tool called HTTPS Everywhere that turns on encryption automatically for many common websites.

3. Protect your email account.
It turns out that your email account is one of your most valuable assets for security. When you click that "I forgot my password" link on your favorite website, usually they send you a password reset email. Even worse, your email likely has enough personal information (friends/family information, birthdays, account numbers, sometimes even passwords or security questions) to crack most every account you own, even ones that aren't on the Internet!

Take similar precautions with your email account as you would with your Paypal account, because the former may provide the keys to the latter.

Anyone else have good tips to protect your Paypal or other valuable Internet accounts? I'd love to hear about them in the comments.

TD Visa Disgust

I've been banking with TD Canada Trust for most of my life. I banked with them back before the Canada Trust merger, I held my first credit card with them, my first retirement savings, even my first investments. But today, they have paid me a gross insult, hidden within pages of legalese, that has me seriously considering leaving this bank forever.

Today, TD Visa sent me a chip and pin card.

For those of us who have been away from Canada now, chip-and-pin cards, as a result of intense pressure from card issuers, have become a de-facto standard for merchant transactions in Canada. Rather than the familiar process of swiping a magnetic stripe and signing a piece of paper, you instead stick your credit card into a terminal, and enter a short numeric code (your PIN). The system has become so pervasive that in many establishments in Vancouver, new members of the service industry don't even know how to swipe a card - much to my amusement when I visit with my ancient magstripe cards.

Why chip-and-pin? It's more secure! Anyone with cheap (or even free) hardware can duplicate the information on a magstripe card, write a random squiggle on a receipt, and walk out of any merchant with as much as they can carry. It's much harder to steal from a chip-and-pin. The card never has to leave the user's hand, and even if it does, is exceedingly difficult to duplicate (millions of dollars of high-end forensics hardware). Even if the card is duplicated or just outright stolen, without the PIN it is difficult to extract any money from it.

Credit cards that are harder for people to steal from? Sounds pretty good, right? Well they are! Except many banks, including TD Canada Trust, have used it as an opportunity to offload risks onto their cardholders.

From their cardholder agreement:

Before you notify us, the Primary Cardholder will not be responsible for any unauthorized Transactions that occurred, as long as you have complied with the Agreement. If at any time your Card or the Account is used, including at an ATM, with a personal identification code (such as a Personal Identification Number (PIN), Connect ID and/or Password), that will be considered an authorized Transaction for which the Primary Cardholder will responsible.

What this translates to is: if you use a credit card, you're not liable for any theft or fraud, unless it's a chip and pin, in which case you're liable for 100%. You're liable for a mugging. You're liable for a terminal with a tampered screen. You're liable if someone uses well-known man-in-the-middle attacks to use your card without your PIN. It may be a bit harder to steal from you, but if they do, it's your problem, no matter what the circumstances.

I don't know if all banks do this. It seems to be a recent change or clarification with TD Canada Trust. I've heard CIBC made this change years ago. Smaller credit unions may be behaving more responsibly than TD Canada Trust. I desperately hope I can find an institution in Canada that actually respects its cardholders, rather than lining them up for theft.

... or maybe I'll just drop my Canadian credit cards entirely. In an ironic role reversal, US law protects cardholders from liability.

Leaving IEEE

I was a member of the Institute for Electrical and Electronics Engineers for ten years, joining as a student member in my early days at the University of Waterloo. I enjoyed my days as a student member, taking advantage of student paper nights, and getting involved with the local student society. During my Masters degree, I was lucky enough to attend a few IEEE conferences, and even published in a few of them. Overall, I felt that

However, after several years in industry, it's not quite as useful. I'm not publishing, nor attending (IEEE) conferences. The very concept of magazines and journals seems dated in an era of RSS, Reddit, and open access. Combine that with a very underwater mortgage, a family to support, and much higher membership fees, and the membership value proposition becomes hard to justify.

But what killed me more than anything - the spam. Neverending spam. I think the most offensive was the IEEE-affiliate life insurance - clearly not even tangentially related to the IEEE, yet I'm getting shredder food every month. Next on my list, the IEEE Communications Society. I don't do communications. I'll probably never do communications. I haven't the slightest interest in the topic, nor have I ever expressed such an interest. Still, they sending me every last call for papers, nag me regularly to subscribe to their content, and steadfastly refuse to honor my unsubscribes.

Finally, I had enough, and let my membership lapse at the end of 2011. This was just the beginning of the spam, with nearly a dozen different offers, warnings, requests and complaints trying to encourage me to renew. Not entirely unexpected, but what really got me was when they opened a support incident at "my request" in their support system, simply to further spam me through their ticket system. Every new email further reinforces how right I was to disassociate with this organization.

IEEE, you are supposed to be the premier professional organization for modern engineers, not an affiliate marketing business. Shame on you.

Good old Games?

Recently I've been availing myself of GOG.com - a site that sells old PC video games at bargain prices, most often $6, though with regular $3 weekend sales that can be hard to resist. Most of the games are packaged to run under the DOSbox emulator, and so far every one has run perfectly.

In an era of multi-million pixel displays, 3D audio, and multi-gigabyte drives, are these ancient games really worthwhile? Some definitely have withstood the test of time. So far, my favorite has been Lands of Lore. There's something about that MIDI soundtrack and the gameplay that seamlessly mixes combat and puzzles that is just as addictive now as it was in my teenage years.

Still, playing many of these classic games have reminded me just how much things have evolved in game design; simple concepts that took the industry surprisingly long to catch on to, that you can't help but miss when going back to those old games.

Control Mapping
Back before the mouse was a basic requirement of every game, it was popular to use the arrow keys for navigation, rather than the now-popular WASD. This allowed the dominant (right) hand of most players to be used for  precise movement. Games eventually adopted the mouse for look, and thus stole the right hand from the arrow keys. Try using the arrow keys with your left hand, while using the mouse with your right. It cramps. Quickly.

But even more fundamental than the arrows-WASD debate, is that most modern games will let you set whatever controls you want. As long as you're willing to spend a few minutes in an option screen, you can set up whatever control scheme you can imagine. In the old games, the controls are the controls, and you live with them or play something else.

New games even let you adjust whether to use inverted or regular mouse look. Yes Magic Carpet, I'm tired of inverted mouse.

Checkpoints
I think I first saw this in Halo - the idea that without significant player intervention, the game would save your progress, so that if you died, you could recover at the start of the most recent section of the map. Now, we take it for granted that in most games your progress will be saved, and a death can only cost you a finite amount of progress. Having to repeat more than five minutes of play is considered poor style in a modern game.

Not so in old games. When you die, it's GAME OVER. Exit to DOS, or start a new game. You can reload from the last point you saved. If you saved three days ago... well sucks to be you. This is particularly relevant with old games, because they're hard! You'll be dying. A lot. It took me the better part of a day replaying Gladstone in Lands of Lore to get back into the step-step-save habit.

Tutorials and Tooltips
Game manuals are a thing of the past. I think the Starcraft 2 manual was more lore than instructions. Many Xbox games don't even come with manuals anymore. With digital download games, it's practically a requirement that the games teach their own gameplay. Even in complex games like high-end MMORPGs, you can learn almost everything you need to know from nothing but tooltips.

With old games, manuals are often essential. First, to learn the controls themselves, which as previously mentioned, can't be discovered or remapped. In some games like Magic Carpet, even the objective of the game can be unclear without some tips. Syndicate's manual is over fifty pages, and even reading that, I only barely understand the game.

C++ interface multiple inheritance

Warning: if you're not a programmer, stop reading now.


Earlier this week I was thinking about multiple inheritance in C++. This practice is often discouraged due to challenges like the diamond problem, demanding solutions so complex that it starts to outweigh the benefits of the multiple inheritance in the first place. However, everyone says that multiple inheritance of interfaces (base classes with only virtual methods) is not only okay, but encouraged. This concept has been rolled into languages like Java and C# which otherwise don't have multiple inheritance!

But this bothered me - in C++, virtual methods are generally implemented by a virtual function table, with a pointer in each implementing class. But how does that work with multiple inheritance? How does the holder of an interface pointer know how to find the virtual functions that matter to their interface as opposed to the other interfaces? Does it even work, or will my code start breaking if I try this? I spent way too much time Bing-ing about looking for the answer with no success. Finally I decided to find out myself.

My test setup is a native C++ Win32 console application, compiled with Microsoft Visual Studio 2010. My output is 32-bit (sizeof(void*)==4).

1. How do we find the right vtable?

class IFoo {
    virtual void Foo() = 0;
};
class IBar {
    virtual void Bar() = 0;
};
class CImpl : public IFoo, public IBar
{
    void Foo() { printf("Foo"); }
    void Bar() { printf{"Bar"); }
};



int _tmain(int argc, _TCHAR* argv[])
{
    CImpl *pImpl = new CImpl;
    IFoo *pFoo = pImpl;
    IBar *pBar = pImpl;
    printf("Ptrs: pImpl = %p, pFoo = %p, pBar = %p", pImpl, pFoo, pBar);
}

Ptrs: pImpl = 000C6F98, pFoo = 000C6F98, pBar = 000C6F9C 

Well that answers that. When we try to take a pointer to the second interface, C++ will adjust your pointer, such that it points to the expected vtable inside the class.

2. But what about the "this" pointer?

So, IBar isn't actually pointing to the object. How does "this" work... is it corrupt when we call it from the offsetted pointer?

class CImpl : public IFoo, public IBar
{
    void Foo() { printf("Foo this: %p\n", this); }
    void Bar() { printf{"Bar this: %p\n", this); }
};



int _tmain(int argc, _TCHAR* argv[])
{
    CImpl *pImpl = new CImpl;
    IFoo *pFoo = pImpl;
    IBar *pBar = pImpl;
    printf("Ptrs: pImpl = %p, pFoo = %p, pBar = %p", pImpl, pFoo, pBar);
    pFoo->Foo(); pBar->Bar();
    pImpl->Foo(); pImpl->Bar();
}

Ptrs: pImpl = 000C6F98, pFoo = 000C6F98, pBar = 000C6F9C 

Foo This: 000C6F98     Bar This: 000C6F98

Foo This: 000C6F98     Bar This: 000C6F98 

Huh. They're both the same, and match pImpl. How did that happen? We just showed that the pointers are different! To answer this, I looked to the assembly. On x86, classes use the "thiscall" convention, which puts the "this" pointer in ECX. Lets see what happens.

When calling via the patched pBar pointer, we set this = pBar. This implies that CImpl::Bar implementation must internally patch the pointer back from IBar to CImpl. But, that wouldn't work when calling from CImpl directly. The compiler, knowing that CImpl::Bar() is meant to look like IBar::Bar(), actually sets this = pImpl + 4.

Oh, you're clever, VC++.

3. What about the same method defined in multiple interfaces?

A fun thing you can do with interfaces, is that different interfaces can define the same method. Since it's just a name (well, a signature), an implementer providing a suitable method can simultaneously satisfy both interfaces.

class IFoo {
    virtual void Foo() = 0;

    virtual void Omg() = 0;

};
class IBar {
    virtual void Bar() = 0;

    virtual void Omg() = 0;

};
class CImpl : public IFoo, public IBar
{
    void Foo() { printf("Foo"); }
    void Bar() { printf{"Bar"); }
    void Omg() { printf{"Omg"); }
};

But how would this work? After all, we just discovered that CImpl::Bar() expects "this" to look like IBar. What does CImpl::Omg() make "this" look like - IFoo or IBar? It can't be both - they point to different locations. But, looking at the vtable in the debugger quickly shows the trick.

Aha, VC++ is more clever than I give them credit for. pFoo directs Omg() straight to CImpl::Omg(), while pBar directs Omg() to Omg`adjustor{4}'. I'd bet the intent of this function is to adjust the "this" pointer to match IFoo - then CImpl::Omg() can assume all callers are referencing it as IFoo::Omg(), and "this" is interpreted appropriately.

Conclusion

You can use "interface-like" classes in C++ just like you would in C# or Java, including multiple inheritance, and the compiler will magically take care of making it work. It accomplishes this through manipulation of your interface pointers and your "this" pointers when using the objects, and through thunk methods where there is ambiguity.

Trust your compiler. Program with interfaces. Win!

Hawaii Vacation–by Microsoft Flight

Amber and I will be taking a vacation soon to Hawaii, specifically “Hilton Hawaiian Village Waikiki Beach Resort”. A last chance to relax before Elora’s arrival.

But I couldn’t wait… I decided to go right now, with the new Microsoft Flight, specifically the Hawaiian Adventure Pack to get access to the high-res terrain for Oahu.

According to the Internet:

(credit: http://www.smarthawaiitour.com/)

 

According to Microsoft Flight:

Flying Icon A5, chase view, from the West

 

Apparently the lagoon is NOT long enough for a water landing in the Icon A5.

 

The underside did not enjoy the beach landing.

Lendio.com = Fail

They purport to "make small business loans simple." But their actual functionality consists solely providing an embarrassingly small list of vendors, with almost no relevant information, and largely ignoring most of the requirements they had collected in a drawn-out interview process.

... and then selling the detailed information to five times as many random small financial institutions, who then proceeded to cold-call me all week.

I think my favorite was the one who insisted that if I didn't want information from his institution that I must have been a victim of identity fraud, then hung up. Then emailed me, which SPF failed. Quality partner right there.

So, don't give Lendio any of your information, because it won't be yours for long.

Dear Facebook Application Authors…

If your app says it needs my email address to function, I’m going to block it.

Seriously. What could your *Ville-of-the-week¹ possibly need my email address for? I’ll click through just about anything, but when broken down to a two-line prompt with a picture that essentially says “The author of this app is going to spam the crap out of you”, what do you really expect me to say?

[1. Zynga is just one of many offenders. Did I call them out specifically due to recent shadiness? Maybe…]

Assassin’s Creed: Revelations

Dear Ubisoft,

Please note the following list of completely redundant, unnecessary, and annoying features in your recent Assassin’s Creed titles.

• City renovations.
• Buying artwork / books / outfits.
• Den defense.
• 2D puzzles.
• 3D puzzles.
• Uplay.
• Crafting.
• Unskippable cutscenes.
• Continent-conquering menu system.
• Insta-win buttons.
• Reusing world models.
• Precursor civilizations.

I encourage you to consider redistributing the resources from the above areas into the following gameplay elements.

• Moar assassinating.
• A difficulty curve.

Sincerely,
  - Lownewulf

PS. Fix your clipping. Or at least reset me to checkpoint when I fall through the world.

Passwords and 1Password

In a way, us computer security people allowed it to happen. We allowed credit card databases to get hacked, phishing emails to fool users, and magstripe ATMs to get skimmed. However, our greatest mistake was that we stayed quiet when PHBs decided that, rather than fixing the actual security problems, instead decided on a false sense of security by forcing users to create ridiculously complex passwords, then forcing users to change passwords almost constantly.

The frequently-changing gibberish passwords with numbers and symbols actually made things far worse. XKCD explains the information theory behind why crazy number and punctuation rules actually make for weaker passwords. Forcing users to change the password frequently just makes said gibberish passwords even harder to remember, ensuring the users will have to commit the cardinal security sin of writing their passwords down. Even worse, with so many services requiring passwords, you either need to maintain a whole list of passwords, or use the same password (or pattern of password) across multiple sites. This can lead to the nightmare of one of your passwords getting exposed (especially if you wrote it down), then having to go through and chaotically change the password to almost every service you use.

I am hoping that the increasing ubiquity of mobile computing will help solve the problem, since it makes two-factor authentication essentially free. The idea being that having two separate levels of security (a simple password, plus a physical item you possess), when done right can be far more secure than any password. Blizzard has already demonstrated this with the Battle.NET Authenticator devices and apps, and I can only hope others go this route. Google is finally trying this too, though still has a lot to learn.

Sadly, until the world catches up, we’re stuck with passwords.

I found a piece of software that I’m actually really liking to help manage the insanity. 1Password is an application for Windows, Mac, Windows Phone, iPhone, and Android; currently $30 for the Windows version. It stores an encrypted list of all your passwords, locked by one “master password”. This means you can have unique, complex, and changing passwords for each service, but only need to remember one strong password. While I’m not often one to pay premium prices for software from random small vendors off the Internet, I’ve found this software to actually be quite worth the investment.

When on the road, you can look up a specific password (or even other data such as a passport number) from a mobile app synced to your desktop. Even if you lose your device (and don’t have remote erase capability), the data is encrypted with your best password.

While on the desktop, 1Password integrates with your browser. After typing your master password, it can automatically log you into most websites. If creating a new password, it can generate a strong (high entropy) password – such a password is almost impossible to remember, but you don’t need to ever remember (or even type) it.

Across computers (or to certain mobile devices like Windows Phone), the list of passwords is shared via the Dropbox cloud file replication service. Admittedly, I had never used Dropbox before using 1Password, but I’ve grown to like it. Plus, it’s free for the first 2GB of space. There’s not much security risk here – even if you don’t trust Dropbox’s security, they only ever handle the encrypted version of your passwords, and never have access to your master password.

Admittedly, from a security standpoint, password repositories can be dangerous, as the repository and master password is a single point of attack. Realistically though (and I’m sure all the security experts are cringing as I say this), anyone capable of capturing your master password is just as capable of capturing a bunch of separate passwords. So, given an equivalent level of risk, why not take increased convenience and improved password habits?

Update; FiOS TV DVR

Awhile back, I raved at the great improvement of FiOS TV. I’m still quite happy overall, but I’d like to retract my statements about the Frontier DVR. Frontier’s software still isn’t as buggy as Comcast’s on the same hardware, but it still has its share of bugs and other usability issues.

• Series recordings seem to be spotty – some series record reliably, but others seem to never find new episodes. I am missing way too much Mythbusters!
• When moving through recorded content, sometimes the video stream will fail to restart – frozen video stream, but audio will keep playing. You have to FF/RW to a different stopping point to get things moving again.
• Pause/resume has some significant lag. When you ask to pause, it plays a few more seconds, pauses, then rewinds to the point you actually wanted to pause.
• Favorites are good, but why on earth can’t you set favorites from the guide?

Certainly tolerable, but definitely not what I’d call a polished experience.