billso.com

There are plenty of great free software applications and services available on the Web.

In some cases, payment removes advertising and enables more features. Some require a subscription or a one-time payment.Sometimes the payment is merely a donation to a one-man operation that wrote the code.

Here’s a few quick lists of what I’m using, inspired by this discussion on Weblog Tools Collection:

Keep in mind that my recommendations are for the consumer or individual versions of each service. Some products are available in corporate or enterprise versions for a fee.

Free software and services that I would pay for, along with links to each service’s “about” or home page:

• Craigslist, if only to get the spam and junk postings off the classified portion of the service.
• del.icio.us, my second favorite social bookmarking service. I’m waiting to see what happens to Yahoo, the company that owns del.icio.us and also owns my next choice..
• Flickr, for the Pro account features.
• Google Earth, to get enhanced features on the Mac application.
• MacUpdate, for enhanced features on this Mac software update service.
• PayPal, so I could have a business account.
• Skype, for unlimited calling.
• StumbleUpon, my favorite social bookmarking service, to get some extra features as a sponsor.
• TextEdit, my favorite text editor for Windows.

Here’s a list of free software and services that I wouldn’t pay to use, because the ROI just isn’t that great:

• avast, my favorite virus scanner for Windows and Mac.
• Firefox, the best web browser for the Mac and Windows.
• Gmail, because the keep adding more storage space to my free accounts anyway.
• Twitter, a microblogging service that supports SMS and a variety of web and software clients
• Twitterific, a Mac twitter client. I can live with the occasional ad.
• WinZip and other file compression programs.
• WordPress, the software I use to run the billso.com web site. It’s fabulous, free, and there’s no real reason to pay for it. Many WordPress developers earn consulting income from clients who need

It’s pretty easy to get a legal copy of Microsoft Office 2007 Ultimate Edition for Windows, but you have to act before 16 May 2008.

Go to this web site, enter your .edu email address, and be prepared to send a copy or scan of your university student ID card. This Microsoft site has more details.

The offer started in September 2007, and the suite includes:

• Access 2007
• Accounting Express 2007
• Excel 2007
• InfoPath 2007
• Groove 2007
• OneNote 2007
• Outlook 2007 with Business Contact Manager
• PowerPoint 2007
• Publisher 2007
• Word 2007

Yesterday was Patch Tuesday, and Microsoft has finally released Service Pack 3 (SP3) for Windows XP. See CIO, InfoWorld, Engadget and Paul Thurrott for some comments, and fire up Windows Update or Microsoft Update to start the install. This may be the last SP release for the 2001 edition of Windows. SP3 may be enough to keep companies from upgrading their desktops to Windows Vista for the next year or two.

Here’s a few interesting thoughts about passwords. Some users have problems remembering their passwords, so they rely upon one password that they can easily remember.

David Naylor has compiled several lists of commonly used passwords. Permutations of “password” and numeric characters are frequent entries in these lists. One of the lists that Naylor uses comes from this DarkReading article that has provides a more detailed discussion of system administrator passwords.

I’ve become a big fan of the passphrase, which is a long password that might resemble a sentence, a list of phone numbers, or some other easily remembered data. This Diceware article has some excellent tips for selecting a strong passphrase.

If the system supports a long password, try using the portions of the sentence or the entire sentence itself as the passphrase.

If you want a shorter password, try using the first letters of a long sentence that you can easily remember, but others will find hard to guess. Shorter passwords are easy to break or crack, so users have to balance security with memory.

Some examples

As an example, an English translation of Julius Caesar’s famous quotation, “The entirety of Gaul is divided into three parts”, might be encoded into a short passphrase, shown below in bold, by using the first letter of each word in the sentence:

1. TeoGiditp is a literal conversion of the sentence that preserves the uppercase characters. It’s a weak encoding scheme, because it’s too easy to guess.
2. tE0Gid13p substitutes a number whenever a alphabetic character is repeated in the sentence. This system is a bit harder to crack, and may be more difficult for the user to remember.
3. +€0G!d1Ep uses punctuation marks or typographical symbols that resemble some of the characters. This encoding scheme may be difficult to type and remember, but the variety of characters used makes a dictionary-based attack less effective.
   
4. 190515070904091916 is another substitution cipher in which each letter is replaced by a number representing its numeric order in the English alphabet. This system may work well for devices on mobile phones. This cipher could be refined by using a non-decimal system like hex, or by rotating the numbers so that i=1, j=2, k=3 and so on.
5. 19!05@15#07$09%04^09&19*16 uses the punctuation marks produced by the shift+numeric keys on a US keyboard to indicate or delimit each character. Again, the user should identify a more random set of symbols that can be remembered and typed.

If the passphrase creator reveals the rules they used to create or encode the passphrase, these examples are trivial for a person to crack.

It’s also easy to crack a password if its used by the same person on multiple systems or sites. The overall security of the password is only as strong as the weakest security scheme employed by any of these sites.

Keep in mind that some characters are not available on all keyboards. Mobile phones and PDAs present special problems, as these keyboards are quite limited. The Euro (€) symbol is usually shown on European keyboards, but is rarely shown on US and Canadian keyboards. This symbol can be typed alt+0128 on US Windows keyboards, with a shortcut key on various other keyboards, and alt+shift+2 on US Mac systems.

Create a password keychain

One trick for creating a site-specific passphrase that can be easily remembered is to include a portion of the site’s name or URL in the passphrase itself. While this system can give a human of software-based password cracker a start at decrypting the password, it does allow users to use a single passphrase across multiple sites. Example #1 from my first list might be encoded as follows for these URLs:

• google.com: TeoGiditp-google (much too easy to crack!)
  
• yahoo.com: TeoGiditp%oohay (that’s “yahoo” backwards)
• hotmail.com: h0+mA1L#TeoGiditp (tougher to crack, harder to remember and type)
  

Using a well-known sentence as a passphrase can also reduce its strength. Try a random passphrase generator like this one from leemon.com. You may need to try several passphrases until you find one that you can remember.

Of course, all of these tricks cannot prevent a keystroke logger, camera or shoulder surfer from observing your password as it is typed.

Related posts on billso.com

• 17 April 2008: Virtual keyboards and monitoring software foil keystroke loggers
• 2 July 2007: CXOs face malware email attacks
• 11 January 2007: How to create a secure password

I’ve written about the Google Phone, also known as the gPhone, before on billso.com. Mobile phone manufacturers are starting to test prototypes and prepare an initial wave of handsets for FCC certification, with public sales likely late in 2008.

The arguments among software developers are starting to heat up as Apple gets its iPhone SDK (software development kit) ready to ship, while Google continues to revise its Android SDK. Android is Google’s software platform for smartphones.

On one side, AndroidGuys claims that the first generation of Android-powered smartphones will suffer from quality control problems, incomplete software and bugs. That’s probably true. Of course, iPhone had some initial issues right out of the box, too.

On the other side, droidworks counters with an important difference between the two platforms. Apple’s iPhone is a high-end smartphone that is tightly integrated with Mac software and iTunes.

The Android platform is based on open source software, and is highly scalable. We’ll see more Google Phones in India and China than iPhones, simply because Android is much cheaper to license and easier to deploy with inexpensive chipsets. There will be gPhones from a wide variety of manufacturers. Android phones do not require a full QWERTY keyboard or a touch screen, but the software will support these features if they’re included in the hardware.

Apple, on the other hand, will remain the sole brand for the iPhone.

Related articles on billso.com

• 20 April 2008: Mobile phones - the cure for global poverty?
• 5 March 2008: Today’s battle for tomorrow’s mobile phones
• 20 February 2008: Mobile phone platform wars
• 31 January 2008: Applications are coming for the iPhone
• 13 January 2008: The story of the iPhone
• 5 November 2007: There is no Google Phone - but there is an OS
• 12 September 2007: The Google Phone and the iPhone - both looking for software and spectrum
• 27 August 2007: Wireless providers gird themselves for battle