Gregarius » BetaNews.Com » janvier 17, 2012

BetaNews.Com (8 non lus)

Security lessons Zappos' 24 million customer breach should teach us

Publié: janvier 17, 2012, 10:13pm CET par Steven Sprague

Another major breach is in the headlines. Zappos, an online shoe and apparel retailer owned by Amazon, disclosed Sunday night that more than 24 million of its customer accounts had been compromised. Hackers accessed customer names, email addresses, phone numbers, the last four digits of credit card numbers and cryptographically scrambled passwords.

To its credit, Zappos moved quickly, resetting the passwords for all the affected accounts. But it was cold comfort for those who may still be in danger of having their data exposed if they used the same or similar credentials on other websites. This concern prompted Zappos CEO Tony Hsieh to warn customers of possible phishing scam exposures in an email to affected customers. It’s another reminder of the sad state of security today.

Allegedly, the attack originated on one of the company’s servers based in Kentucky. While details of how the server was hacked are scant, perhaps the best advice to all the would-be Zappos of the world would be to take the simple step: Restrict server access to only known PCs.

Establishing the identity of a platform isn’t difficult at all, in fact, the corporate PCs that would need access to an enterprise server already have the technology embedded on the motherboard. The Trusted Platform Module (TPM) can attest to the identity of the device with nearly absolute certainty.

And a second, powerful safeguard is encryption. With that much sensitive information housed on the network, encryption at the server level should be considered a "must" to prevent a Zappos-like breach in the future.

And the last lesson from the Zappos breach? Isn’t it time we armed the consumer with stronger authentication than the fragile username and password? Here, too, the TPM has proven its ability to play a role; providing an excellent mechanism to protect individual identity with an extremely secure, integrated capacity to store a PC’s security keys.

Because the TPM can store multiple keys, it enables the end-user to access secure services from multiple independent providers – each with a unique, secure key. Whoever owns the PC controls the keys stored in the TPM—giving power to the end user, where it belongs.

Photo Credit: Andrea Danti/Shutterstock

Steven Sprague is CEO of Wave Systems. His expertise lies in leveraging advancements in hardware security for strong authentication, data protection, advanced password management, enterprise-wide trust management services and more. Mr. Sprague earned a BS from Cornell University in 1987.
Add ProEject to your USB drive toolkit

Publié: janvier 17, 2012, 9:40pm CET par Mike Williams

Once you’ve finished working with a USB flash drive then it’s easy just to unplug it right away, but of course that’s usually not a good idea. If the Windows cache contains changes that haven’t yet been written to the drive then removing it may result in lost data, so it’s always best to eject the drive first.

And if you find the standard Windows eject option isn’t as easy as you’d like, then there are plenty of capable alternatives around. RemoveDrive, for instance, which we wrote about back in November, makes it easy to eject drives from a shortcut or a custom script. But ProEject takes the idea considerably further.

The program starts by trying to close down any programs that you might have launched from the drive, for instance. Which seems a good idea to us, as if they’re still active then you won’t be able to eject the drive.

ProEject also attempts to clean up after your activities. So it’ll search the Most Recently Used areas of the Registry and look for shortcuts created in your SendTo, Recent, Quick Launch and (on Windows 7) Pinned folders, removing anything that might have been added in this session.

And the program has plenty of other interesting features. If your drive is using TrueCrypt, say, ProEject will recognize this and dismount it properly. It can work with many other tools to improve drive ejection (including RemoveDrive). There’s support for using Unlocker to help identify open file handles, too.

And if this still doesn’t provide precisely what you need, then command line support means you’re able to use some of ProEject’s functionality from your own scripts. (Check the program’s Readme.txt file for the details.)

We do have one or two issues with the program. When launched it displays all the drives connected to the system, for instance: seeing only the USB drives (or at least highlighting them) might simplify the process for the user.

And ProEject also has the occasional annoying delay. For example, if you view your current settings, then close the dialog without making changes, the program still rewrites its settings file, which on our test PC meant an 8 second wait until we could continue.

For the most part, though, ProEject proves to be a powerful tool which, once configured to suit your needs, can make it much easier to safely remove USB drives. And even with occasional irritations (which will be fixed in time – it’s only version 1.0, after all) we think the program is still strong enough to merit a place in most people’s portable USB toolkit.

Photo Credit: chien321/Shutterstock
Everything you need to know about e-textbooks before Apple gets involved

Publié: janvier 17, 2012, 9:27pm CET par Tim Conneally

Apple is holding an education-themed event this week, and the usual gamut of unnamed sources and rumor-mongers have come to the consensus that the event will focus on Apple's plans to enter the e-textbook business, and possibly unveil a new interactive e-book publishing platform.

This rumor springs from the best-selling biography of late Apple CEO Steve Jobs, in which Jobs' biographer Walter Isaacson said textbooks were "the next business [Jobs] wanted to transform," and that the company had already had several series of meetings about making Apple e-textbooks a reality.

Recently, Washington, DC-based Gilfus Education Group released its annual list of the top five trends in education innovation for 2012, and unsurprisingly, e-textbooks topped the list.

Some have already predicted that Apple's presence would do the same thing for e-textbooks that it did for .mp3 retailing. That is to say, take an already existent (but disjointed) market and whip it into shape with a domineering hand. So before Apple's event takes place, we thought we'd compile a list of the big players in the e-textbook space to create a better picture of the e-textbook business and what Apple will be coming into.

Barnes & Noble Nook Study - Book retailer Barnes and Noble has approximately 2.5 million e-books of all types available, including e-textbooks. Nook Study lets students rent or buy e-textbooks on the web and read them in the Windows or Mac application. The application allows search, tagging, annotations, highlights, and printing. Unfortunately, Nook Study does not yet exist as a mobile application like the regular Nook e-reader does.

Amazon Kindle Textbook rental - Unlike Barnes and Noble, there really isn't much difference between Amazon's regular e-books and its e-textbooks. The cross-platform Kindle application deals with e-textbooks in the exact same way as regular e-books, but Amazon has an e-textbook rental program that lets students buy temporary licenses on books to save money.

Chegg - Chegg began as a textbook rental site in 2007 and grew to become one of the largest of its type. In 2011, the site branched out into e-book rentals, and began offering HTML5-formatted e-textbooks for consumption in the browser. Chegg has partnered with Cengage Learning, Elsevier, F.A. Davis, Macmillan, McFarland, Rowman & Littlefield, Taylor and Francis, McGraw-Hill, John Wiley & Sons, and Oxford University Press for content.

CourseSmart - This online vendor distributes digital material from many of the biggest textbook publishers like Chegg does. CourseSmart's partners include Pearson, McGraw-Hill Education, John Wiley & Sons, and Cengage. With its own desktop software, a Web-based e-book store, a developing mobile presence, and about five years in operation, CourseSmart is a highly visible channel for e-textbook distribution. CourseSmart and Chegg are currently the two most well-regarded e-textbook platforms.

VitalSource - Ingram Content Group's VitalSource is actually the platform that powers both Chegg and CourseSmart, making it the most widely used e-textbook platform in the world, reaching more than 180 countries and 6,000 universities globally. It's not the face that students see, but it is of immense importance in the still young e-textbook industry.

Kno - This startup from one of Chegg's co-founders first began in the hardware business, trying to get a dual-screen e-reader off the ground, but it eventually morphed into a software-only mobile application and e-book retail/rental store. Now the company has a selection of over 150,000 e-textbooks, and strives to be different by rolling unique learning features into its application, such as behavioral analytics, flash cards, and journaling.

Inkling - Like Kno, Inkling is a mobile application designed specifically for consumption on tablets, and like many of the other services, it offers e-textbook rentals. However, it differs in execution from the likes of Amazon and Barnes and Noble. Instead of renting textbooks for a period of time, students buy their books by the chapter, and each chapter generally costs between $1.99 and $21.99, as determined by the publisher. Right now, Inkling has only a few hundred textbooks available for purchase.

CafeScribe - Educational tools provider Follett Corporation launched its own browser-based e-textbook platform CafeScribe in 2010, and has already partnered with more than 800 university bookstores to be their e-textbook solution. Follett's library has more than 10,000 titles.

Nature Publishing - In 2011, 135-year old Nature Publishing wrote its first textbook, the "born digital" text called Principles of Biology. At just $45 dollars, Nature completely rebuilt the business of publishing textbooks to cater to the e-book generation. The result is a book that is more quick to market, more dynamic, and cheaper.

ScrollMotion - ScrollMotion differs slightly from most of the companies mentioned above because it designs standalone e-reading applications for content publishers, and created the HMH Fuse K-12 "iPad Textbook" app for Houghton-Mifflin Harcourt publishing. Publishers can, with this type of app, offer their content directly to students and consumers. This company is in an extremely important position to watch, because Gartner Research predicted that by 2016, more than 50% of all e-textbooks will be self-published. Making an e-textbook into a standalone app would make it more accessible and visible.

Lulu - Following the self-publishing train of thought, Lulu lets authors create their own e-textbooks, convert them to multiple formats, and assign them ISBNs for listing and sale across multiple e-book stores. Additionally, it has its own retail platform for both physical and e-book sales.

Scribd - Like Lulu, Scribd lets authors or content creators upload their e-textbooks and distribute them either for free or in the Scribd Store. The main drawback of these self-publishing platforms is that they lack the necessary peer review and content vetting that makes textbooks what they are. Gartner Research in December said we can expect providers such as Lulu, Smashwords and Scribd to expand on their peer review capabilities to answer this demand.

Flat World Knowledge - This five-year old company publishes complete, peer-reviewed textbooks under a Creative Commons open license and lets students read them for free online, or purchase them as affordable downloadable e-books or even as printed books. Educators who want to save their students a great deal of money on books and learning materials can choose to "adopt" Flat World texts into their curricula. These texts are given a unique URL and can be shared freely with students without the need for user profiles.

Image: Siamionau Pavel/Shutterstock
Mount disc images with ISO ToolKit

Publié: janvier 17, 2012, 9:22pm CET par Mike Williams

ISO images have been a popular means of distributing software for a very long time, so it was good to see Windows 7 finally introduce a tool to burn them to disc.

It’ll probably be Windows 10 before we get to see the operating system provide all the ISO handling features you’re likely to need, though, so if you regularly need to work with disc images then a quicker solution might be to download the ISO ToolKit.

The program supports five main functions. It can create an ISO image from a folder structure on your hard drive; copy a CD or DVD to an ISO image; convert images to and from the ISO, NRG and BIN/ CUE formats; extract the contents of an ISO, NRG or BIN/ CUE image; or mount up to two ISO, NRG or BIN/ CUE images as virtual drives, so that they can be accessed without burning them to disc.

There’s no support for burning images to disc, unfortunately, but that’s still a reasonable feature list for a small, portable tool. ISO ToolKit also provides useful extra touches where you’re most likely to need them (when creating an image you can choose from six file systems, for instance, and make the final image bootable). And each function is presented simply, with the minimum of fuss -- you just click the tab you need, specify the relevant drive, image or folder, and ISO ToolKit will go to work.

The one major problem we noticed occurred with the image mounting feature: it didn’t work at all our first test system, but ran just fine on another. Other users report similar experiences -- it works for some, not for others -- and so there’s clearly an issue here which the author has yet to figure out.

This may not be the tool for you if you’re solely interested in mounting disc images, then. But otherwise the ISO ToolKit is a likeable program, compact, portable and easy to use, and we’ll be interested to see how it develops in future.

Photo Credit: Eastimages/Shutterstock
Will your website go dark to protest SOPA?

Publié: janvier 17, 2012, 9:09pm CET par Joe Wilcox

Jan. 18, 2012 is designated SOPA blackout day, with prominent websites planning to go dark in protest of two bills working through Congress -- Stop Online Privacy Act and PROTECT IP Act (PIPA). If you've got a big school project due Thursday and plan on using Wikipedia, get your research done today. The community-based encyclopedia plans to go dark tomorrow, and it's not alone.

The proposed legislation has generated gigabytes of negative responses, which included a Go Daddy boycott for supporting SOPA (since retracted) and culminates in tomorrow's blackout. Two months ago, I posed poll: "US Congress is considering two new copyright bills: PROTECT IP and Stop Online Piracy Act. Do you support them?" More than 3,500 responses later, 95 percent answered "No". You're not alone.

To recap, Senators introduced PIPA in May and House representatives did likewise with SOPA in October. Either bill would give the government broad powers to take down websites, seize domains and compel search engines from indexing these properties. Little more than a request from copyright holders is necessary. It's essentially guilty-until-proven-innocent legislation that would punish the many for the sins of the few, while disrupting the fundamental attributes that made the Internet so successful and empowered so many individuals or businesses to accomplish so much. (Review the bills: PIPA. SOPA.)

Wired UK's "SOPA 101" guide is one of the best primers posted in recent days, if those bills are too long (and wordy) for you.

Last week, the White House finally took a position about SOPA and PIPA: "While we believe that online piracy by foreign websites is a serious problem that requires a serious legislative response, we will not support legislation that reduces freedom of expression, increases cybersecurity risk, or undermines the dynamic, innovative global Internet".

Tomorrow's blackout protest was scheduled to coincide with a House vote on SOPA, which has been postponed, leading to many cries of victory over the legislation. SOPA isn't dead, and last I checked the Senate still plans to vote on PIPA as scheduled. SOPA is on hold, not that the White House is really helping. The statement -- from Aneesh Chopra, US chief technology officer; Victoria Espinel, intellectual property enforcement coordinator; and Howard Schmidt, cybersecurity coordinator -- merely steps back from the proposed legislation.

"Moving forward, we will continue to work with Congress on a bipartisan basis on legislation that provides new tools needed in the global fight against piracy and counterfeiting, while vigorously defending an open Internet based on the values of free expression, privacy, security and innovation", they write. Meaning: They're backing off because of public pressure. More than 51,800 people signed petition: "VETO the SOPA bill and any other future bills that threaten to diminish the free flow of information".

If the Obama Administration really opposes SOPA and PIPA, then prove it: Blackout Whitehouse.gov tomorrow. Show support for protecting Internet freedoms.

The Go Daddy boycott shows just how impassioned are SOPA and PIPA opponents. My question: How far well they -- you -- go? Will you boycott sites that don't support the blackout? Facebook, Google, Tumblr and WordPress.com, for example -- I've seen nothing yet indicating blackouts planned for tomorrow. Imagine the impact if Bing and Google went dark for 12 hours on January 18.

Wikipedia will go dark, or so founder Jimmy Wales tweeted yesterday and then boasted: "This is going to be wow. I hope Wikipedia will melt phone systems in Washington on Wednesday. Tell everyone you know!" Wikipedia's official announcement released later. Reddit also will go dark, but not Twitter. Yesterday, CEO Dick Costolo made clear Twitter's blackout position in a couple of tweets: "Closing a global business in reaction to single-issue national politics is foolish" and "Not shutting down a service doesn't equal not taking the proper stance on an issue. We've been very clear about our stance".

Twitter has vocally opposed both bills, but Costolo's tweets, in response to others, don't reflect that. He put it in business perspective, which is more in the spirit of content providers, such as those in Hollywood, supporting SOPA and PIPA. More sensible response: "Twitter is a tool of free speech. Blackout would suppress it". That fits in less than 140-characters. :)

Will you take down your site to oppose SOPA? If you have a third-party hosted WordPress site, meaning not WordPress.com, there are many plug-ins available to automate the process. Please answer in comments. Before anyone asks, I will take down my personal website from 8 am to 8 pm EST tomorrow, but, sadly, don't think it matters much since I haven't posted there in months (I've been too busy at BetaNews).

Photo Credit: sagasan/Shutterstock
Pokki creates desktop apps from websites

Publié: janvier 17, 2012, 5:57pm CET par Nick Peers

You have undoubtedly noticed that an ever-increasing amount of the time you spend using your computer is online. The same is true of your phone, and when you’re out and about it is quite usual to use dedicated apps to access services such as Facebook and Twitter. But when using a desktop or laptop, the vast majority of people will head straight to the website of various online services. Thanks to Pokki this may change.

Pokki is a platform for a series of applications that can then be used to transform a range of websites and online services into desktop apps. The value of being able to access the Internet through the desktop rather than a browser is something that has been recognized in the past -- even Microsoft noticed the potential early on with its Active Desktop component in older versions of Windows. Pokki is somewhat more advanced than this and other similar options that are available, offering you a series of specially designed apps, each of which have been built from the ground up with a particular web service in mind.

The main app installs, interestingly, as a taskbar toolbar. From here you can access the Pokki version of the App Store, where you can download and install all manner of Pokki apps (or Pokkies as they are known). As you would expect, there are the familiar faces such as Facebook, Twitter and Gmail, but there are also apps for games, productivity tools and online media services such as Grooveshark. The breadth and range of app is impressive and the overall quality is high.

The fact that Pokki apps are purpose-written really shows. These feel like much more than website conversions; they are dedicated apps that not only bring you a more accessible desktop version of many popular services but in some cases actually improve the service in question. It is important to remember that this is a program that is currently in beta, but it is already shaping up to be something impressive. Check it out now to find out what all the fuss is about.

You can find out more an download a free copy of the app by paying a visit to the Pokki review page.
Got USB device troubles? Try BusDog

Publié: janvier 17, 2012, 4:31pm CET par Mike Williams

When a favorite USB mouse stopped working last week, I tried all the usual techniques to try and get it running again: so I unplugged and reconnected it, looked for driver updates, checked Device Manager for clues, and so on -- but with no success.

Could the problem be something more fundamental? I downloaded BusDog, an open-source USB traffic sniffer to help me find out.

I launched the program, and it immediately displayed all my USB system and connected devices, including the mouse, so I could see it was being detected correctly.

The next step was to check the device traffic. It’s easy enough: just check the mouse device, click Trace, Start, then move the mouse around, and that immediately revealed the problem. A mouse should be sending USB events all the time, whenever it makes the tiniest of movements, but mine was hardly firing at all -- and that meant it was a hardware problem. Time to forget drivers and other PC tweaks, all I could do was replace the mouse.

This wasn’t the best of news, but at least BusDog had saved me from wasting any more time on the issue. And if you need to similarly check basic USB functionality on any device, then the program should work on XP or later, in both 32 and 64-bit Windows (though the latter will need TESTSIGNING enabled -- see the BusDog site for more).

The program can also sometimes help you to find out more about some USB devices. When we plugged in a couple of flash drives, for instance, the ASCII view of their events sometimes included their manufacturer, model name and other useful information. (You may not be so lucky, but if you’re trying to find out more about a device then it’s worth a try.)

And if you’re a developer or USB expert trying to diagnose low-level device issues then you’ll appreciate BusDog’s filters. By telling the program to display only events containing a particular string of characters, say, you’ll be able to tune out the USB “noise” and focus only on the data you need.

There is one issue here, though, and it’s an important one. If your system has a problem installing a USB filter driver like BusDog then it could prevent any other USB driver from loading, including those for your mouse and keyboard, effectively disabling your PC. This isn’t particularly likely, but it’s possible, so play safe: make sure you have a system restore point and a full system backup available before you launch the program.

Photo Credit: Brian A Jackson/shutterstock
Game Manager 3.0 -- the Windows Media Center of fun

Publié: janvier 17, 2012, 2:18pm CET par Mike Williams

In the world according to Microsoft, the Windows Games Explorer should provide everything you need to organize, update and manage your favorite games. And it’s not too bad: with a little work you can get a display that includes game information, ratings, cover art and more.

If Game Explorer just isn’t powerful enough for your needs, though, you might find the free Game Manager useful. It also provides a database of games that you can organize and view in several ways, but can do this via a Media Center-style full-screen interface, and includes plenty of extra functionality as well.

The program downloads cover and box art, both front and back, for instance -- right-click with the mouse and you can toggle between the two, clicking to zoom in on the details.

If you use DAEMON Tools or Alcohol 120 percent to maintain images of your game discs, then you’ll appreciate Game Manager’s ability to automatically mount them before running a game, and remove them when you’ve finished.

And the program can also display your game collection in various ways, take screen grabs while you play, or maintain your games by downloading and installing official patches.

While all this looks great, we found Games Manager to be less than intuitive. And the initial configuration process proved particularly tricky. The program can try to locate your installed games, for instance, but don’t expect great results (it thought that an empty C:\My Works folder was home to Enemy Territory: Quake Wars, for instance). Our first efforts to manually add games weren’t much more successful, and other areas of the program similarly didn’t work quite as we expected.

Still, checking out Game Manager’s online help generally provided an answer for most things, and once you’ve managed to import your games, and learned how to browse around your database, then the program worked reasonably well. So if you’re looking for a way to keep a large game collection in order, then Game Manager may be useful -- just expect to spend a little time figuring out how everything operates before you get the full benefit of the program’s functionality.