|
We guarantee your privacy: 1. We will never sell, rent, or give away your address to any outside party, ever. 2. We will never send you any unrequested e-mail, besides newsletter updates. 3. All unsubscribe requests are honored immediately, period. Privacy policy 
|
|
TOP STORY — info you need to make Windows work Startup offers free Wi-Fi security By Brian Livingston Wi-Fi devices and software are finally starting to support real encryption to protect you from identity theft (or worse) when you go wireless. But setting up a truly secure system is still way too difficult in most cases. That's why I'm excited that companies are starting to offer easy-to-use Wi-Fi security services for free. The first user-friendly, industrial-strength ID-and-password system — which hasn't even been formally announced yet — is from WiTopia, a company that's young but is run by some very experienced network talent. You may already own secure devices In an article entitled "Wi-Finally" — published in the May 26, 2005, issue of the Windows Secrets Newsletter — I described the three pieces that have finally come together this year to make Wi-Fi safe to use. Let's summarize the components you need: • A Wi-Fi router or access point that supports the new WPA or WPA2 standard (the older, obsolete WEP standard is now considered useless); • A Wi-Fi adapter that supports WPA and/or WPA2; and • Wi-Fi client software that's updated to support either standard; If you have such a set — most of today's "g" products and some older "b" products qualify — you're ready to use Wi-Fi safely. To find out which devices support or can be upgraded to the new specs, visit the Wi-Fi Alliance's Certified Product Listing page, select the WPA or WPA2 check boxes, and run a query. To find an updated Wi-Fi client software driver or "supplicant," visit Microsoft (for Windows XP SP2) or Funk or Meetinghouse (for other Windows versions). If you need more help, see the original article. Let good users in, keep bad people out With the above pieces, you have a choice of two kinds of secure encryption: • WPA uses a method of encryption called TKIP, which almost all "g" products are capable of supporting. • WPA2 uses AES, an encryption standard that requires hardware support that some "g" devices don't have. Using either WPA or WPA2, there are two kinds of user authentication: • WPA-Personal and WPA2-Personal use a pre-shared key (PSK). The PSK is a password, which should be at least 32 characters long and completely random, that you enter into your wireless router/access point and all of your Wi-Fi devices. • WPA-Enterprise and WPA2-Enterprise require the entry of a valid username and password combination before wireless resources can be accessed. This rule is usually enforced by a server running so-called RADIUS software. Almost anyone who can follow printed instructions can enter a PSK into each access point and each desktop or laptop computer that will wirelessly use it. This is called Personal Mode. The drawback to Personal Mode is that all users must be given the same PSK. When an employee is terminated, you must change the PSK in every access point and in every client device. Companies with a number of employees who come and go should require a separate username and password for each one who uses wireless resources. This is called Enterprise Mode. Unfortunately, setting up a RADIUS server can be a daunting task for a small business. The acronym stands for Remote Authentication Dial-In User Service. It no longer has much to do with dial-up modems but is used for all kinds of broadband and wireless connectivity. But it's a technical challenge that few people have experience setting up. If you'd like to configure a RADIUS server yourself, software to do so is built into Microsoft's Internet Authentication Service (IAS) for Windows 2000 Server and Windows Server 2003. On the other hand, if you'd like to take advantage of someone else's work and have the benefits of full username-and-password authentication of Wi-Fi users in just 10 minutes or so, the new free service from WiTopia is probably just what you need. Free Wi-Fi security for up to 5 users WiTopia quietly started offering its SecureMyWiFi service free of charge for home users and small business just a couple of weeks ago. The gratis level of service supports one wireless router or access point and up to five users. |
 Windows Secrets Newsletter Issue 57 — 2005.07.14 TOP STORY • Startup offers free Wi-Fi security • You may already own secure devices • Let good users in, keep bad people out • Free Wi-Fi security for up to 5 users • More fun tricks with Wi-Fi SECURITY BASELINE • MS AntiSpyware now ignores Claria • New spyware "definition" makes matters worse • PC World re-tests, CounterSpy wins again • The Security Baseline as it stands WINDOWS GIZMOS • Hawking debuts two little broadband helpers • Broadband booster hikes VOIP call quality • External antenna doubles as Wi-Fi finder • Watch your videos around the world INDEX OF REVIEWS • Magazines rate the top GPS alternatives • Handheld mag tests seven PDA GPS add-ins • TomTom's GPS line wins 2nd award • Wired Magazine gives Magellan highest GPS rating • Sound & Vision picks iTrip FM device • American Photo likes Dell picture printer • Ultimate Mobility: HP best printer on the go • Perfect Vision names seven Best Buys HOT TIPS • Fix Windows or just make it zippier • New ways to repair your Internet connection • Deleting spooler files speeds up Windows • NetZero 7 can conflict with MS patches BRIEFING SESSION • Why Fi? A tutorial on wireless tech • The ghost of wireless past • G, your wireless downloads fast • The dark horse: 802.11a • Living N the future • My buying advice in today's market OVER THE HORIZON • MS Java Virtual Machine opens IE hole • No patches yet, but workarounds available • Most of Microsoft's suggestions are poor • I say, get rid of MS Java completely WINDOWS PATCH WATCH • Half our patches out of the way • Office patches are now MU-able • Not another confusing image patch? • What does Microsoft Update do, anyway? • Log files you might need to look at • WSUS and SBS 2003 sp1 installing issues • Claria deal no-go and other good news • Firefox 1.0.5 released this week • What are your biggest security risks? • Say "Goodnight, Gracie" to Windows 2000 SP3 UPDATE MANAGEMENT • Beware of automated patch-management syndrome • There's wisdom in the Knowledge Base • Creating a set of key information • Don't let automation make you complacent WACKY WEB WEEK • Planarity game is fun in a Flash USEFUL LINKS • RSS readers: narrowing your choices • Picking the best online RSS reader • Longhorn RSS will integrate support NEWSLETTER CONTROL PANEL • Windows Secrets home page • How to subscribe • Change your delivery address • Change your preferences • Access past free issues • Access past paid issues • Upgrade to paid version • Search for info (WinFind) • Submit a Windows tip • Get subscription help • How to unsubscribe CIRCULATION: over 147,000 |
If you have more devices than that, each additional access point costs a mere
$10 a year. Each additional block of five users is a bargain at $5 a year ($1/yr.
per user).
If you have WPA- or WPA2-capable devices, WiTopia has made
it surprisingly easy to get
Enterprise Mode working. You create an account online, then enter each of your
username-password combinations (see image at right). To connect to your Wi-Fi signal, a user must authenticate
through Witopia's RADIUS server, which the company maintains 24/7 at its Reston,
Virginia, location. You can
add and subtract users and change passwords at any time.No one without a proper username and password is able to authenticate. In addition, WiTopia supports remote MAC address filtering, granting access only to authorized users on specific laptops or desktops. Intruders, therefore, are blocked from gaining access to your Wi-Fi network. Full Mesh Networks, a "sister company" to WiTopia, was founded in 2003 by Bill Bullock and Steve Shippa. The two entrepreneurs formerly spent more than seven years in management at UUNET, which at that time handled as many as 25 million sessions a day, making it arguably the largest RADIUS infrastructure in the world. The WiTopia executives are making a calculated gamble that offering a free RADIUS service to individuals and small businesses will eventually produce paying customers. The no-cost service is billed as being for a limited time, and Bullock said in an interview that the offer would probably last only through the end of this year. Everyone who signs up, however, will be guaranteed free service for at least a full 12 months, he said. For those with obsolete, non-WPA equipment, or who want the simplest possible experience, WiTopia will sell you an updated Wi-Fi router, configure it in-house, and ship it to you. For example, the site currently sells the Linksys WRT54G router for $64 and the D-Link AirPlus G Wireless Pocket Router for $70. There's a one-time $59 charge for custom configuration. More fun tricks with Wi-Fi WiTopia also maintains a PersonalVPN service. It's beyond the scope of this article to explain how a virtual private network works, but think of SecureMyWiFi as protecting wireless access in your own building and PersonalVPN as protecting you when you're using someone else's wireless router to access your usual network remotely. The company's PersonalVPN formerly cost $79 per year, but during WiTopia's current "Secure the World" promotion, it's as low as $39.50. Windows Secrets reader Stephen Charme recently tested PersonalVPN and HotSpotVPN1, a competing service that costs $89 per year. He and the company both confirmed that they have no business relationship other than as a customer and a provider. Here's his report:
For more information on WiTopia's offerings, and its current fire sale of sharply lowered prices, visit WiTopia.net. I believe we haven't yet seen the last startup seeking to build a customer base of Wi-Fi users by cutting its fees to the bone or positioning its services as completely free. Reader Charme will receive a gift certificate for a book, CD, or DVD of his choice for submitting a comment that we printed. To send us more information about the ways you're using Wi-Fi, or to send us a tip on any other subject, visit WindowsSecrets.com/contact. Thanks in advance. Brian Livingston is editor of the Windows Secrets Newsletter and the coauthor of Windows 2000 Secrets, Windows Me Secrets, and eight other books. ^ |
|
THE SECURITY BASELINE — the minimum you need for safe computing MS AntiSpyware now ignores Claria By Brian Livingston Microsoft's AntiSpyware utility, which is currently nearing the end of beta testing, has stopped recommending that Windows users remove such adware programs as Claria, 180Solutions, WhenU, New.net, eZula TopText, and Webhancer, according to Spyware Warrior and numerous other sources. MS AntiSpyware started defaulting to a recommendation of "ignore" for Claria, as opposed to "remove" or "quarantine," as far back as Mar. 31. But antispyware experts only recently recognized and publicized the change, according to a July 1 blog posting by Alex Eckelberry, the president of Sunbelt Software. Sunbelt makes the competing (and top-rated) CounterSpy utility. Criticisms of Microsoft's decision have been swift and withering this week. eWeek.com contributors David Coursey and Larry Seltzer wrote columns entitled "Maybe They Should Call It MS Pro-Spyware" on July 11 and "Why Microsoft Antispyware Is Untrustworthy" on July 12, respectively. In a statement, Microsoft said, "Windows AntiSpyware (Beta) continues to notify our users when Claria software is found on a computer, and it offers our users the option to remove the software if they desire." This response obscures the fact that MS AntiSpyware previously recommended the removal of Claria (formerly known as Gator) and several other adware programs, but no longer does so. Most PC users will simply click "OK" when an antispyware program presents a list of detected software. They won't examine or change numerous default settings. The end result is that Claria and other adware will continue to threaten the security of millions of users' PCs. (Note: A rumored acquisition of Claria by Microsoft has fallen through, according to a ClickZ article by Zachary Rodgers.) Let's be clear on one point: Why is adware and spyware bad? First of all, no computer users in their right minds would agree to have more pop-up ads show up on their PC screens. All such programs slow down a computer and are prone to incompatibilities. Adware and spyware software, therefore, must use some form of deception to become widely installed. Sites that install such programs typically promise great benefits while downplaying any negative side-effects (if they even mention everything that's being loaded onto your PC). Second, adware and spyware are motivated by profit. Most such programs enable the original promoter to install additional programs across the Internet at a later date without further notice. Access to an installed base of PCs is now quite valuable, so spyware makers sell remote installs to additional parties. As soon as one piece of spyware is installed on a PC, you may never know what other programs you'll soon be running. Third, if a computer user truly wanted to receive ads from particular companies, he or she would sign up for their e-mail newsletters, subscribe to their RSS feeds, or install their standalone applications. Since no sane person really seeks out hard-to-manage adware, it's usually installed quietly by a primary "carrier" program that the PC user actually wanted, such as a cute screen saver. Claria goes even further than this, according to an analysis by Ben Edelman, a respected antispyware researcher. Claria uses cartoony sites designed to get children to click its download links; it displays fake dialog boxes that look like genuine Windows alerts; and it sets up new domains with nonsense names to evade blocking by antispyware utilities, Edelman says. By these means and others, Claria software has become installed and active on an astonishing 40 million PCs (a figure claimed by the company in a press release last year). New spyware 'definition' makes matters worse Microsoft and a number of other, usually responsible corporations — including AOL, Computer Associates, Lavasoft, McAfee, and Symantec — struck a blow for stupidity on July 12 by announcing a "uniform definition of spyware" (PDF file) released by a new organization called the Anti-Spyware Coalition. Why is this a bad thing? Because the loudest voices crying for a definition of spyware have been the spyware and adware makers themselves. Many of them have threatened antispyware developers with lawsuits over being called "spyware." But these threats have mostly failed to get anywhere, legally, since the term is open to interpretation. The Anti-Spyware Coalition "hopes the definitions will clear the way for anti-spyware legislation" in Congress and elsewhere, according to a Wired News article. This would create a law defining spyware as technologies that, among other things, "impair users' control over... distribution of their personal or otherwise sensitive information." Spyware promoters, of course, could easily keep their programs just shy of any such line. Spyware and adware apps don't need to distribute any personally identifiable information — they work in the aggregate, across millions of PCs. Spyware authors could barely contain their glee. "Any kind of refinement, any added clarity is going to be helpful," said Sean Sundwall, a spokesman for 180Solutions, in an AP article about the new definition. Hel-lo, we want these adware guys to be uncomfortable! They should never know who or what will uninstall them next. (You can make this same point directly to the coalition, if you like, via its contact form until Aug. 12.) Why is Microsoft stopping its AntiSpyware utility from removing so many adware programs? And why is it supporting a definitional dead end in the battle against spyware? Microsoft's new policy seems to be this: any program can get an "ignore" recommendation from AntiSpyware, as long as that program is installed after a computer user has clicked some kind of "OK" button. These install-me buttons are usually linked to lengthy End User License Agreements (EULAs). The Redmond company has a strong interest in maximizing the enforceability of EULAs. Legal executives of the corporation have won several court precedents that say a person who merely clicks "OK" is legally bound to whatever is in a EULA. Microsoft has even changed the contractual terms for Windows by inserting EULA amendments into security updates. (See "Sneaky Service Packs" in my Aug. 23, 2002, InfoWorld column.) The company can't very well take a position that the EULAs of other companies, such as Claria, don't represent a user's consent. It's ridiculous, of course, to claim that anything companies do to users after they click "OK" is, well, OK. For instance, clicking the "Yes" button when prompted by one widely-circulated Windows Media Player 9 file installs a mind-boggling 31 different adware programs, according to a Ben Edelman article. Some of the installed adware was from 180Solutions and eZula — the very companies that MS AntiSpyware no longer recommends be removed. Companies that are noticeably absent from the misnamed Anti-Spyware Coalition include PC Pitstop, a well-regarded online scanning service, and Sunbelt Software. In a post last month, Sunbelt's Eckelberry noted, as an example, "Look who has delisted Hotbar." According to the adware maker itself, the answer is coalition members Microsoft, Lavasoft, McAfee, and others. Perhaps that's why Sunbelt's CounterSpy product continues to receive top ratings from every major computer magazine that's tested the leading antispyware products. (More on this in the next item.) PC World re-tests, CounterSpy wins again PC World gave CounterSpy 1.0 its highest rating in a head-to-head comparison of seven antispyware utilities in the magazine's April 2005 issue. In a later test directly comparing CounterSpy and MS Antispyware using signature files with identical dates, CounterSpy also came out ahead in June 2005. In tests by other publications, CounterSpy (and its centrally-managed Enterprise Edition) has also swept first place in Laptop Magazine, Windows IT Pro, and eWeek. For its August 2005 issue, PC World reviewer Mary Landesman pitted a pre-release version of CounterSpy 1.5 against the latest versions of Webroot Spy Sweeper and FBM Software's ZeroSpyware 2005. (The magazine didn't even bother re-testing MS AntiSpyware.) CounterSpy came out on top yet again. "Its new engine and improved technology offered up the best removal rates," Landesman writes. Unfortunately, if adware promoters are legally successful in painting antispyware firms into a definitional corner, we may have to redefine this whole category of security programs. Perhaps they could be called "universal uninstallers." They'd identify anything that's on your PC and allow you to remove it, referring to large databases of recommended and unrecommended programs. If there's a weed in your garden, you have the right to pluck it. Seriously, I hope antispyware companies are never forced into such a rebranding. The Security Baseline as it stands I haven't seen any comprehensive reviews that knock out of the winner's circle anything from last issue's Security Baseline. Of course, if respected reviewers start giving their top awards to different products, the categories shown below will be updated to reflect that fact. Based on the latest published tests, therefore, the best four products for comprehensive protection against hackers are (1) a Linksys hardware firewall, (2) the ZoneAlarm Security Suite, (3) CounterSpy antispyware, and (4) an update-management tool of your choice. See details below.
|
|
FORWARDING INSTRUCTIONS — news gains value when it's shared Please share this information with your friends You're encouraged to refer your friends and colleagues to this free newsletter. Because most e-mail programs don't correctly display a formatted message that's been forwarded, simply call people's attention to the permanent Web address of this issue: WindowsSecrets.com/comp/050714. ^ |
|
WINDOWS GIZMOS — our product reviews of new stuff Hawking debuts two little broadband helpers
|
|
INDEX OF REVIEWS — our directory of product shootouts Magazines rate the top GPS alternatives
|
|
HERE'S A TIP — you'll get a better newsletter if you choose the paid version You're reading the free version of the Windows Secrets Newsletter Subscribers to the paid version receive additional information in each issue. Some of the extras this week are:
Paid subscribers gain access to all past paid newsletter content Make a contribution to support our research into Windows and you'll immediately be able to read and search through scores of valuable articles. In addition, paid subscribers are entitled to download valuable content that we license for you at least once every calendar quarter. To upgrade, simply make a contribution of any amount you choose If you do this by July 27, 2005, you'll instantly be sent the full, paid version of today's newsletter. To upgrade to the paid version of Windows Secrets, please visit WindowsSecrets.com/upgrade. Thanks in advance. ^ |
|
WACKY WEB WEEK — playing for you the Internet's greatest bits
USEFUL LINKS — more stuff that's good to know RSS readers: narrowing your choices (Part 2 of 3) RSS adoption is growing rapidly and a multitude of RSS readers are vying for your attention. (By Brian Livingston, Datamation) More info Picking the best online RSS reader (Part 3 of 3) Online RSS aggregators allow you to read your feeds almost anywhere in the world. Determining the best RSS reader depends on your content needs. (By Brian Livingston, Datamation) More info How Longhorn will integrate RSS support Learn how Microsoft intends to implement RSS in both Internet Explorer 7 and Longhorn (and all participating Longhorn apps) in this detailed technology showcase. (By Paul Thurrott, SuperSite for Windows) More info ^ ABOUT YOUR SUBSCRIPTION — we're here to serve you The Windows Secrets Newsletter (formerly Woody's Windows Watch and Brian's Buzz on Windows) is published twice a month, except for breaks in August and December. The newsletter is published on the Thursday after Microsoft Patch Tuesday (the 2nd Tuesday of each month) and two Thursdays after that. A short "newsletter update" is sometimes published between regular newsletters, if breaking news occurs. Publisher: WindowsSecrets.com LLC, 300 Queen Anne Ave. N. #456, Seattle, WA 98109 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine). Editor: Brian Livingston is the coauthor of Windows 2000 Secrets, Windows Me Secrets, and eight other books. Associate Editor: Paul Thurrott is the author of Windows XP Home Networking and Great Digital Media with Windows XP and the author or coauthor of several other books. Contributing Editors: Susan Bradley, Mark Burnett, Chris Mosby. Research Director: Vickie Stevens. Program Director: Brent Scheffler. Trademarks: Windows is a registered trademark of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, WinFind, Windows Gizmos, Index of Reviews, Briefing Session, Windows Patch Watch, Update Management, and Wacky Web Week are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners. How to subscribe: Anyone may subscribe to this newsletter by visiting WindowsSecrets.com/info. Our Ironclad Privacy Guarantee: (1) We will never sell, rent, or give away your address to any outside party, ever; (2) We will never send you any unrequested e-mail, besides newsletter updates; and (3) All unsubscribe requests are always honored immediately, period. Privacy policy HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter, Copyright © 2005 by WindowsSecrets.com LLC. All rights reserved. ^ |
