Brendan’s Blog

I just read a great blog post here that speaks to a transition I recently made myself.

I have been an Exchange/Outlook user since 1996, before Outlook was even a product.  During those years I developed systems of email folder heirarchies that I used to “file” my email.  These heirarchies changed year-to-year as I changed projects or jobs.  This filing helped me find relevant email on any number of topics when required.

I also have a no-delete policy for email.  I don’t delete anything.  My theory is that storage will continue to get cheaper, and search functionality will continue to improve.  Once my mailbox size became large, I started creating an annual “PST” archive file so that my primary mailbox would stay manageable.  Over the past twelve years I’ve amassed many gigabytes of email.

Last year I began using Google Mail’s web interface as my primary personal email client.  Around the same time I saw an “Inbox Zero” presentation by Merlin Mann which was very thought provoking.  After a short time my habits changed dramatically from being an email filer, to an email finder.  I highly recommend it to anyone who spends time moving emails from your inbox to other folders in an attempt to organize your email.

When using Google Mail, I immediately archive any message that doesn’t require me to perform a follow-up action.  Those that require follow up stay in my inbox until I’ve completed the task.

When using Outlook I flag messages requiring follow-up.  Messages from high-volume email distribution lists are automatically moved to Inbox subfolders via the Rules feature.  Others emails simply stay in my Inbox or their distribution list folder until Outlook AutoArchive moves them to a PST file.

The advantage to “finding” is that you don’t spend time filing on a daily basis.  I don’t even label much as I can almost always think of keywords, senders, or recipients that narrow my search sufficiently.  The only filing and labeling I do is automated with filters.  Email from active distribution lists gets automatically tagged and/or filed appropriately.

Are you a finder or a filer?

Once upon a time I frequently reused passwords. So if you knew my dogs name, or what kind of car I drove, you could easily have pretended to be me with just a little extra work. This is obviously a very bad idea, but I’m sure many people struggle with managing passwords for web sites and computer systems you access on a regular basis.

Passwords are keys to your identity.  If a malicious person were to figure out your email password, what harm could they cause?  Could they quickly gather the names and contact information for your friends and family?  Could they figure out where you bank?  Could they reset your bank password by telling your bank that your password was forgotten?

A researcher who examined 10,000 Hotmail, MSN and Live.com passwords that were recently exposed online has published an analysis of the list and found that “123456″ was the most commonly used password, appearing 64 times.
- Wired Magazine

Here are my tips for choosing the best passwords:

• Use different passwords for every site/application.  Do not reuse them.
• Change passwords frequently.  The more you use a password, the more you should change it.
• Keep your passwords secret.  Guard them as if they were keys to your identity — they usually are.
• Consider using a random password generator.
• Consider using passphrases (e.g. Myhouseismadeofwoodandhasyellowsiding!)
• Consider using acronyms (e.g. Mhimowahys!)
• Do not use words, birthdays, family and pet names, addresses, or any other personal information in your passwords.
• Do not use repeat characters such as 111 or sequences like abc, qwerty, or 123 in any part of your password.

I strongly recommend using a password managment tool for three important reasons.

1. Tools remember many passwords so you don’t have to.
2. Tools can type passwords for you.  This makes strong passwords easy to use.
3. Tools can create strong passwords which are complex, unique, and random.

A while back I wrote a post about PasswordSafe, which I used to manage my usernames and passwords.  I later switched to a different tool named KeePass.  KeePass is also free and open source, but I think it is also easier to use.  I now also use LastPass which is a different on-line based password manager.

KeePass is a free open source password manager, which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file. So you only have to remember one single master password or select the key file to unlock the whole database. The databases are encrypted using the best and most secure encryption algorithms currently known (AES and Twofish). For more information, see the features page.

The ability to auto-type usernames and passwords is infinately flexible with KeePass.  Auto-type is a very important feature, although I can understand why you may not initially think so.  Think about the strongest types of passwords.  They are long, complex, unique, and full of many different character types.  Do you want to type those in manually each time?  Once I switched to KeePass, my normal password length increased to 20 or more randomized characters wherever possible.  Since I don’t have to remember or type them, I prefer the really long/complex ones.

To manage my password database across several computers, I use FolderShare to synchronize it between systems.  This keeps my database of (as of writing 317) passwords the same across all my systems.  Occasionally I also copy the password database file to a USB flash drive so I can access accounts when I’m not using one of my own computers.

KeePass has many other great features.  The listing of features below links to their website.

Some websites with more complicated authentication schemes will require customization of the auto-type string.  The software “help” references provides details on how to do this.

LinkedIn is a powerful tool for enhancing and maintaining your professional people network. An article about the service was recently published in USA Today.

I was first introduced to LinkedIn several years ago when I received an “invite” from someone I worked with on a project. My initial reaction was to ignore the invitation. I am suspicious of unexpected e-mail, and giving out any personal information unless I have a good understanding of how it will be used. LinkedIn’s web site identifies the following three primary benefits of the service:

1. Find past and present colleagues and classmates quickly. LinkedIn makes staying in touch simple.
2. Discover inside connections when you’re looking for a job or new business opportunity.
3. Your network is full of industry experts willing to share advice. Have a question? Just ask.

After some cursory steps to verify what LinkedIn was, I created an account and simply ignored it for over almost two years. During that time I never received any spam or unexpected communications as a result of having a LinkedIn account. Some time later, in 2006, I was reintroduced to LinkedIn during a meeting with colleagues. I saw how my coworker had developed an extensive LinkedIn network of peers and colleagues, and I decided I should do the same.

Since that time I have used LinkedIn frequently. As a rule-of-thumb, I only send invites to people who are already a member of LinkedIn. I do seek out trusted colleagues, and new professional acquaintances who are already LinkedIn members to establish connections. There are over 14 million members, and it is growing every day.I avoid establishing connections to people I have not met or worked with.

I set my public profile to read similar to a resume. It identifies all of my employers and a quick summary of my jobs. Since I have done lots of project work, I also list some specific customers — but not details of those engagements. This sometimes results in unwanted contacts from recruiters, but I have found those to be rare. This detailed public profile serves two important purposes for me.

1. People who have heard of me, but do not know me, can quickly discover a little about my experiences and expertise.
2. Those who have business opportunities that fit my background can find me.

In practice I have found LinkedIn to be helpful in learning more about my colleagues and keeping track of those who move around. It is also worth noting that my current job the result of a contact made through LinkedIn. LinkedIn has worked for me, and it can work for you with a little effort. There are over 14 million members, you must know some of them!

Frequently asked questions about LinkedIn are answered here.

The small physical size and low cost of USB based flash disk drives, or USB Drives, often exposes confidential information due to theft and loss. The growing memory capacity on these drives increases the problem as more data is stored for longer periods of time.

I use my USB Drives frequently, as do many mobile professionals. I categorize my usage into two basic functions:

• Storage – Storing my files for later reference, often with a PC which is not my own.
• Transfer – As a mechanism to copy files from one PC to another.

When evaluating encryption methods I considered how a given encryption product would impact the use of a USB Drive for both functions. For example, since I frequently use my USB Drive with PCs I do not own, I cannot use a product which requires a typical software installation on a PC to use.

I also sometimes lend my USB Drive to others temporarily – typically when transferring files from one PC to another. The encryption product needs to allow a third party to still use my USB Drive without knowing how to use the encryption software.

Another consideration was cost. A low to no-cost solution is usually preferable, not only because it does not require an initial investment, but it also facilitates easy testing and rapid adoption.

I settled on a product called TrueCrypt which, for now, seems like the best tool suited for my use. Its license provides for free use for both non-commercial and commercial purposes. Version 4.2a for Windows is around 1,388KB in total size which includes documentation.

Main Features:

• Creates a virtual encrypted disk within a file and mounts it as a real disk.
• Encrypts an entire hard disk partition or a storage device such as USB flash drive.
• Encryption is automatic, real-time (on-the-fly) and transparent.
• Provides two levels of plausible deniability, in case an adversary forces you to reveal the password:
  • Hidden volume (steganography – more information may be found here).
  • No TrueCrypt volume can be identified (volumes cannot be distinguished from random data)
• Encryption algorithms: AES-256, Serpent, and Twofish. Mode of operation: LRW.
• Further information regarding features of the software may be found in the documentation.

I create an encrypted disk volume within my USB Drive, rather than encrypting the entire device. The encrypted volume is used to store all protected data. When the encryption software is not used, the encrypted volume simply appears as a large file which cannot be accessed. Naturally this file can be deleted, however, the data within the file is protected from unauthorized access.

I leave unencrypted free space on the USB Drive for use when transferring files from one PC to another. This allows the USB Drive to be used for file transfers without using the encryption software at all.

TrueCrypt can certainly be used in many other ways and for many other purposes. I simply find the USB Drive to be an easy use-case.

One of the things that both my wife and I do on the Internet is shop. I tend to buy consumer electronics, she tends to buy clothes for our daughters. We both have found techniques that work for us. I can only speak for me, so if you’re looking for how/where to buy clothes, this article isn’t going to help you much.

1. Look for product reviews. Before a purchase, I use Google to find product reviews of the items I am interested in. A simple search such as “review netgear wpn824” will locate several useful sites.
2. Check the manufacturer’s web site. Frequently it will contain feature overviews, suggested retail pricing, information about a newer models/versions, and perhaps even an electronic copy of the user guide.
3. Compare prices. Once I have selected a specific product to buy, I use two web sites to look for price comparisons. The first is http://shopper.cnet.com/ which specializes in consumer electronics and frequenty includes product ratings and review. The second is http://www.pricegrabber.com which has a wider variety of items, but doesn’t contain product reviews. Both sites allow you to compare total price after shipping by entering your zip code.
4. Purchase with a Credit Card. I make nearly all of my on-line purchases with an American Express charge card. The credit card adds several types of protections such as a purchase protection, return protection, extended warranty, fraud protection, and dispute resolution. While debit cards or PayPal may provide some of these features, I prefer the convenience and features of my American Express card. Your preferences may vary of course, as credit cards are not for everyone.
5. Use Low-Cost Shipping. If you really need a product quickly, you are often best-off buying it at a store. The premium cost of overnight or two-day shipping is rarely worth the cost to me. So what if the new CD/Book/Mouse gets here in 5 days instead of 2. I’ve obviously lived just fine without it so far…. what’s an extra three days?
6. Consider Used. People tend to either love or hate eBay. I have purchased many used items so far, and only gotten ripped off once (on an original XBox.) Usually new products are more expensive (after shipping) on eBay than they are at other places, but used products can be much cheaper. If you are buying CDs, movies, or books consider using Half.com. I have had nothing but great experiences here.
7. Check for rebates and coupons. I have found that the Hot Deals forum at FatWallet.com has great information on some items. I frequently perform a search here for my item before I buy it elsewhere.