LastPass and YubiKey - Lessons Learned

Continuing on with my year of digital security ideas, I wanted to share a few short thoughts on some lessons I learned using LastPass and YubiKey.

LastPass

• Before I committed to switching to LastPass, I tried it out. LastPass uses a Master Password and I generated it in my KeePass.  However, I didn't save my KeePass vault for some reason.  Never forget your LastPass Master Password or you will be sorry.
• Always generate a few one-time passwords (OTP) to get into your LastPass vault just in case.

YubiKey

• After you receive your YubiKey, be sure to sign up for the Yubico Revoke Service and add your key.  This allows you to revoke your YubiKey in the YubiCloud authentication service in case your key is lost or stolen.  You have to physically have your key to add it to the revoke service -- you cannot add a key if you do not have it (like after you lost it).
• Be sure to add your YubiKey to your LastPass profile and enable two-factor authentication.

2013 - The Year of Digital Security

Last year, 2012, was the year of backups.  Between the cloud and automatic backups and safe places to keep drives -- I believe backing up my digital life as well as getting it more organized in the first place was a complete success.

This year I'm focusing on something entirely different: Security.  Actually, I did a lot of small security stuff at the end of 2012 so I'd say I started 2013 with a "very good" rating.  Instead of a tutorial on how to implement security in your digital life, I'm just going to share some of things I've already done and where I'm going from here.

I was already doing a lot of good things that I started in 2012:

• I was user of a password manager / password vault.  I've been using KeePassX (available on many platforms like Linux, MacOS, Android, Windows, etc.) on both my laptop, desktop and Android phone. I kept my single password vault file in sync between devices using DropBox.


• Stopped sharing similar or the same passwords between sites. I was pretty good about this, but sometimes I would order something from a company that I knew I would rarely use.  I became lazy and didn't always setup a new profile in KeePassX. For example, I was one of the 24 million accounts that were hacked at Zappos in January of 2012.  Also, my credit card information was stolen (see sample letter in PDF) from Altrec -- an outdoor outfitter where I made a purchase almost two years ago.


• After reading Matt Honan's tail of how he got his entire digital life wiped out by hackers in Wired last August, I turned on Google Authenticator (two-factor authentication) on all my GMail accounts (even DropBox can utilize Google Authenticator).

So, you're probably thinking what more can you do? Well, there a few more items that I've already working on or done in 2013:

• I decided to switch from KeePassX to LastPass for my password management. I switched for three reasons:
  
  
  
  • #1 - LastPass has tighter integration with the browser and the cloud. LastPass has a pretty good web browser plugin for Chrome and Firefox.  KeePassX I would have to find the profile and use the clipboard to copy my password.  LastPass just reminders my profiles.
  
  
  • #2 - My LastPass password vault is encrypted locally and stored in the LassPass cloud.  This takes the pain of synchronization with KeePassX and Dropbox out the equation.
  
  
  • #3 - Two-factor authentication support. For those that don't know what this is, this means you need both the password and some physical item (that usually emits unique codes) in order to login.  If you don't have both items, you cannot login.
  
  
  
  


• Two-factor authentication using YubiKey.  These are amazing little USB devices that emits an one-time password (OTP).  For example, to login into my LastPass vault I use my master password and then I have to authenticate using the OTP emitted from my YubiKey.  They even offer a YubiKey that has NFC built-in so you can use it with NFC enabled devices like my Google Nexus 7 tablet.


• I now encrypt my home directory data on my HD (via Ubuntu) on both my laptop and desktop.  So even if you steal my computer -- you cannot get my HD contents unless you know my password. (Note: Yubico offers a PAM for Linux so I could even require my YubiKey login).

I hope this inspires you to do more for your security of your digital life.  I'm planning on writing up a nice quick start soon for getting started with LastPass and some of the things I did or things you shouldn't do like I did.  Let me know if you have any questions.  Until then, may the security deities be with you!

Illegal use of nonvirtual function call in Java / MySQL JConnector

My computer crashed today and after restart none of my Java based application via Tomcat that used MySQL would work.  I would get an error like this:

Could not verify datasource: java.lang.VerifyError: (class: com/mysql/jdbc/DatabaseMetaData, method: supportsRefCursors signature: ()Z) Illegal use of nonvirtual function call

No matter the amount of Googling did anything turn up useful.  After reinstalling MySQL, I realized that my Aqua DataStudio could still connect and query the MySQL databases.  I tried a new MySQL J/Connector which did not help.

In the end, the fix was that Tomcat was using Java8 weekly (via a .deb) and something in Java8 must be broken.  I downgraded Tomcat to use Java7 and everything worked.  I found out that there was an update to my system to Java8 on 2/13 and the restart made it effective because Tomcat had been running for at least a week.

The fix: Check your Java version and downgrade from Java8

Donate Idle CPU Time to Rosetta@Home

If you have a idle compute or idle CPU time, consider donating that CPU time to a good cause via distributed computing.  I donate my CPU time to Rosetta@Home.

Rosetta really needs your help.  They recently started the Institute for Protein Design that aims to design new proteins to fight diseases. Due to overwhelming needs, it's taking 10 days for single protein fold to be computed (about 3,000-5,000 work units) and there is a huge backlog.

My ultra fast 8-core Intel i7 at 3.4Ghz can only chomp through about 18 work units a day on average.  Your help is needed so join Rosetta@Home today.

More info on Rosetta and the good they are trying to do here:

Rosetta@home needs your help to determine the 3-dimensional shapes of proteins in research that may ultimately lead to finding cures for some major human diseases.

By running the Rosetta program (BOINC) on your computer while you don't need it you will help us speed up and extend our research in ways we couldn't possibly attempt without your help. You will also be helping our efforts at designing new proteins to fight diseases such as HIV, Malaria, Cancer, and Alzheimer's.

Please join us in our efforts! Rosetta@home is not for profit and a program of the University of Washington.

Grails48 Hackathon - Minneapolis Team Meet'N'Greet - Sun, 11/4 from Noon to 2p

The Minneapolis Team is having a pre-hackathon Meet'N'Greet to talk about the hackathon and organize for the event. I'm relatively new to the Grails community here in Minneapolis (coming from other languages) and Kurt, Jacob and myself thought it would be great for a meet and greet to talk about EnlistApp.  We'll discuss what the app will should do, plan out tasks, talk about GitHub and more.

Date: Sunday, 11/4/2012
Time: Noon to 2p CT
Where: Bob's Java Hut - 2651 South Lyndale Avenue, Minneapolis, MN

Hope to see you there!

Grails48 Hackathon - Nov. 9-12 - Join the Minneapolis Team

I want to invite you to join the Minneapolis Team for the Grails48 Hackathon that is occurring November 9-12.  It's easy to join at hackathon.io:

http://grails48.hackathon.io/teams/view/615

You don't have to be there the whole time -- even part of a day would be helpful.

Our project is EnlistApp. Enlist is an open source and free application that aims to help non-profits organize volunteers, track volunteer hours and management volunteer rewards.  This application will directly benefit Team Ortho -- they put on running races in the Twin Cities. They support research, education, and advancements in orthopaedic technology; and to promote good muscular, skeletal, and joint health by encouraging an active lifestyle including training for and participating in amateur athletic events.

We already have a start on it here -- uses Grails, Twitter Bootstrap, JQuery, etc in case you want to check it out:

https://github.com/maestrofjp/Enlist-Grails

I'm working on a location.  Doug Sabers has offered ReachLocal's offices (below where we have the GUM meetings) and I'm waiting to hear back from him to confirm.

In the meantime, come join the team for the hackathon.

The Road to Getting Your Digital Life Together

Maybe this will be a bit morbid, but I've heard of nightmares when it comes to somebody dying and not having access to their digital life afterwards. Here is my list of things to do to get your digital life in order.  Not only will it help those that you leave behind; it will make your life easier while you are alive!

So don't think you'll get a jump on those dice of life. Snake eyes will come someday -- whether it's death, theft, flooding or fire.

1. Use a Password Manager

   Don't use the same password everywhere.  That will lead to your digital life being hacked.  Use a unique, strong password for each service and website you use.  I like to usethe open source KeePassX which is available for Windows, Mac, Linux, Android and iPhone. You only have to remember one password to unlock your database (make sure it's a good -- it's your master key). I keep my password database synced between my phone and my main computer using a file sharing service (Box, Dropbox, Google Drive, etc). You can even periodically print out your passwords and put that in a safe place (like a fire safe).



2. Get Your Backup in Order

   Now that you've made your life more secure, be sure to backup all those important documents, photos, and music.  Backup never seems important until you actually need it.  So don't mourn the loss of your prize MP3 collection or your kid's baby pics.  Easiest option is to buy a large external hard drive and use backup software.  Space is cheap so consider 1TB of space or more. Consider getting a disaster proof backup drive. ioSafe makes drives that are fireproof and waterproof.

   Don't rely on remembering to backup.  Set your software to backup on a schedule and prompt you if your backup drive isn't connected to your system.  I'm paranoid and I backup daily. Also any good backup software should be encrypting your backups in case your drive should get stolen or go missing.

   Alternative, you can use a cloud based service however you need a good internet connection and I can only assume it's only so secure.  I mean I know it's not public access, but somebody would have to steal your external drive.

   I use DejaDup on Linux which allows you to backup to local drive or cloud services like Amazon S3, Rackspace and Ubuntu One.  I love it -- just set it and forget it (thanks to Ron Popeil for that line).

   Alternatively for music / photos, there options from Amazon (CloudDrive / CloudPlayer), Google (GoogleDrive/GooglePlay) and Apple.



3. Digitize Your Music and Photos

   Unless you're in the Millenial generation, then you probably have CDs and printed photos.  Theft, flood and fire are all possible. I've spend many an hour ripping CDs to OGG format and uploading to GooglePlay.  Nice side effect is that I can stream my entire collection from my phone / computer and they are backed up!

   I like to use RipperX for Linux which has CDParanoid built-in.  CDParanoid is great for ensuring great rips since CDs that are scratched etc.

   If you don't want to scan your prints in yourself or do not have equipment, you can take prints or negatives to places like Costco and they have services that will do that for you.



4. Get a Will and/or Living Trust

   Ok, I know this isn't part of your digital life, but your Last Will and/or Trust dictates what happens to your stuff -- including your digital life such as music, photos, Facebook, Twitter, Google+, etc. No Will means those that you leave behind will have a hard time cleaning up your digital mess especially if you are more technology savy than your next of kin.  Make sure your Will or Trust states what your executor or trustee should do with your digital life.

   One option is Nolo WillMaker which will create Wills, Power of Attorney, Healthcare Directives and Living Trusts.  Not bad for $42 or even less if you look for Nolo promo codes on Google.  WillMaker works like TurboTax -- you are interviewed and the software walks you through the process.  It even comes with 100+ page eBook to help you decide what options are best for you.