2FA on WordPress

Perhaps there was a day when you left your front door unlocked because you could trust your neighbors… if so, that day has long since passed on the internet.

Passwords can be good, but even individuals who use strong passwords, and don’t reuse them generally don’t change them often enough…

And let’s get some terms straight here — a strong password is on the order of 20 plus characters (and the complexity really doesn’t matter much, because the only way to crack that type of password is a brute force attack — or social engineering).

Multi-factor authentication (MFA) is an authentication method in which a computer user is granted access only after successfully presenting two or more pieces of evidence (or factors) to an authentication mechanism: knowledge (something the user and only the user knows), possession (something the user and only the user has), and inherence (something the user and only the user is).


Two-factor authentication (also known as 2FA) is a type, or subset, of multi-factor authentication. It is a method of confirming users’ claimed identities by using a combination of two different factors: 1) something they know, 2) something they have, or 3) something they are.

Wikipedia – Multi-factor authentication

Something you know (a user id and a password).

Something you have (a security token, mobile device, bio-metric, etc)

Clearly the more “factors” you add to your authentication scheme the more secure it becomes (and the bigger hassle it is as well).

For WordPress my feeling is a good password combined with some type of token based authentication should be adequate for most any site.

The question is — what’s a good token?

Well, part of that will depend on the plug-in you decide to use on your WordPress site and what additional authentication schemes it supports.

Good authentication schemes are (in the order of my preference):

  • FIDO2 keys
  • FIDO keys
  • Token authentication (Google Authenticator, Microsoft Authenticator, Authy, Duo Mobile, FreeOTP Authenticator, LastPass Authenticator, Yubico Authenticator, etc)
  • SMS
  • Email

I highly recommend you choose an authentication plug-in which allows for multiple second factor authentication schemes and enable at least two different type (it’s also a good idea to choose one that would allow multiple FIDO2/FIDO keys to be registered). It’s much easier to access your site with a backup method than go through your hosting service and manually edit WordPress configuration files to temporarily disable the authentication requirements if you are unable to perform the authentication (like a lost cell phone or key).

Most of the WordPress plug-ins allow you to configure the authentication methods per user, and realistically only your administrative users need be required to have 2FA — for other users you could leave it as purely optional.

Perpetrating a Public Fraud

On my birthday I sent off my US Passport renewal application via US Priority Mail® because I wanted to insure that my old passport wasn’t lost, and of course the National Passport Center only has a Post Office box.

You can view the tracking information on the link below.

I called the US Postal Service about this (I actually had to make three separate calls, but it’s the post office so I didn’t expect stellar customer service).  The bottom line is they told me that even though this item was mishandled by the post office, and that the delay was not the result of anything beyond their control I was not entitled to a refund.

Read what the post office has on their web site about priority mail… “about 2 days” — 2 weeks (and one day) is no where near 2 days…

Like most “big businesses” in this country, the US Postal Service believes they are above the law and simply do not have to be truthful or honest in their business and advertising practices.

My advice, pay a little more and use a reliable carrier and simply avoid the US Postal Service — it’s no wonder that they’re having a difficult time making ends meet, maybe if they actually cared about consumers.

Personally I’m looking forward to the day the US Postal Service fails and I stop receiving “Junk Mail”.

Priority Mail®

With delivery in about 2 days and affordable prices, Priority Mail service is a great choice for shipping packages and envelopes. It includes Free Package Pickup* at your door. Plus, when you ship online you’ll get special savings and free Delivery Confirmation™.

You can view the tracking information here:

Show tracking information for 9405503699300472497222.

Or you can view it online at USPS.Com (you can confirm I haven’t edited the information):

Originally posted 2012-05-04 02:00:34.

Virtual CloneDrive

I’ve tried a number of virtual CD/DVD drive tools for Windows over the years.

Daemon Tools was one of the first (free) solutions that really worked well; but success went to their heads and to describe it as anything but a POS would be way too kind.

Microsoft released a very basic driver for Windows XP, and everyone hoped that they would just include the feature in future releases of Windows; but disappointment from Microsoft isn’t new, and isn’t likely to stop anytime soon.  Neither Windows Vista or Windows 7 had the feature, and the Windows XP driver can’t be used in anything but Windows XP and Windows Server 2003.

Gizmo was a descent solution; the free version had all the features I really needed, it worked — but there was just so much baggage that came with being able to mount drive images; and there were times when it just didn’t work properly.

Virtual CloneDrive has been around for a very long time —  and it’s free.  In the past it always seemed like a so-so solution to the problem, but history has a way of rewarding the companies that stick with a fairly simple paradigm and who builds a product that just works.

While I’m not a huge fan of SlySofts other products (AnyDVD just never seems to work as advertised — and it’s an expensive solution), I have to say that Virtual CloneDrive is probably one of the absolute best virtual CD/DVD solutions for Windows.

Virtual CloneDrive

NOTE: Virtual CD/DVD solutions are used to create a virtual CD/DVD drive from an image of the disk (ISO, BIN, CCD, etc).

Originally posted 2010-07-22 02:00:40.

Disposable EMail Addresses

DEAs = Disposable EMail Addresses; they’re useful for you to provide to a vendor so that you can track the use of the email address and delete it if you find it’s abused or chose to no long do business with whom you gave it to.

Just like Virtual Credit Card numbers give you control over payment to merchants, Disposable EMail Addresses give you control over your inbox.

It’s a great way to fight SPAM and identify SPAMmers.

If you don’t happen to own your own domain were you can create “forwarding” addresses, there are a number of web sites that provide you with the ability to create and manage DEAs — just do an internet search.  If you can’t find one, let me know and I’ll give you some pointers.

Originally posted 2008-12-19 12:00:36.

Wikipedia Funding

I’m a big fan of Wikipedia— that should be clear from my previous posts on Wikipedia and my frequent use of Wikipedia as a reference tool (and to link to from my posts).

Wikipedia rose from the ashes of failue much like a phoenix… and currently operates one of the largest (if not the largest) repositories of human knowledge.

Wikipedia is freely accessed by anyone with an Internet connection (provided their provider does not block such access), and is currently funded completely through donations.

While I applaud the dreams of Wikipedia’s founder Jimmy Wales to keep the site free of advertising, my feeling is that advertising might well be a better way to sustain the site.

My concept is that those who do not wish to see advertisement donate, and are free from advertisements as long as they have “credits”… when they run out of credits then they like those who choose not to donate see advertisements.

Since Wikipedia is one of the heaviest traveled sites on the internet, advertisers will likely pay top dollar, and there’s likely no need to work through an advertising network…

Originally posted 2010-01-24 02:00:35.

Fair Use

The fact that the US Copyright Laws are in a major need of an overhaul isn’t something that only the masses of ordinary users understand; but to some extent John McCain is also painfully aware.

A little back ground.

During the 2008 Presidential Campaign, John McCain launched a number of political advertisements on YouTube, many of those advertisements used copyrighted material (for which he had not obtained a use license for).  Those advertisements were pulled from YouTube to comply with US Copyright Law (not the McCain had much choice — YouTube was required to pull the advertisements under the DMCA — an act which McCain supported).

In mid October 2008 McCain suggested to YouTube in a letter that “VIPs” shouldn’t be bound by the same fair use rules as others.

What can you expect from an elitist… he only sees the problem for himself, not for the general public.  A man with eleven homes and thirteen cars and uncounted wealth simply doesn’t feel he can afford to pay for the use of copyrighted material when the use of that material has obvious and substantial personal gains for himself, but it’s fine that a minimum wage mother should have to pay for the use of an old tune in the background of her child’s birthday video.

When put like that it’s easy to understand why member of Congress have one of the best health care plans in the world (for life) but they don’t feel the average American should have much choice.

Or perhaps we should consider TSA treatment of the average American who is subjected to searches and harassment and humiliation while members of Congress bypass the entire process.

Wait I digress.

Maybe, though, on copyright, we’ll have a little more luck holding politicians to the exact same standards that you and I must be accountable to.

Something more akin to one of the results of the confirmation hearing for Judge Robert Bork.  It resulted in the passage of the 1988 Video Privacy Protection Act (because our member of Congress were afraid their video rental records might be revealed to the public — not because they were worried about you and me).

There are permitted uses of copyright material which do not require any license payments; it may not be required to completely scrape the existing laws; all we may well need is the statement added that when an individual is not likely to substantially profit through the use of the material, it is covered under fair use.

US Copyright Office – Fair Use

Originally posted 2010-01-20 01:00:37.

PayPal

The world’s most-loved way to pay and get paid.

What a crock… everyone I know loathes PayPal… the only reason anyone uses it is critical mass; pretty much the same reason people use eBay — that’s like saying people love the phone and cable company just because they use their services.

It’s laughable that a brand that’s synonymous with poor service and screwing people over every time they have a chance would have a slogan like that…

Of course, I broke into hysterical laughter the first time a Pacific Bell customer (dis)service person answered the phone with:

How may I provide you with excellent service today.

My reply was transfer me to a company that actually cares about it’s customers if you can find one.

Remember, it’s the worst companies that find it necessary to try and convince you that they’re loved…

Originally posted 2011-01-20 02:00:53.

Nothing but the necessities…

In a school district that is struggling to keep teacher’s it’s amazing that that the Santa Rosa County Florida School District can find the money (and need) for 90 iPad2s for administrators (it’s also amazing that there are 90 administrators in a  county with only about 150,000 residents).

I’m glad to see that my tax dollars are well spent on essential items to insure that today’s school children will be properly educated and that the administrators responsible for overseeing that education will have new toys at the disposal to sit mostly unused in their desks — after all, an edict has been issued by the school district that these devices are only to be used in a professional capacity.

I wonder, will it be grounds for immediate termination the first time a games is played on,, a facebook post is made from or personal email is sent via one these essential educational tools — inquiring minds want to know.

My personal feeling would be this money would be better spent offsetting the $4.4 million dollar shortfall for the 2011-2012 school year that is necessitating the layoff of teaching staff — of course, why should I be surprised about iPad2s for administrators, after all most of them just got raises to address the inequities in their pay (I guess they couldn’t afford their own iPad2s — though they seem to expect teachers to buy a great deal of supplies for their classrooms out of their considerably smaller salaries).

Originally posted 2011-08-15 02:00:22.

Green Online… JUST SAY NO

Below is a note I sent to Willis Orchard Co about an order I placed for some tropical plants.


On 19-Mar I placed an order for three Medjool Palms (1.5′-2′) and a Drawf Cavendish Banana Tree with and expected ship date around 1-Apr… yesterday (11-May) I received the FedEx packages containing those items.

Roughly a week after the expected ship date I began calling approximately once a week for an update on the shipping status — to which (other than the last call) I was always told that the product should be shipping within a couple days…

Needless to say, my impression of your “customer service” wasn’t very high; in fact it was so low that I acquired the forty-seven other fruit trees, shrubs, and ornamental trees I used to begin landscaping my yard from local sources…

I understand that your shipping delays were caused by your vendor; however, the failure to realistically appraise me of delays is solely a fault your company and customer service people must bare.

While the shipping delay alone was enough to make me shy away from doing additional business with your company; the condition of the plants I received certainly indicated to me that I shall not put your company high on a list to consider again.

The committed size of the plants is stated to be the overall height; while I’d would have hoped that would be the height from the top of the root ball to the highest vertical point on the plant, it’s obvious that you intend that measurement to be the distance from the top of the root ball to the furthest point on a (stretched) frond of the palms.

In my case that appears to be two just less than 18″ (one of those I’m being generous with the “just less”) and one that isn’t even 16″… further the one closest to 18″ and the one less than 16″ are based on measuring fronds that are brown at the ends (dead) — which most likely didn’t occur in a single day of shipping from Southern Georgia to Northwest Florida.

I can’t say I was the least bit surprised… and certainly I don’t think any of these three specimens would have come home with me had I visually inspected them before purchase (at the prices you charge).

Whether these represent the plants you would normally ship to a customer or simply you feel you’re a victim of the volume of your orders verses the inability of your supplies to fulfill their commitments I can’t say… all I can say is that I’m greatly disappointed.


In retrospect, I’d say ordering plants online should be put in the same category as ordering produce online — what you get might not live up to your standards, and what others are happy with says nothing about the quality.

Originally posted 2010-05-13 02:00:35.

SyncMate – Expert Edition

Several weeks ago I took a look at the free edition of SyncMate, and I had some fairly good things to say about it.  In fact, I was so impressed with it that I started using the free edition to synchronize my Windows Mobile device.

Eltima Software contacted me and offered me a license for the expert edition to enable to me more fully explore the capabilities of it (and to write a more in depth post about it).

I agreed, and here’s what I found…

I decided that this would be a fairly comprehensive test; it would involve a number of different operating systems, and synchronization environments.

The operating systems I tested were:

OS-X 10.6.1 (32 & 64 bit)

Windows 7 (32 & 64 bit)

Windows Vista (32 & 64 bit)

Windows 2003

Windows XP

Windows Mobile 6.5 (HTC Touch Pro 2 – XV6875)

Windows Mobile 5.1 (MotoQ)

Outlook Look 2003, 2007, 2010 on the PC

Entourage 2008 on the Mac

Windows Contact / Windows Calendar (on Vista and Windows 7)

Live Contacts / Live Calendar (on Windows XP, Windows 2003, Windows Vista, and Windows 7)

FireFox (Windows)

Safari (Windows and OS-X)

Additionally I took a quick look at iTunes and iPhoto (even though I don’t use either of those normally); and I took a quick look at Google synchronization (including synchronizing to an Android handset).

It’s a long list, and I assure you that the coverage of the tests were not exhaustive — but rather concentrated on suites of versions that would be most commonly found together (though I have a reasonably good feeling that unless there were some real flukes, the sample of tests I performed are probably indicative of all combinations).

My first test was to synchronize my Mac Book Pro with my Mac Pro… I’ve never really put any effort into making sure that the contacts and such agreed between the two, so I install unlocked the free version of SyncMate I’d installed on both and proceeded to enable all the plug-ins.  After fighting with both iPhoto and iTune (you wouldn’t need to worry about that if you actually used them they would have already been setup and ready to sync). the little spinners started and in just a few minutes I had everything on both machines (which also included all the calendar and contact information I’d gotten from my smart phone to start with) in sync.

I went ahead and disabled iPhoto and iTune for the rest of my tests — I’d seen it work, and certainly synchronizing those would easily be covered with the folder synchronization (which was a more generic test — but of course it was nice that the iTunes/iPhoto sync could be enabled with a simple click).

I decided next to see what the various versions of Windows and Office Suites would do… so I brought up virtual machines using various OS images and installed versions of Office in them.  I setup the Windows component of SyncMate and then decide to just do everything at once — so I added all the machines to SyncMate on the Mac Pro and hit the sync button.

It took a few minutes, but then on every machine in either (or both) the Windows Contacts and the Outlook Contacts there was a full copy of my contacts; as well as files I’d put in a test folder.

Things were going very well, so now I turned to a couple Windows Mobile devices.

Both were easy to setup via USB, and both synchronized perfectly (frankly I was a little surprised when the MotoQ running Mobile 5.1 worked as well as it did).  So then I tried WiFi sync on the XV6875 — worked just fine (there’s a nice feature of the SyncMate driver on the WinMo device that will tell you the IP and name of the device if you need).  Next was Bluetooth synchronization… and unfortunately I wasn’t able to do that on either device — during setting up the connection I kept getting “Uncompatible Device” (a newer version of SyncMate has corrected the awkward english construction; but unfortunately I still cannot use Bluetooth synchronization with either my XV6875 or Q), so I’m not exactly sure what the problem is, but I would consider Bluetooth synchronization more convenient than WIFi — though I generally use USB since I can charge the device as well.

Then I decided to try a few more scenarios from the SyncMate feature list.

Folder synchronization with a USB flash drive worked perfectly.  And from that I’d be fairly confident that iTunes/iPhoto/folders could be synchronized to any USB (disk) device.

Google synchronization worked just as documented; and synchronizing an Android handset with Google just happens (all you have to do is enter you account information into the handset and enable synchronization).

Here a few comments on individual features…

Call history and the SMS manager are both very nice features of the expert edition… I’m not sure it’s sufficient motivation to pay for an upgrade, but it certainly is a sweet feature.

Mounting a Window mobile phone as a USB disk is a feature that didn’t make much sense to me; my XV6875 has the ability to select whether or not it makes an ActiveSync style or USB drive connection when you connect it; though on an older device like my MotoQ it does let you see the file system on the Mac much as you would on a Windows desktop.

Time synchronization is another feature that just doesn’t make sense; all devices get synchronized to the network (and thus to atomic clocks) so I see little value (and a number of reasons not to) synchronize them to each other and defeat the mechanisms already in place (if this were a camera, not a cellular phone I’d consider this a plus — but I’m going to say this feature should be removed; and certainly not used).

As noted before, synchronization to Windows Live isn’t support (and since this is a Mac centric product I don’t think that should come as a surprise — but, of course, some people who have Windows Mobile phones may use some of the Live services).

One thing I haven’t really covered to this point is how you setup a sync partner in SyncMate; and I guess I haven’t focused on it because it’s fairly easy, and definitely straight forward.  It isn’t “automatic” (and I actually consider that a plus — I absolutely hate ActiveSync trying take ownership of a device I just want to attach once).  A nice touch to the way you add a partner is that you can both name it, and include an image for it (though it might be a little nicer if Eltima included more stock images with SyncMate, or created a web interface to find images of handsets — but I just downloaded one of each of my phones and then used that).

The number one quality of SyncMate is that it works — and by far and large it works as advertised.  In this round of tests I didn’t have any instability in the version of the Windows sync driver I installed (unlike in the previous tests where I did have some issues with the Windows sync driver crashing).

One feature I felt might be interesting for Eltima to add would be a “mesh” type synchronization — really all they’d need to do is have an ability to synchronize the partnerships between Mac hosts (ie — all the synchronization partnerships I entered on my Mac Pro could instantly appear on my Mac Book Pro the next time the two machines sync’d — and then conflicts would just be handled throughout the mesh on a peer-by-peer basis just as they are now).

As I’ve stated previously I find the price a little steep — but you and your wallet will have to decide for yourself…  If you like the free version, and have needs for some of the additional plug-ins; I suspect you’ll be favorably impressed by what you get once you purchase a license.

Eltima Software
SyncMate

Originally posted 2010-07-26 18:04:01.