Adobe Flash blocked in Chrome 76

When you now run version 76 of the Google Chrome browser you will see the message shown in the screen shot excerpt below.

Click above to enlarge image.

If you click on Learn more at the right-hand side, you will see a 2017 message about the termination of Adobe Flash late next year.



 As explained in this article, Chrome now blocks Adobe Flash by default.  Flash support has been built into Chrome for a long while, thereby not requiring the user to download it separately from Adobe each time an urgent security update was needed.

Mozilla's Firefox browser will disable Flash starting in version 69.  I already have it disabled in my current version (68.0.1) of Firefox.

Based on what I see on the Adobe Flash Player download page, Flash is still supported in all versions of Windows, along with macOS and Linux. Web browsers other than Chrome may still support Flash, but the number of websites that still require Flash is rapidly shrinking.

If you still use a particular website for a service that is important to you and it will not run unless Flash is enabled, I recommend that you enable Flash only for that particular website.

John

Passwords & Two-Factor Authentication

During a recent morning on 3740 kHz we discussed the two big Yahoo email breaches and the need for effective password use and management. A detailed Q and A about the Yahoo breaches is available in this article by Brian Krebs. Today we depend upon online accounts for many purposes. Our most important accounts (e.g. finance-related) must have strong passwords that are not reused at other sites. A good way to meet these requirements is by use of a password manager. (Paper records are also popular, but require manual typing of login details and secure handling.) Below are links to two (of many available) password manager programs that have good reviews from security analysts and journalists. Both are free and have versions for Windows, Mac, Linux, iOS and Android.  If you have not used one, I suggest that you try one with one or more of your existing logins to explore the features.

• LastPass
• KeePass

You can find these and many others reviewed in many web articles such as the following:

• The best password managers for PCs, Macs, and mobile devices
• The Best Password Managers of 2017

Several programs provide automatic fill-in of username and password blanks on web sites that you log into. Some or most can use secure cloud storage to make it easy to access your password data from multiple computers or mobile devices. These programs can also generate a complex, random unique password of any length to use with each online account.


Note that use of any password manager requires you to choose a strong master password since it must protect all of your stored passwords.


For additional security you should consider two-factor authentication (2FA) which requires entry of an additional piece of information when a login is attempted from a previously unknown device. This is strongly recommended for online accounts that involve your financial matters. Below are links to articles that discuss how two-factor authentication works and why you should use it.

• Multi-factor authentication
• Two factor authentication: what you need to know
• Websites that support 2FA

At the very least, you should make sure that your important / finance-related online accounts use unique and long passwords. Password complexity is important too, but if you must sacrifice complexity, use longer length. For an appreciation of the importance of password length see this article by Steve Gibson. With a password manager you can use long and complex passwords since you are not burdened with manually typing them in at each login.

Your comments and questions are welcome.

John

Two online malware scanners

A recent issue of PC World magazine suggested two free online malware scanners as a supplementary check of your Windows PC that may already have installed anti-malware software, or if you are having current malware symptoms:
Free Online Virus Scan - Antivirus Software - Trend Micro USA
Free Virus Scan | Online Virus Scanner from ESET 
I mentioned these to the Monday morning radio group, and used them later on my two desktop PCs that currently have the Avast Free AV installed.


On my office PC, 2006 vintage with two drives, I first rain the ESET online scanner. It ran for 2 hours and appears to check all files. It found several instances of potentially unwanted applications  (listed below) and deleted/quarantined them. Drive C is the newer Win 7 drive; Drive F is the older Win XP drive, which I almost never boot up now. I did a Google search on the reported Win32/InstallCore.QW and found the tally at virustotal.com to be very interesting:
https://www.virustotal.com/en/file/2ca33500c1e3c129aad55a092717a9044cd0e1919e24ce78211ebd4611572826/analysis/

Next I ran the Trend Micro Housecall and it found nothing. It took only a few minutes to run and I'm not sure if it also checks for potentially unwanted applications in additional to the truly malicious stuff.

On the ham shack PC, 2013 vintage with two drives, the Trend Micro Housecall scan found nothing. Then I ran the ESET scan, with the option again set to include potentially unwanted applications in its search. It took just over an hour to scan the two drives (315,385 files). On the older drive F, that was originally in the office PC years ago, it found two potentially unwanted applications. The program automatically quarantined them and gave me the option to delete them upon completion of the scan.

I concluded that both online scanners are worth running if you have current malware symptoms or just want to occasionally supplement your normal resident anti-malware software.  As malware developers and users have become more sophisticated and sneaky with their methods, it is more important than ever to not rely on any single protection method and to be even more vigilant about emails and web links.

==================================================================
Results of ESET scan on 2006 vintage PC.  User names replaced with ****.

C:\Users\****\AppData\Local\Temp\ICReinstall_Evernote_5.7.1.5586_inst.exe   

a variant of Win32/InstallCore.QW potentially unwanted application    deleted - quarantined

F:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate\{16782E9C-E344-47BD-

A045-B9BA79870632}\_Setupx.dll   
a variant of Win32/InstalleRex.U potentially unwanted application    deleted - quarantined

F:\Documents and Settings\****\My Documents\Downloads\aoeprzip.exe   
a variant of Win32/OpenInstall potentially unwanted application    deleted - quarantined

F:\Documents and Settings\****\My Documents\Downloads\outlookexpress-setup(1).exe   
Win32/DownloadAdmin.G potentially unwanted application    deleted - quarantined

F:\Documents and Settings\****\My Documents\Downloads\setup-bluegriffon.exe   
Win32/DownWare.W potentially unwanted application    deleted - quarantined

Password Management

Below are my notes about several methods and tools for password management. Individual needs and preferences will always help to determine the best approach. 

For a collection of articles that review various password management programs, scroll down to the section labeled  "Reviews".

Paper Records

• easy to use, but requires manual keyboard entry of login data
• storage is offline
• must be stored and transported securely
• may not be with you when you need it
• no electrical power needed to access
• frequent updates can get messy

Web Browser Password Storage

• built into popular web browsers
• convenient for most web sites
• storage by web browser on your device is not highly secure
• password data can be lost if not backed up
• must synchronize among multiple devices
• master password strongly recommended for user access

Spreadsheet Password Storage

• convenient for most web sites
• storage by spreadsheet file on your device is not highly secure
• password data can be lost if not backed up
• must synchronize among multiple devices
• master password strongly recommended for user access

Cloud-based Password Managers

• encrypted password data is shared among all of your registered devices via cloud storage
• all encryption / decryption is done on your device
• software must be installed on each device
• can augment security with a hardware multifactor authentication device
• able to capture login information during initial login creation on a web page
• automatically enters login information on subsequent logins
• easy to create new login information and updated passwords
• can generate strong random passwords that meet web site requirements
• can securely store content other than logins
• a master password is required

Local Computer-based Password Managers

• encrypted password data is stored on your device (computer, phone, flash drive / removable media)
• data file must be backed up
• if removable media used for storage, must transport between devices
• all encryption / decryption is done on your device
• software must be installed on each device
• some can augment security with a hardware multifactor authentication device
• data can be shared among all of your devices via manual copy process, local server or cloud
• easy to create new login information and updated passwords
• can use copy / paste or auto-text to apply login data to a web page
• can generate strong random passwords that meet web site requirements
• can securely store content other than logins
• a master password is required

Reviews

Many articles are published that review and compare password manager programs. Here are a few for information. The first article does a very good job of explaining the big picture and the specifics of various approaches.

Password managers: Are they safe? Which is the best?
The Best Password Managers
Lifehacker Faceoff: The Best Password Managers, Compared 

Take control of password chaos with these six password managers

Web Browser Based Password Managers  -- See page 5

Top 10 password managers

Updating Vulnerable Software

There is no end in sight to the parade of malware exploits that make use of vulnerabilities in popular Windows-based programs. If you are not sure of your system's vulnerability or don't trust the automatic notifications that you receive from some programs, you should consider running a scan on a regular basis to determine what programs need to be updated. Two facilities that I have used and trust are:

• FileHippo - You can download popular program updates from their home page, or install and run their free Update Checker for a scan of the most popular programs installed on your PC. You can choose to have it run every time you start Windows or just run it on demand. The results are displayed on a convenient web page where you can click and download any updates you need or want. They include beta versions of programs that you may or may not want to use. This scanner identifies version updates for a select group of popular programs, not every program installed on your system. The updates are not all associated with patching security holes. Below is a screen shot fragment that shows the scan results I obtained today. Click on the image for a full-size view.

• Secunia Online Software Inspector - This scanner concentrates on identifying vulnerable programs on your PC. It also provides a web page report with links to the updated program versions. It is a Java applet and so requires Java to run. Below is a screen shot fragment that shows the scan results I obtained today. Click on the image for a full-size view.

Scanning takes only a few minutes on most systems. Downloading and installing the updates may take some time, especially if you have many outdated programs, but all experts in the field of computer security agree that patching vulnerabilities is very important to the overall secure use of your computer.

Selected computer security tools

Here are a few links about certain computer security tools that I have repeatedly suggested to friends and family members:

• Microsoft Security Essentials -- Free antivirus / antispyware
  
• PC World review of beta version
  
• Ars Technica revew
  

• Secunia Software Inspector -- Use one of these to check your installed programs for vulnerabilities:
  
• Online Software Inspector -- scans from web page
  
• Personal Software Inspector -- download version that monitors PC continuously
  

• OpenDNS -- Can be set in your router or in each PC individually. For a laptop that is used elsewhere to access the Internet, it should be set up in the laptop even if set up in the home router. For a household with many PCs, especially children's, the router may be a good place to set it. The optional user account can enable more powerful and customized filtering of web sites.
  

• Password Managers
• SplashID -- I use on my PDA. It syncs with the version on my PC.
  
• Password Safe -- Free. Duplicates what I have on SplashID. Has a nice Auto Type feature that provides single-keystroke entry of userid & password at a web site's log-in screen.
  
• LastPass -- A web-based password manager; I have not used it.

• File Shredder -- Can process individual files or entire folders and their subfolders with contained files. Example of the latter usage is to shred the entire "Documents and Settings" folder of a PC being recycled or discarded.
  

• CCleaner -- Excellent product for cleaning up software debris that accumulates in your PC.
  

• Drop My Rights -- A free utility from Microsoft that reduces the administrative rights of a web browser, email program, or media player to prevent most accidental installations of malicious software when using these routine programs.
  
  

Electronics Recycling
Off topic, but included here for convenience. See the blog posting about Technical Knock Out, a good place for recycling old computers.

Web log-in storage by Intenet Explorer

Most if not all web browsers provide the convenience of storing usernames and passwords for logging into web sites that require them. While I do not recommend using a web browser to store log-in data for very important or sensitive web accounts, the service can be convenient for other web accounts. For your most important log-in data I recommend a program such as Password Safe. This program saves your data in an encrypted file that you can easily save on back-up media, too.

Some web browsers let you access stored log-in data easily, and provide the option of password protecting the stored data. However, this 'master password' feature is not as secure as a dedicated password program.

Log-in data (usernames and passwords) stored by Internet Explorer (IE) are not accessible within IE. When you access a web site log-in page that uses the stored data, your username will be visible, but the password will be obscured. If you have stored such data while browsing with IE and later need to view it, because you don't have it saved elsewhere, you will need to use a third-party software tool or an obscure procedure.

This web page discusses the protected storage used by IE and provides links to several tools for accessing the stored data. Most of the tools listed are priced at $39. One is offered free of charge. Another page features such a tool for $10. I cannot advise about the effectiveness or trustworthiness of such tools.

In summary, be cautious about where you store web account log-in data so that it is secure but also accessible when needed.