How To Spot A Psychopath

October 19, 2009

Perhaps the bits are getting lost

Oh, Sky Cake Windows. You really are a new toy every day, aren’t you?

Readers with unusually long memories may remember that I shamelessly begged for money to buy a new computer. Against all reason, you actually gave me enough to make that possible, just before the end of the last financial year. Said new computer, replete with overclocked Core i7 920 CPU and 6Gb of RAM, has been happily buzzing away next to my desk ever since.

I’m not actually using the new computer yet, though, because I will not permit myself to start screwing around playing Fallout and GTA and such on it until I have actually finished writing big review about it, like unto the piece I wrote about the Athlon X2 box in 2006, and the other piece I wrote about the Pentium 4 box that preceded it in 2003.

But every time I get back to working on that big review, the PC bang-per-buck goalposts have shifted again. There is, for example, not really much reason for most people to get an LGA 1366 Core i7 machine any more, now that functionally-no-slower, yet cheaper, LGA 1156 CPUs are available. And don’t even start me on the graphics-card scene.

So this has turned into the longest PC-to-PC migration project in history, with the new machine being languidly updated with data and applications. It’s on all day, but only actually running a BitTorrent and distributed.net client. (I think you can spot the moment in my stats when the new box came on line. Feel free to mess up the numbers by ascribing your own distributed.net work to dan@dansdata.com, too.)

So anyway, the new computer’s running Windows Vista SP2 (the 64-bit version, so I’ll be able to use all of the 6Gb of memory), and it behaved itself perfectly for weeks on end. As you’d expect it to, of course; Vista was something of an adventure in frustration when it was freshly birthed, all shiny and glistening, but the two service packs have burned away the more impudent of its tentacles.

But then, just the other day, the Vista box decided to stop moving data over its gigabit-Ethernet link to my old computer, the one I’m still using, at the tens of megabytes per second to which I’d become accustomed.

Instead, it’s decided to send data at, oh, maybe half a megabyte per second. 1.5Mb/s, tops. Often quite a lot less.

Vista-to-XP network transfer speed problem

That screen grab is of a transfer from the Vista machine to the XP machine, initiated and screenshotted at the Vista end. But speeds are the same if I start a transfer from the XP end.

It sped up to about 200 kilobytes per second after a few minutes. Sometimes, at random moments, it actually managed to sustain a whole couple of megabytes per second for a while. Whoopee.

Copying between all the other devices on the network works exactly as fast as it always did. The Vista box copies files between its own drives very quickly. The laptops get full bandwidth from their wireless adapters, the Vista box copies to the little Thecus N299 at its usual roughly 8Mb/s, and copying from the XP box to anything else on the network is also fine. And, get this, copying from the XP box to the Vista box is fine, too. Full gigabit speed. So this is a one-way problem.

And it’s specific to the (Realtek) network adapter on the Vista box’s Asus P6T motherboard. When I unplugged the Ethernet cable and plugged a USB wireless adapter into the Vista machine, I got full wireless bandwidth from Vista, via the access point and its own Ethernet hookup, to my XP PC. I presume a PCI Ethernet card or USB Ethernet adapter would work fine, too - though I wouldn’t be at all surprised if the slow-transfer disease spread to the new adapter in due course.

I’ve plugged the Ethernet cable back into the Vista machine’s built-in adapter for simplicity, now. Since the BitTorrent client is on the Vista box, this means that if I download something big on the Vista machine and want to move it to the XP one, I can either start it copying long before I want it, or plug a thumb drive into the Vista box, copy the file (at a perfectly normal speed) onto that, then plug the thumb drive into the XP machine.

This problem - or something very like it - was all the rage among Vista’s early adopters back in 2007. I think the 2007 version of the problem usually had to with a well-meaning feature in Vista which is supposed to reserve network bandwidth for streaming multimedia content, so if you’re watching an HD movie or something over a (suitably speedy) network from a Vista computer, you’ll never have any frame-dropping or glitches when seeking, because any other file transfers from that computer will be heavily throttled even when they don’t need to be.

This feature apparently often went haywire, especially in the original version of Vista. It either decided to operate all the time whether you were playing video or not, or it operated when the local user of the Vista computer was just playing music, or something, while someone else tried to get a file from his computer over the network. I think there was some kind of Copy Control Crap involvement here, too, but don’t quote me.

This was meant to be fixed in SP1, and by all accounts a lot of it was. Vista Service Pack 2 has been out for some time now, and that’s what my new computer is running. And as I said, for weeks on end, everything worked fine. I could play even HD movies from the Vista box over the network, A-OK.

Because this problem has such a long history, it’s somewhat challenging to dig up information about fixing it on Vista SP2, as opposed to SP1 or the original extra-special Oh Dear God Why Did I Buy Vista v1.0 Edition. An inexpertly-crafted search string will thus turn up tons of people complaining about it back in 2007. The water is further muddied by different versions of the problem, in which copies from Vista to, say, Windows Server 2003 work OK, but copying stuff the other way is very slow and may even time out and die entirely. I don’t think my problem is related to those ones, but who frickin’ knows.

I have tried many things to fix this problem.

[UPDATE: In the original version of this post I forgot to mention that yes, I’m using a full-permissions administrator account, and yes, Vista’s firewall is turned off.]

First up, I tried using a different copying program (like the aforementioned TeraCopy, or Vista’s own Robocopy). No good.

I tried opening a DOS prompt (with admin permissions) and typing the voodoo chant "netsh int tcp set global autotuninglevel=disable". No good.

I tried Microsoft’s automatic “Fix It” doodad for changing this same setting. No good.

I noticed that the Vista PC’s hard-drive light is locked on for a couple of solid minutes after startup, even if I close all apps that could be expected to hit the drive. I don’t remember whether it did this before the transfer problem. Perhaps it’s SuperFetch-related. While I was fiddling with this, I completely disabled Windows Search. No good. Didn’t even prevent the drive-flogging on startup.

(Good old lsass.exe was totting up I/O reads and writes at a great rate. I’m unconvinced that it had much to do with the startup disk-flogging, though, since it kept on reading and writing after the drive light had returned to normal occasional flashing.)

I’ve got Nero installed on the Vista machine; that installs some pointless services that can also hit the disk, so I killed them along with indexing. I also disabled Nero’s system-startup tasks using MSConfig. No good.

I power-cycled the cheap and cheerful gigabit switch. No good.

I usually have a VNC view of the new computer’s desktop open. I closed that. No good.

(VNC itself is subject to the slow-transfer problem; it updates very noticeably slower now, and of course becomes even more painful if I ignore the new limited bandwidth and force it to a high-bandwidth connection mode, like the “LAN” setting in the UltraVNC viewer.)

I ventured into the registry, and tried setting NetworkThrottlingIndex to FFFFFFFF. Then rebooted. No good.

In a moment of mad optimism, I tried telling Vista to “diagnose and repair” the network connection. It told me I needed to “turn on TCP performance improving settings”, so I did. No good.

I turned off Quality of Service for the XP machine’s network adapter. No good.

I turned off the same QoS Packet Scheduler and a couple of Link-Layer Topology Discovery doodads on the Vista box’s network-adapter properties. No good.

I tried mapping a drive. No good.

I went on a rampage through Task Manager, killing every task that wasn’t obviously necessary for Vista’s continued operation. AnyDVD, audiodg, Daemon Tools, GoogleCrashHandler, jusched, nTuneService, PunkBuster, UpdateCenterService, Real Temp, PresentationFontCache, nvSCPAPISvr, MSASCui, two copies of nvvsvc.exe, Vuze and the VNC server all bit the dust.

No good.

But then there was SLsvc.exe, a Copy Control Crap process if ever I saw one. I killed it, and… No good.

I fiddled with “Remote Differential Compression“. Windows said “Please wait while the features are configured. This might take several minutes”, and for once it was not joking. It sat there for quite a while. But then it finished! No good!

I read through this page looking for things I hadn’t yet tried. The only new one I found was disabling “Windows Meeting Space”. So I did that. No good.

I said, “hang on a minute - why not just connect the XP and Vista boxes with a FireWire cable? That’s fast!”

So I did. And although the XP machine was perfectly willing, it didn’t work at all, because Microsoft has removed FireWire networking from Windows, as of Vista.

I noticed that Windows Update had a new driver for the motherboard’s network adapter, which I hadn’t installed with the other updates. So I installed that. No good.

I tried disabling “Large Send Offload” in the Vista machine’s network-adapter properties. I even disabled the IPv6 one as well as the two IPv4 ones. No good.

While I was there, I tried disabling the IPv4 and IPv6 versions of TCP and UDP Checksum Offload, and an IPv4 Checksum Offload too. Each of them can be enabled for receiving, transmitting, both, or neither; I fully disabled all of ‘em. No good.

I went to Device Manager and uninstalled the network adapter - and selected the “Delete driver software” option - then rebooted so it’d be redetected. No good.

Then I smote my forehead mightily, and tried a new Ethernet cable. I would actually have been slightly irritated if that had worked. It didn’t. Actually, it made XP-box-to-Vista-box copies slow, just like Vista-box-to-XP-box ones. Both cables have all four pairs connected - well, unless there’s a break in the middle somewhere. I cannot escape the feeling that this is trying to tell me something, but I’m too tired to figure out what it is.

I haven’t yet tried starting the Vista box in Safe Mode with Networking, as this page suggests. I haven’t tried connecting the two computers with a crossover cable, either. I also haven’t yet tried just officially declaring the migration to be complete and starting to use the new box as my main computer.

But dammit, I want to fix this. I’ve gone too far to turn back now.

Perhaps there’s something obvious that I’m missing, here. If any of the three people who’ve managed to read to the end of this post have any suggestions, I’m all ears.

May 21, 2009

A surprisingly un-awful interface

Filed under: MiniReviews, Software

I’ve become something of a connoisseur of dreadful user interfaces.

They usually grow like pearls, when a programmer adds features to the software he’s writing, and sticks the interface elements for each new feature wherever they fit.

From the programmer’s point of view everything’s fine, because he knows the software back to front and can remember where he’s put everything. From anybody else’s point of view, though, the interface looks as if a drunk reeled unsteadily around the window, dropping a checkbox here, vomiting up a drop-down menu there. If the program has a lot of features, then even if the programmer doesn’t do anything really stupid, the interface can still be hilariously horrible.

It’s possible for an interface to be inscrutable at first but pleasant to use after a relatively short learning period - look at Kai Krause’s old Photoshop plug-ins, for instance - but developer-made interfaces that just growed like Topsy usually aren’t like that.

One that I see quite often is NoteTab’s many-tabbed Options dialogue

NoteTab setup window

…but there are some much more impressive examples.

Bulk Rename Utility interface

Like this, for instance.

I had a directory full of MP3s that all had file names with a number on the front and a chunk on the end that I didn’t want, and which all had underscores in place of spaces. I wanted to make the file names prettier.

To do a job like this on a PC, there are four ways you can go.

1: Rename them all by hand. Acceptable for six files, not acceptable for sixty, a tedious way to spend an afternoon for six hundred, a steady job for life for six million.

2: Write a little batch file, usually in some inelegant way like doing a dir >foo.bat and then editing foo.bat so that it ends up as a long list of “ren” commands. Or even uses “for”, if you’re fancy.

3: Use a proper Unix-style shell like Cygwin or something, that lets you do stuff like this in one operation on the command line, or at worst with a very small script. The standard Unix/Linux/whatever “mv” command can’t do this in one line, but any decent shell should have a quite powerful “rename” command. More complex operations are likely to require you to know regular expressions, though.

4: Chicken out and just find a stand-alone file-rename utility.

I chose option 4, and headed off to Pricelessware, the alt.comp.freeware reference archive. Pricelessware pointed me to Bulk Rename Utility, whose inimitable interface you see above.

Let’s have another look at it, shall we?

Bulk Rename Utility interface

When I first ran Bulk Rename Utility and saw this, I just sat there and laughed. That lower portion of the window contains, unless I’ve miscounted, 28 check-boxes, 21 text fields, 17 incrementable numeric-field doohickies each with two increment buttons, 14 drop-down menus, and 17 other miscellaneous buttons. And it’s got a normal complement of ordinary menus up at the top!

The hell of it is, though, that this interface is actually very usable. It works, and it works well. I learned how to make it do what I wanted in, I don’t know, maybe 30 seconds. It could probably be better, but it’s by no means actually bad.

Bulk Rename Utility would be every bit the nightmare it appears to be, if it weren’t for one very sensible move on the programmer’s part: The interface shows you, in green, a preview of what your instructions are going to do to whatever files you’ve selected.

So I could instantly see that my search-for-”_”-and-replace-with-” ” operation was going to annihilate all of the filenames altogether, and I said “huh?”, and then I noticed that I’d accidentally put the search-and-replace terms in the “RegEx (1)” part of the interface instead of the “Repl. (3)” part, and I fixed that, and it was fixed.

Capitalising words in filenames is easy, too - just stare at the interface for 10 seconds to find the right bit of it (”Case (4)”), and select the option you want - “Lower”, “Upper”, “Title” or “Sentence” - from the menu. If those names don’t immediately explain their function to you, the green preview will.

Bulk Rename Utility even deals elegantly with locked files. If you choose to abort the renaming procedure because a locked file can’t be renamed (in this case, the file was still open in my music-player), Bulk Rename Utility gives you the option of reversing all of the renames it did before getting to the locked file.

Using regular expressions via this interface isn’t much easier than using them on the command line, but there are umpteen other options for everyday, and some quite unusual, rename operations. If you’re not doing something pretty darn complicated, you ought to be able to get it done with the standard interface.

An interface like this is still a usability disaster for a lot of people, though.

Pretty much anybody should be able to learn how to do complex rename operations with Bulk Rename Utility if they just spend a couple of minutes playing with it. OK, you might have to look at the help, or even download the manual in PDF format. But it’s really not that difficult, even if you’re not good with computers.

But your average computer-phobic person won’t even try to use something that looks like this. The same explosion-in-an-interface-factory quality that cracked me up when I first saw Bulk Rename Utility has a much more negative effect on people who aren’t confident about using computers.

Sometimes that lack of confidence is justified. It’s still easy to find big-name software products, including whole operating systems, that just don’t bloody work for some tasks, or that drop dead unexpectedly and then need a lot of work to fix. One of the standard things you hear from computer-phobic people is “I don’t want to mess around with it, in case I break something”. If that fear is based on a memory of a time when something really did break, then it’ll be a difficult phobia to cure.

But many computer-phobics haven’t had many, or any, experiences of this sort. They just don’t know much about computers, and have decided that this means they will never know much about them. I find that attitude very frustrating - “give a man a fish and he’ll eat for a day, try to teach a man to fish and he’ll tell you you’re wasting your time”.

On the plus side, Bulk Rename Utility might actually serve as a sort of exposure therapy for computer phobias. Show it to the computer-hater, let them soak up how completely impossible it looks, then let them use it to rename a directory full of temp files. Whaddaya know - it’s not that hard, if you just read the little labels and then see what they do!

The only thing wrong with Bulk Rename Utility for this purpose is that renaming multiple files isn’t a task that ordinary users actually have to do very often. Ideally, you’d want a daunting-seeming, actually-easy-to-use program that greatly speeds up some painful task that ordinary users do often have to do.

Any suggestions?

December 24, 2008

Osculate your Altair today!

Mystifying advertisement

I think the best part of this mystifying advertisement from the latest DailyWTF post is the bit at the top where it asks you if you’ve kissed your computer lately.

Years ago, when I was working at ACAR/PC Review, we somehow ended up with dozens of boxed copies of an accounting package called, and I assure you I am not making this up, “Tungkiss Your Money”.

On the box was a moderately realistic picture of a man holding his hands, full of gold coins, up to his mouth, so he could lovingly lick the bullion.

Andrew, the editor, was pretty good at finding ways to convert randomness like this into profit, or at least perks.

But we never could shift all those Tungkiss Your Moneys.

April 23, 2008

Video programming magic du jour

Filed under: Hacks, Software

Behold: A way to automatically calibrate a projector to put a full image onto an arbitrarily aligned screen.

Even, thanks to the non-zero size of the image source, if that screen is facing slightly away from the projector.

(Via.)

This system can only lay as many pixels across the screen as the projector’s lens would manage anyway, of course, but if the Carnegie Mellon researchers do manage to turn this into a real-time system, the image will be able to follow the screens around pretty much seamlessly.

So it’ll be kind of like a real-world version of those augmented reality systems in which video images of specially printed objects “grow” extra stuff:

(Previous video magic.)

February 22, 2008

Wanna buy a porn blocker? Only $3000!

Remember those lame Internet filters which my faithful readers helped the smut-hungry youth of Australia to dismantle, last year?

Well, the whole taxpayer-funded content-control software handout program has now officially been declared (by Australia’s new Federal Labor government) to be a miserable failure.

Apart from the fact that the NetAlert packages were quite easy to get around, it turned out that nobody actually very much wanted them.

The Government predicted that 2.5 million households, about 31% of the whole country, would want their free copy of one or another of the packages (which they’d paid for with their taxes already, of course).

As it turns out, they got a grand total of 144,088 CD orders and downloads.

And not all of the people who got the filter software bothered to use it. The ridiculously-named government department responsible says only about 29,000 of the packages were actually installed.

That’s 1.2% of the target, for those of you keeping score at home.

The total price of the software filter scheme was 85 million Australian dollars. That’s about $US78 million, at current exchange rates.

So this software ended up costing the taxpayer about $AU2930 ($US2685) per installed unit.

A copy of Net Nanny will cost you $US27 from Amazon. That’s almost exactly one per cent of the effective price of the “free” software.

All that, to stop red-blooded Aussie kids from seeing boobies and doodles.

But have no fear - the new Federal government is much more sensible! They enthusiastically explain that their own very expensive scheme to implement “mandatory ISP-based filtering to deliver a filtered feed to all homes, schools and public internet points” will work far better. You know, just as it has in the other countries that’ve implemented secret Internet blacklists which, in effect, accuse lots of random innocent people of being child pornographers.

Never mind that, despite more than $15 million worth of advertising (including a booklet sent to every household in the country), it is now demonstrable that approximately three-fifths of bugger-all Australians have any interest in filtering their own Internet connection.

No, never mind that. We must be protected from filthy filthy porn, whether we want to be or not!

This is all more evidence that, as I’ve said before, it doesn’t matter whether censorware works. Which is good, because it generally doesn’t.

The purpose of censorware is not to Protect The Children, but to get some people elected and keep other people employed.

February 20, 2008

The MPAA will be very angry when they figure out what this is

Filed under: Movies, Nerdery, Music, Software

DVD Jon’s new application DoubleTwist looks completely awesome. I don’t think it really does anything that you couldn’t do before with umpteen tweaky utilities, but it aims to do it all in one simple program.

So I was all ready to download the beta and start freeing all of my DRM-ed media files from their corporate shackles… when I suddenly remembered that I don’t have any DRM-ed media files.

I’ve got some DVDs, but they seem pretty happy where they are.

If you’ve got audio, video or even photos (on a stupid locked-down cameraphone, for instance) that you’d like to move somewhere else but can’t, though, check DoubleTwist out.

January 11, 2008

It turns out that Michael Jackson COULD look weirder

Michael Jackson with giant glove

There’s something you don’t see every day. (Via.)

The White Glove Tracking project got a lot of people who probably should have been working to identify the location of Michael Jackson’s famous sequined white glove in every frame of his 1983 TV performance of Billie Jean.

Then they made this video.

The video is just one - relatively trivial - example of what you can do when you turn elements of moving video into separately manipulable data, and then start fooling with that data programmatically, in this case with Processing. There are several more examples on the whiteglovetracking.com gallery page.

Another, different but related, concept:

Making 3D models from video clips (via).

December 30, 2007

The YouTube Of Tomorrow

Filed under: Movies, Software

DivX’s new Stage6 site will host, for free, pretty much any legal DivX-encoded content you like, with much better quality than GooTube.

Stage6 video files are of course generally much bigger, and you need to install their special player extension, and the site still seems to have that occasional GooTube problem where you upload a video and then it never goes live.

But I consider this a small price to pay to be able to watch (and download!) stuff like A Gentlemen’s Duel and Team Roomba’s hilarious instalments one and two of their TF2 griefing, in decent resolution.

(Unlike many other video hosting services, Stage6 does not have interstitial ads, or weird code that only works right on Internet Explorer. Actually, the current FAQ notes that “The Stage6 beta website is optimized for experience in the Mozilla Firefox browser. It may kind of work in IE as well.”)

As a test, I’ve uploaded my battling robot bugs video from the other day to Stage6; it’s here. I think the stereo audio improves it considerably.

(Joey, the Amazing Fetching Cat may now also be enjoyed in higher resolution and stereo on Stage6. He’s here.)

November 22, 2007

DirectX redux

Filed under: Windows, Games, Software

So, I’ve got that DirectX Acceleration Not Available problem again. DirectDraw Acceleration, Direct3D Acceleration, AGP Texture Acceleration; all Not Available. Direct3D was available until I tried turning it off in dxdiag, then ran dxdiag again to see if all of the options were back.

Nope, that trick doesn’t even work once, any more; now they’re all gone. Again. Graphics card allegedly has “n/a” memory on it, et cetera et cetera.

The last time this happened I tried all kinds of things, not a one of which worked, and ended up reinstalling Windows. But somebody mentioned that this was exactly the kind of problem that Windows XP’s System Restore (which I of course did not have turned on) was created to solve.

So in this Windows installation, I left System Restore turned on. And when DirectX screwed up yesterday, I used System Restore to roll the system back to its status of about a week ago.

And hooray, the problem was solved!

For about twelve hours.

I’m not crazy about the idea of restoring my system to that save point once a day for the rest of my life. I can see no other option, though, unless I get a whole new computer. I know for a fact that cleaning out all of the drivers and DirectX files before reinstalling will not help at all; all that does is take a long time and require a large number of reboots.

Perhaps a new video card would do it. This GeForce 7800 GT is pretty old and dusty; perhaps the problem does in fact have something to do with the video card failing some kind of obscure internal test, as when hard drives drop back into PIO mode.

The graphics card does still work just fine, as far as I can see; 3D mode is A-OK when DirectX is, you know, working, and OpenGL 3D is A-OK even now. I just ran OpenGL Quake 2; everything’s fine, and the video card fan ran up to higher speed as it’s meant to.

But perhaps the card didn’t give Windows the right password yesterday, or something.

I could try digging up another graphics card, but I haven’t another PCIe card in the house, and this computer’s too young to have an AGP slot. So I’d have to find some ancient PCI card, and I think the only one of those I’ve got is in the file server.

God damn it.

November 17, 2007

e4b48fd541b3dcb99cababc87c2ee88f = elephant

This post on the Light Blue Touchpaper blog tells us all yet another thing we can do with Google:

Find a password, if our l337 h4XX0r skillz have already allowed us to harvest the MD5 hash for it.

The completely stupid way to store passwords, implemented by small children writing programs in BASIC and by $300-an-hour consultants writing enterprise software, is to just save all of the usernames and matching passwords as plain text in a file somewhere. If an attacker can read that file, they can now log in as anybody.

A much better, but still not as secure as it should be, method of saving passwords is to “hash” them using a “one way” or “trapdoor” algorithm, like MD5. A trapdoor algorithm runs very quickly in one direction (turning a password into an almost-unique string of seemingly random characters), but is almost impossible to run the other way, if you don’t have access to cubic kilometres of sci-fi nanotech.

If someone gets hold of the file in which you store password hashes, the one-wayness of the hash algorithm means the attacker still can’t figure out what passwords correspond to what hashes, and so cannot make use of his discovery.

Well, that’s the theory.

In practice, attackers can take a dictionary of passwords, hash them all, then search for matches between their new hash dictionary and the password hashes. There are even helpful online tools that’ll do it for you, like the long-established passcracking.com/ru, or md5oogle. When there’s a match, you’ve got the password.

And this is what Google allows you to do in two seconds, if the password hash you’re trying to “reverse” corresponds to a common word.

The word “elephant”, for instance, hashes to e4b48fd541b3dcb99cababc87c2ee88f. Search for that in Google and you’ll get a bunch of pages which, for reasons explained in the Light Blue Touchpaper post and its comments, often also have the word “elephant” on them, or right in their title.

(This post will probably be very high in those search results in a day or two. Check out the above-linked online reverse MD5 hash lookup tool if you’d like to explore other options - it lets you hash any string you like, then checks some databases for it. While it’s checking, you can be Googling the same string. Md5oogle lets you generate MD5 hashes as well, but it converts everything to uppercase first - which many password systems also do.)

This technique only works for passwords that’re common words - or, at least, have for some reason been hashed and stored in a Google-visible file. If your password is something nonsensical like dj347F, which hashes to 54041c87e2e431f3fc4c47e55d114ef3, the hash won’t be found anywhere on the Web (except, again, on this page, once Google indexes it).

This technique also doesn’t work if the passwords are “salted” with some extra data before being hashed. So if a user foolishly decides to choose “mypassword” as his password, the software actually hashes, say, 28391mypassword, and thus creates an un-findable hash.

Adding a simple fixed salt to every password still doesn’t give you really industrial-strength security, but it’s streets ahead of a lot of the junk that makes it to production. And it does stop dumb attacks like Google searching - well, at least until people find out that MurderDeathKill 3D’s online gaming logon system just adds 28391 before hashing passwords, and start making tables of dictionary words with 28391 in front of ‘em.

Lots of current popular software uses unsalted hashes, including the WordPress software that runs this blog.

So it’s pretty lucky that I made my admin password “3hv78UEr”, isn’t it?

Older Posts

Get your free blog up and running in minutes with Blogsome