Deterministic Password Manager

While Apple, Google, and Microsoft are all very hard at work on a variety of passwordless schemes, passwordless logins will not be a reality at every website you visit anytime soon, simply because password-based login systems are the easiest and the cheapest to implement and most business, including banks/financial institutions are too lazy and don't want to do anything unless they are forced to implement a better solution. So we all have to continue using password manager for quite some time to come. 

There are many commercial and free versions of password managers out there to choose from but most of them store your encrypted password somewhere on the cloud which has a potential to be compromised. What if a password manager stores literally nothing and is able to deterministically calculate your password every time you access it? Would that be cool? That is what I did with my deterministic password manager prototype below. 

My website mypassword.us creates deterministic password without storing anything on the cloud or local storage unlike many password managers. All you need to remember is your single passphrase, the website name (FQDN), username for each website to create or retrieve your strong password on the fly. For convenience, the password is copied to browser's clipboard so it can be pasted into the website's password field directly.

Note: Password length can be set to 8 char for old & outdated websites that still insists on 8 char but it is highly recommended to use 16 char. Also, fields are case sensitive to ensure high variability on generation of password.

Simple Encrypted Drive

We all have sensitive data that we need to keep them away from prying eyes. While there are so many free software and solutions available, they all have advantages and disadvantages in using them. A discussion of available solutions and the pros/cons are outside the scope of this blog. If you are interested in using a simple, highly secure and most importantly, a free solution where you have 100% control of your sensitive information, read on. Note: This is only if you use a Mac or Linux laptop/desktop, sorry no Windows.

Here is a simple shell script to encrypt your data locally in your hard drive or on a portable USB stick to take it anywhere. If your USB stick is lost or stolen, the data stored in there are of course useless to anyone. The way the script works is by creating an encrypted disk using a special filesystem driver (encfs) and allows you to copy your ordinary files (i.e. unencrypted) through the driver just like copying a file with your operating system's copy command. To access these files, you have to mount the drive with your passphrase. Once the filesystem is mounted, they are available through a mounted drive in plain form to retrieve or update your files. Once the file system is unmounted, they stay in your hard drive or usb stick in encrypted from. 

Here is how to use it.

./encrypted_drive.sh -d /tmp -m

In the screenshot below, I am using a /tmp directory just as an example but you should actually choose a permanent storage like an ordinary directory in your home path like "$HOME/encrypted" or a USB disk mount ex: /Volumes/<mydisk> on Mac. Note: you need to choose a strong passphrase and remember that to access your files later. The very first time you run, script will ask you a question about encrypted volume type as shown below, just hit enter to take the default; subsequent runs will not ask anything except the Encfs password i.e. master password you chose to mount the encrypted volume.

Once the drive is mounted (see the screenshot above shows mounted drive on your desktop), you can simply copy your sensitive files using operating system copy command like shown below, or just drag and drop files like you'd do with any other drive/path. The mounted drive will stay mounted for 15 minutes and unmount itself automatically for security reasons.

As you can see from the above screenshot the files are now accessible through the mount point (/tmp/decrypted) for reading and writing in plain form. Once you unmount using -u command, you see the files in /tmp/decrypted are gone and the actual files in encrypted form are in /tmp/encrypted which is useless if anyone got a hold of your USB drive or your computer containing these files. (Note: replace /tmp/ with the path you chose for your permanent storage when you mounted the drive)

The script is available in my GIT repo below. Download it and follow the instructions (below) to install the encfs which is required for this script to operate. Love to hear feedback.

GIT: https://github.com/aselvan/scripts/blob/master/security/encrypted_drive.sh

#  Instructions for installing encfs

#   Mac: 

#   run the following 2 commands on mac terminal (assumed you have brew installed)

#     brew cask install osxfuse

#     brew install encfs

#   

#   Linux:

#     Ubuntu/Debian: apt-get install encfs

#     Redhat/CentOS: yum install encfs  

#     Other: refer to your distro manual

#

#   Windows:

#      Sorry, wipe that crap 😃 and install Linux or get a Mac!

#

Facebook knows you way more than you think!

We all know that Facebook collects data on all of us. They manage to do that with different ways including via 3rd-party web browser cookies; an explanation of 3rd-party cookies goes beyond the scope of this blog but you can read about it at the link here. Though 3rd-party cookies are slowly phased out, the alternative i.e. FLoC proposed by Google, as per many privacy advocates, is even worse i.e. so for now, just assume Facebook and other platforms will always have a way to spy on you.

While there are ways to restrict what Facebook collects (follow steps at end of this blog), there is not a whole lot you can do to make them stop other than just deleting your Facebook account. The reason is, Facebook generates substantially all of its revenue by selling ads so they have to monitor your online activity to slap you with targeted ads and curated content based on your web browsing behaviour i.e. the sites you visit, shop, like etc. At the end of the day, Facebook knowing I have T-mobile wireless, or shop at Amazon or browse Reddit is not a big deal for me, I just don't care. However, when I looked at what websites are sharing with Facebook, specifically, financial institution that I do business with, I was concerned. My financial institution (will not mention their name here) shared with Facebook something related to my activity, see below ... 

It is unclear to me what they shared since I don't have the details other than Facebook telling me they did. I have the habit of clearing all cookies on banking and financial websites frequently, so unfortunately, I can no longer access this specific cookie in my browser to see the content! However, based on the name of activity shared i.e. "COMPLETE_REGISTRATION", I can only assume it is not something I would like them to share, whatever it is. If it was just "PAGE_VIEW" like all other sites, I would be ok with it. The only thing I remember is opening a new account, transferring money on those 2 days at that exact time mentioned which caused my concern. Why on earth Facebook needs this information? Just to give some perspective, this is just one specific instance of a website I have discussed above, there could be crap ton of them we visit everyday sharing all kinds of stuff w/ Facebook 😮

Finally, if you got this far, you can follow the steps below to tell Facebook to quit doing this, at least for now, until they figure out new ways of profiting on you 😃

Update: (May 22, 2024): Since many page links and interfaces have changed since this original post back in June 2022, I updated the details below as of today. 

While logged in Facebook ...

1. Navigate to https://www.facebook.com/off_facebook_activity
2. Click "Manage future activity"
3. Click on "Disconnect future activity" [Note: this will also clear all the stored activity so you don't need to clear that]

For visual reference, The screenshots for steps 2 and 3 are below.

How to get free home phone service w/ Google Voice + OBi

If you are still paying for home phone service, you should to look into this. This blog will walk you through to setup a free, feature rich home phone service with no monthly recurring cost (except the cost of the OBi device you purchase one time). You can enjoy features like unlimited free local and long distance calling in US & Canada, $0.01/minute to India, unlimited call blocking of annoying telemarketer calls, call screening, call hour schedule, custom greeting, voice mail transcript to your e-mail and a boat load of other features. The only requirement is: you need have a decent internet connection. Interested? Then read on.

OBi110:

First you need to get a OBi110 VoIP device (for about $60 at amazon.com). Here is a link to it http://www.amazon.com/gp/product/B0045RMEPI

Google Voice (GV):

Next, sign-up to get a free GV number. Anyone with a g-mail account can get one by clicking the link below...just follow the instructions. If you don't have a g-mail account, no worries, you can create free account here http://www.gmail.com ; it should not take more than a few minutes.

https://www.google.com/voice

Number porting:

Skip this section if you are fine with the brand new phone number GV assigned to you. However, if you don't want new phone number and would like to keep your existing number, Google will happily port your number to GV service for $20. However, it gets bit complicated if your existing number happens to be a land-line number because Google will not be able to port land-line. The good news is, there is a way to port your land-line number to GV service by first porting it to a mobile provider (t-mobile) and when the porting is complete, then you can ask GV to port it from t-mobile. Just follow this link http://www.obihai.com/porttutorial that will walk you through that process. I took this route to port my land-line number since I had the same number for almost 18 years and I did not want to loose it … the total cost to port my land-line following the link was about $35 ($20 for Google + $10 for t-mobile prepay card used in the process to convert my land-line to mobile number).

Setting up OBi Device:

Once you got your OBi device, connect the internet port of the OBi to your internet router and power it on. Connect a home phone (corded or cordless base unit) to the port named “Phone” on the device (Note: there is also “Line” port there, I will explain later in this blog what you can do with it). Now, create an account at http://www.obitalk.com using your Google account credentials. After the account is created, login to obitalk.com and click on the “Add Device” link on the left of your dashboard, (Note: ensure that the check-box “I want to configure Google Voice on this device” is checked) and follow the prompts to setup GV service on the OBi. Have the home phone connected to the device handy with you as you will have to dial some codes to activate the device during the process. Once you complete this step, and if all goes well, your corded or cordless phone connected to the OBi will be active now and ready to make local and long distance calls. Congratulations, you are ready enjoy the free service!

To setup and use all that great google voice features (custom greeting, call blocking, call screening, ... etc), read the documentation at the link below. There are plenty of documentation available besides this on the web.

http://www.google.com/googlevoice/about.html

International calls:

If you just want the home phone for calls in US and Canada, you can skip this section as well as the rest of the blog. Otherwise, read on for to setup cheap calls to many countries especially India. This step is very simple, all you have to do is add money to your GV account! You can do that in GV webpage here: http://google.com/voice click the + link next to the word “Credit” on the left under your GV phone number and follow the prompt.

The rest of the blog is for optional things like skype integration. If you are not interested, you can skip the rest of the blog.

Skype integration: (optional)

Since many people use skype to make and receive international call these days, you can optionally integrate your skype account with OBi so you can call your friends and family overseas via your skype account bridged to OBi. The OBi110 device is equipped with two SIP lines. The first one (SP1) is already used for GV that you setup earlier and the second one (SP2) is free to do what ever you want with it. We can use the empty SP2 to link your skype client to OBi so your friends and family overseas who use skype can call your skype client which in turn will call your OBi which in turn will ring your home phone. Sounds good right? This step is bit complicated and you can potentially screw up your device but if you follow the steps carefully it should be OK. This skype integration is not needed if you prefer to use skype client and are comfortable with it. If that is the case, you can skip this section.

Here are the steps to follow to link your skype client to OBi

1. Download the latest SipToSis (a program that creates a bridge between your skype client and OBi device) from here: http://www.mhspot.com/sts/siptosis_download.php Once download is complete, extract the archive to a folder named SipToSis. Execute SipToSis_win.bat (windows users) on a command prompt or SipToSis_linux (Linux users). When activity has stopped, terminate SipToSis.
2. Now, using notepad (or vi) edit SkypeToSipAuth.props file and add the following line at end of the file. In order to do this, first you need to find the IP Address of your OBi device. To find IP address, pickup your home phone, and dial ***1 and press talk button. Now your OBi will speak the IP address (and other settings) for you, once you note down the IP, you can hang up. I assume you know your skype_id :) Note, replace the appropriate entries on the line with out any angle brackets of course.
   *,sip:siptosis@<your_OBi_IP_Address>:5061,<your_skype_id>
3. Add a # in front of the line in the same file as shown below
   #*,play:clips/invalidDest.wav
4. Go to obitalk.com and enable expert settings (click the blue button for expert/advanced configuration, click yes at the warning and click enter to enable expert settings page). Under the expert settings, make the following changes.
   Service Providers -> ITSP Profile B -> SIP -> ProxyServer : 127.0.0.1
   Voice Services -> SP2 Service -> AuthUserName : (put anything here)
   Voice Services -> SP2 Service -> X_RegisterEnable : (unchecked)
   Voice Services -> SP2 Service -> X_ServProvProfile : B
   SP2 status should show : Registration Not Required
5. Start skype client.
6. Start SipToSis on the command prompt. (You should see the output similar to what I get on my machine shown below for reference)

Launching SipToSis

2014-11-01 21:47:25,062 Starting SipToSis v20130716

2014-11-01 21:47:25,065 Skype4Java Version 1.3.0.1

2014-11-01 21:47:25,065 os=Linux ver=3.13.0-37-generic arch=amd64 (8 core)

2014-11-01 21:47:25,065 javaVer=1.7.0_72 - Oracle Corporation (64 bit)

2014-11-01 21:47:25,091 Available Codecs: PCMU(0),PCMA(8),iLBC(98),L16/16k(102)

2014-11-01 21:47:25,091 DTMF rfc2833(101)

2014-11-01 21:47:25,092 initSkype - If stuck, check Skype online & API auth

2014-11-01 21:47:25,628 SkypeVer:172

2014-11-01 21:47:25,703 Attached SkypeUserId:aselvan

2014-11-01 21:47:25,713 Config - skypeClientSupportsMultiCalls:false concurrentCallLimit:2

2014-11-01 21:47:25,713 SipToSis contact_url=sip:skypests@192.168.x.xxx:5070

2014-11-01 21:47:25,713 via_addr=192.168.x.xxx realm=

2014-11-01 21:47:25,713 RTP Ports: 63200-63202 Local Skype Ports: 64432-64435

2014-11-01 21:47:25,713 jitterLevel=-1

2014-11-01 21:47:25,750 Registrar Server Domains=

2014-11-01 21:47:25,751 MaxCallTime: not limited MaxPSTNCallTime: not limited

2014-11-01 21:47:25,751 MaxDailyPSTNUniqueNumberCount: 48 MaxDailyPSTNMinutes: 350

2014-11-01 21:47:25,751 Loading Skype PSTN Call History

2014-11-01 21:47:25,756 WAITING FOR INCOMING CALL

...

At this point (assuming I haven't missed any steps) you have your OBi device bridged to skype client successfully. To test it out, you can setup a speed dial to your skype friend or skype test user “echo123” as shown below at obitalk.com speed dial setup (you can find it under the “Add Device” link).

sp2(<your_friends_skype_id>@<your_computers_IP_address>:5070)

sp2(echo123@<your_computers_IP_address>:5070)

Note: Replace <your_computers_IP_address> with the IP address of your PC running SipToSis and Skype client. Enter the above without the angle brackets in the “Number/Address” field of an empty speed dial entry, you can add a friendly name in “Name” field.

Once the skype speed dials are setup, you can simply pickup the phone and dial the speed dial number and press talk. This will make the OBi call SipToSis which in turn calls skype client which actually connects your home phone to your skype buddy on a voice call.

BTW: The speed dials are for anything, it can be skype friends or just any phone numbers. You can setup up to 99 speed dials

Bridging a land-line with OBi: (optional)

Finally, if you have an existing land-line and would like to keep it as a second line for home business or you just love to pay telephone company for what ever reason :), you can link that to OBi so you can take advantage of OBi features on that line as well. Remember the “Line” port mentioned earlier? that is where you connect your existing telephone service. Once connected, you need to go to your obitalk.com account and click on “Add Device” and follow the prompt (note: ensure that the check box “I want to configure Google Voice on this device” is unchecked this time). The only reason you may want to do this bridging is so you can use same phone to make calls using different services (GV or your land-line), and to take advantage of the OBi features. OBi by default will use SPI (your GV service) to make outbound calls. You can however change that on Obitalk.com settings.

Final thoughts:

OBi is highly configurable and comes with ton of useful features. In my opinion, it is way too complicated for ordinary folks to mess with all of them especially the inbound and outbound call routing rules, digitmaps, auto attendant etc. In order to play with all of them you need to spend a lot of time to read the manual (first link below) to learn how to do it. If you are happy with GV features (sufficient even for an advanced user), just don't mess with any settings on your OBi.

Enjoy your OBi!

http://www.obihai.com/docs/OBiDeviceAdminGuide.pdf

http://www.obihai.com/docs/OBiFeatureStarCodes.pdf

http://www.obitalk.com/forum/

http://www.obihai.com/tutorials-tips

How to block unwanted calls using Vonage and Google Voice

While most VoIP based telephone service providers allow features to block annoying telemarketers and SPAM calls, Vonage does not provide any feature to block calls but I still stick to Vonage for number of other features I really like. The following are 3 simple and easy steps to setup selective call blocking using combination of Vonage and Google Voice service. Not an elegant solution, but it does work, most importantly, its free :) I am using successfully for couple of years now.

Just follow the 3 steps below.

1. Get a free google voice number. Go to https://www.google.com/voice and follow the prompt to set it up with your home or cell (you should remove it later) and google chat as the forwarding numbers as shown below ...

Phones setting: http://selvans.net/vonage_scb/gvsettings.png
Calls setting: http://selvans.net/vonage_scb/gvcallsettings.png
Note: mine shows only google chat since I removed all forwarding numbers.

2. Login to your vonage account and setup simulring to ring your google voice as shown below
Simulring: http://selvans.net/vonage_scb/simulring.png

3. Login to your vonage account and setup voicemail timeout settings as shown below
Vonage VM timeout: http://selvans.net/vonage_scb/vmtimeout.png

After this, when ever you get an unwanted call, login to google voice, select history, find the unwanted number and select "block" from the pulldown menu under "more" as shown below ...
http://selvans.net/vonage_scb/gvblock.png

Note: Google does a pretty good job on its own blocking spam... as you can see, I did not have to block this 702-815-2394 number since google already did that for me :)

In addition, if you have a list of numbers to be blocked you can follow my original post below to setup a group of numbers to block.

https://forums.vonage.com/showpost.php?p=17184&postcount=56

Enjoy!

How to setup keybased ssh, scp to Transend WifiSD card

The following are steps to get root and ssh access to Transend WifiSD card to automate copying of files from the card. It is assumed that the user is familiar with some knowledge of Linux scripts and commands. It is also assumed that the user is going to use a Linux host to interact with the card although the setup can be easily used in Windows as well using tools like winSCP or cygwin or pscp.exe.

The setup outlined here is based on the information and code shared by the original author (Glen) at the following link/blog.
https://www.pitt-pladdy.com/blog/_20140202-083815_0000_Transcend_WiFi_SD_Hacks_CF_adaptor_telnet_custom_upload_/

DISCLAIMER: Use it at your own risk. I am not responsible for any loss or damage to your property.

STEPS:

0. Use the Transcend tools (andriod app or ios app) to configure your card to connect to your home wifi network; while you are at it, change admin user, cards wifi ssid, passwd etc. Make sure your card successfully connects to your  wireless network and note the IP address assigned to it by your home wifi router.

1. Download and extract http://selvans.net/public/custom.tar.gz in your desktop computer and edit the autorun.sh file to uncomment the line below for telnet access, i.e. remove '#'

   telnetd -l /bin/bash &

2. Edit the access.sh file and change "trusted_network" variable to match yours

   trusted_network="your_routers_ssid:your_routers_ip:your_router_mac"
   example: trusted_network="myrouterssid:192.168.1.1:ff:ff:ff:ff:ff:ff"
 
3. Insert your SD card in your computer and copy the entire custom/ directory from step #1 above to the root directory of SD card. In addition, also copy autorun.sh to root directory of SD card.

4. Remove card and reinsert it into your computer.

5. Now you should be able to telnet to your card from your linux box, i.e. telnet <your_card_ip>
In the examples shown below 192.168.xxx.xxx is my WifiSD card  and 192.168.yyy.yyy is my ubuntu desktop

   arul@cheetah:~$ telnet 192.168.xxx.xxx
   Trying 192.168.xxx.xxx...
   Connected to 192.168.xxx.xxx.
   Escape character is '^]'.
   # ls
   bin             home            lost+found      sbin            usr
   config_value    init            mnt             sys             var
   dev             lib             proc            tmp             www
   etc             linuxrc         root            ts_version.inc

6. Once you are logged in via telnet as shown at #5 above, you need to create dropbear hostkeys and copy them to your desktop to include in /custom directory on SDcard.  Note: I have included two dummy files in /custom directory you need to replace them by creating your own key files. i.e. follow the example below but use your IP address and your user name of course.
 
   # dropbearkey -t rsa -f /tmp/dropbear_rsa_host_key
   # dropbearkey -t dss -f /tmp/dropbear_dss_host_key
   # scp /tmp/dropbear_* arul@192.168.yyy.yyy:/tmp/.
 
Now, copy the 2 files from your /tmp directory to the custom/ directory on the SD card  by replacing them.

7. Create (or copy if you already have a dsa public key) in your desktop to  the /custom directory as authorized_keys. Note: I have a dummy authorized_keys  file that you need to replace.

   ssh-keygen -t dsa
   cp ~/.ssh/id_dsa.pub custom/authorized_keys

8. Once you update all the key files in custom/ directory in the card, unplug your card and plug it back into your device (computer or camera) one last time. Once the card boots, you should be able to ssh into your card or scp files, or setup automated scripts to copy files from card to your desktop... and pretty much do everything you can do with ssh!
 
   example: 
   arul@cheetah:/tmp$ ssh root@192.168.xxx.xxx
   # cat /proc/cpuinfo 
   Processor : ARM926EJ-S rev 5 (v5l)
   BogoMIPS : 421.06
   Features : swp half fastmult edsp java 
   CPU implementer : 0x41
   CPU architecture: 5TEJ
   CPU variant : 0x0
   CPU part : 0x926
   CPU revision : 5

   Hardware : KeyASIC Ka2000 EVM
   Revision : 0000
   Serial : 0000000000000000
   
   # date
   Sat May  3 16:13:53 UTC 2014
   
   # /sbin/busybox-armv5l uname -a

   Linux (none) 2.6.32.28 #137 PREEMPT Fri Mar 22 18:21:52 CST 2013 armv5tejl GNU/Linux

   # exit
   Connection to 192.168.xxx.xxx closed.

   arul@cheetah:/tmp$ scp -r root@192.168.xxx.xxx:/mnt/sd/DCIM/* .
   DSCN0254.JPG                                          100%  836KB 278.8KB/s   00:03 


Have fun with ssh/scp on your Transend WifiSD card!

TOOLS:
   This is where I got the prebuilt busybox and dropbear binaries for reference. They are already in the custom/ directory for convenience.
   arm5l busybox: http://busybox.net/downloads/binaries/latest/
   arm5l dropbear: http://landley.net/aboriginal/about.html