COMPUTING FUNDAMENTALS I

Transcription

1 FALL 2017 / COMPUTER SCIENCE 105 COMPUTING FUNDAMENTALS I DAY 2 27 SEPTEMBER 2017

2 COURSE ADMIN

3 COURSE ADMIN NOTECARDS - ATTENDANCE & FEEDBACK Name Student ID One of: What did you learn or find most interesting? What are you confused about, or what wasn t clear? Any other course feedback.

4 COURSE WEBSITE CS.PDX.EDU/~HARMON8/CS105.HTML

5

6 DAY 2: DO YOU KNOW HOW TO Access the reading for Monday that s through the PSU library? (Sorry about the PDF. I will move the schedule over to HTML as soon as I can!) Log into Slack to ask questions? Turn in your reading response on D2L? We will talk about the first homework on MONDAY in class. It s going to be some spreadsheet stuff. If you have ideas for a dataset you care about, let me know by FRIDAY AT 5pm. Default: I will grab some Census data? Bring a laptop and/or ME BY FRIDAY AT 4pm if I need to bring a laptop for you.

7 QUESTIONS?

8 DAY 2: TODAY: PERSONAL SECURITY BEST PRACTICES Computer basics & terminology! Then some applications Password management with KeePass 2-factor authentication: PSU, Dropbox, Google Keeping your computer up to date Backing up data - time machine, windows backup, dropbox and google drive Slack + Can you access the reading for Monday? + Can you see the course on D2L and where to turn in reading response?

9

10 COMPUTER TERMINOLOGY WHAT S A COMPUTER MADE OF AND WHY DO LAPTOPS FROM JUST A FEW YEARS AGO SEEM SO SLUGGISH?

11 HARDWARE the physical stuff AND SOFTWARE the instructions for what to do

12 COMPUTER TERMINOLOGY SOFTWARE LEVEL 1: APPS OR APPLICATIONS

13 COMPUTER TERMINOLOGY SOFTWARE INSTRUCTIONS LEVEL 1: APPS OR APPLICATIONS

14 COMPUTER TERMINOLOGY SOFTWARE INSTRUCTIONS Mac OS Windows *nix Chrome OS LEVEL 2: OPERATING SYSTEM OS Android ios INFRASTRUCTURE & TRANSLATOR

15 SOFTWARE APPS RUN ON THE OPERATING SYSTEM THAT RUNS ON THE HARDWARE

16 COMPUTER TERMINOLOGY PROCESSOR OR CPU CENTRAL PROCESSING UNIT

17 COMPUTER TERMINOLOGY PROCESSOR OR CPU WHAT INTEL MAKES CENTRAL PROCESSING UNIT

18 COMPUTER TERMINOLOGY OTHER MICROPROCESSORS LIKE A GPU GRAPHICS PROCESSING UNIT

19 COMPUTER TERMINOLOGY MEMORY (OR, RAM) VOLATILE RANDOM ACCESS MEMORY

20 COMPUTER TERMINOLOGY MEMORY (OR, RAM) VOLATILE RANDOM ACCESS MEMORY

21 COMPUTER TERMINOLOGY HARD DISK DRIVE FIXED NON-VOLATILE (ALSO A KIND OF MEMORY)

22 COMPUTER TERMINOLOGY HARD DISK DRIVE (ALSO A KIND OF MEMORY)

23 COMPUTER TERMINOLOGY TODAY PERMANENT MEMORY IS OFTEN STORED ON AN SSD (SOLID STATE DRIVE) FASTER, RESILIENT, BUT EXPENSIVE

24 COMPUTER TERMINOLOGY OSS DESIGNED FOR NEW SSDS ARE TERRIBLE IF YOU HAVE AN OLD HDD A LOT MORE I/O

25

26 THE END

27 QUESTIONS?

28 INTERMISSION

29 THE WORKSHOP PART OF CLASS PERSONAL SECURITY BEST PRACTICES

30 1. KEEP YOUR COMPUTER UP TO DATE

31

32 The British hospitals hit by this latest attack, which weaponised a flaw in Microsoft s Windows operating system revealed in February, are hopelessly outgunned. They re running Windows XP, an operating system first released in September 2001, and which Microsoft itself gave up supporting in 2014; it has been kept on life support by extra payments to the company, but the Department of Health stopped making those in

33 PERSONAL SECURITY BEST PRACTICES UPDATING IS IMPORTANT Don t try to live like an underfunded government bureaucracy On both Mac and Windows machines, it s really straightforward to set up automatic updating. It should be enabled by default. Don t turn it off! Don t delay those updates for months on end!

34 PERSONAL SECURITY BEST PRACTICES WHY DON T PEOPLE UPDATE? Bad experiences with losing data A better alternative to not updating? Keeping your data backed up!

35 2. BACK UP YOUR DATA!

36 BACKING UP YOUR DATA BACKING UP YOUR DATA - EXTERNAL DRIVE Windows File History Mac Time Machine These require an EXTERNAL hard drive, usually this connects via some USB variant (e.g., USB or USB-C) which depends on your computer A good choice if you are willing to plug in an external drive from time to time and keep it somewhere safe!

37 BACKING UP YOUR DATA BACKING UP YOUR DATA - THE CLOUD Dropbox, Google Drive, icloud, OneDrive Security focused services like SpiderOak Business-focused like Box Your files are backed up to servers (computers) that Dropbox, Google, Apple, Microsoft, Box, SpiderOak operate Many of which may actually be operated by Amazon! A good choice if you also want to sync across multiple devices (e.g. your phone) or access your files remotely (e.g. from a lab computer) and feel comfortable putting your files on a remote server. Dropbox is the most user-friendly for sharing files with others and for multi-platform setups (e.g. windows computer + iphone), but they have also had some bad data breaches in the past. YMMV. SpiderOak has good security and reliability, but is more expensive and probably your friends aren t using it

38 3. GOOD PASSWORDS & A PASSWORD MANAGER

39 PASSW0RD! P4SSWORD#

40 PASSW0RD! P4SSWORD#

41 MAKING UP ONE REALLY GOOD PASSWORD AND USING IT FOR EVERYTHING

42 MAKING UP ONE REALLY GOOD PASSWORD AND USING IT FOR EVERYTHING

43 BETTER OPTION 1: PASSPHRASES

44

45 BETTER OPTION 2: PASSWORD MANAGER

46 DAY 2: PASSWORD MANAGERS ARE GREAT BECAUSE: Generates passwords for you that are arbitrarily long random strings meeting all the requirements of a particular site Stores all those passwords so you don t have to remember them Also great for those easy-to-guess security questions like what s your favorite color usually these can be any random string! use random strings!

47 KEEPASS KEEPASSXC keepass.info keepassxc.org

48 KEEPASS/KEEPASSXC + free + open source + regularly updated + available for many platforms + data file is encrypted and can be safely stored anywhere (i.e. dropbox) - manual syncing - not as user friendly as some others

49 ONEPASSWORD

50 1PASSWORD + super easy to set up + good reputation + seemingly good security + lots of apps for different devices - costs money - closed source

51 DAY 2: WHY WOULD YOU WANT SECURITY APPLICATIONS TO BE OPEN SOURCE? Doesn t that mean people can hack them easier?

52 DAY 2: WHY WOULD YOU WANT SECURITY APPLICATIONS TO BE OPEN SOURCE? Doesn t that mean people can hack them easier? NOPE! NOT REALLY!

53 DAY 2: KERCKHOFFS'S PRINCIPLE "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. (a 19th c. military espionage theory)

54 DAY 2: OTHERS? Lastpass seems popular, but was hacked in 2016 Enpass expensive to use on mobile, but if you have a chromebook, maybe your best option? icloud keychain if you re all apple/mac products, this probably works. Safari has built in suggested passwords now when you re using the web that are pretty good. Wired ideas: Lifehacker ideas:

55 IF YOU USE A PASSWORD MANAGER, ITS SECURITY IS ONLY AS GOOD AS YOUR MASTER PASSWORD!!! AND THAT ONE YOU HAVE TO REMEMBER!

56 4. TWO FACTOR AUTHENTICATION (2FA) A/K/A TWO STEP VERIFICATION

57 DAY 2: FACTOR AUTHENTICATION FROM 2008

58 DAY 2: FACTOR AUTHENTICATION TO TODAY! Two-factor authentication (or 2FA) is one of the biggest-bang-for-your-buck ways to improve the security of your online accounts. Luckily, it s becoming much more common across the web. With often just a few clicks in a given account s settings, 2FA adds an extra layer of security to your online accounts on top of your password.

59 DAY 2: SO.. WHAT IS IT?

60 DAY 2: FACTORS FOR AUTHENTICATION knowledge factors something you know, like a password possession factors a physical thing you have to have, like a key inherence or biometric factors something inherent to you, like a fingerprint

61 DAY 2: TWO FACTOR AUTHENTICATION USES TWO DIFFERENT THINGS + PIN NUMBER possession knowledge

62 DAY 2: TWO FACTOR AUTHENTICATION USES TWO DIFFERENT THINGS GENERATED TOKEN / + DETECTED PRESENCE PASSWORD possession knowledge

63 DAY 2: ESPECIALLY GOOD WHEN: You use public computers and your password might get accidentally saved to a browser or stolen by malicious software

64 DAY 2: ESPECIALLY GOOD FOR: Important stuff. Like, your password. If someone got access to your password, they could reset all your other passwords!

65 DAY 2: WILL THIS PROTECT YOU FROM THINGS LIKE THE EQUIFAX BREACH? No, and there s nothing you can do about that one. It was the result of very poor security on Equifax s part. BUT! Setting up 2FA does help with some things: Protects *other* accounts so information gained in one breach can t be as easily used against you to gain access to something else Can possibly help protect you against lazy password security by other companies

66 DAY 2: DANGERS! You lose your access to the extra factor (i.e. your phone is lost, stolen, or broken). Some services give you a list of single-use codes or backup contact options. A good thing to store in a password manager!

67 DAY 2: SET IT UP AT PORTLAND STATE Uses an system called Duo - your second step can be a phone call, a smartphone app, or an SMS SMS is not the most secure, but probably still better than nothing You are no longer forced to change your password every x days. No obvious backup codes that I can figure out. Don t lose your phone!

68 DAY 2: SET IT UP ON OTHER SYSTEMS - GMAIL, DROPBOX, ETC.