Tuesday, December 18, 2018

UPS Battery Replacement

Commentary: My old UPS battery died.  Rather than buying a new unit, I replaced the battery. A UPS is recommended if you have dirty power -- and my power was dirty because of a power-hungry laser printer that keeps rebooting the PC each time it prints.  Related article:  PC Reboots after printing.

Somewhat humorous update: This article was written in 2010/2012 -- the last time I replaced the battery.  It failed again today, 6 years later.  Time to get a new battery. 

An un-interruptable power supply (UPS) provides power when the main grid fails. During a "power anomaly," these relatively inexpensive devices keep the computer running for about 10 to 12 minutes -- giving enough time to save your work and shut down. If you are not at home, included software can gracefully shut the machine down.

But the real reason for a UPS is to protect the hard disk and motherboard from brownouts and power surges. Power gremlins like these can fry the equipment or corrupt the hard disk -- which would ruin everything. Remember my mantra:  Data is more valuable than hardware.

Related Keyliner Article: UPS turns off and on

My UPS Pooped-out and the PC Reboots:

My then six year-old UPS [now approaching 15 years] APC cs350 has been dying. When it was new, it ran the computer and two monitors for about 10 to 12 minutes -- now it can hold a charge for 2 seconds.

The unit has a sealed, lead-acid rechargeable battery and like a car battery, it can lose its spunk. 

The final straw came last week when my Brother HL-2040 laser printer (Keyliner reviewed here), printed a page and then surprised me by rebooting the workstation. When it crashed, the document was lost and the RAID disk array failed.  See also, this newer keyliner article:  PC Reboots after Printing.

As I noticed later, it was crashing each time someone else printed from their laptops or tablets -- but they never noticed my computer would power-down.  The prior week I noted the RAID was perpetually rebuilding (article: Raid Power Gremlins).  When I put two-and-two together, I understood this was a power issue. 


Laser printers pull an amazing 450 watts and something like 15amps.  Lights throughout the house, and probably throughout the southern part of the State, dim whenever the printer cycles.  The power company rejoices when I print. 

I have always known the UPS was compensating. Each time the printer fired-off a page, the circuit would brown-out and the UPS stepped in to save the day -- that is, until it became too tired.




APC cs350:

I am partial to the APC brand cs350 UPS, which costs about $70 (now $90 and is amazingly still produced).  You can get one at any office-supply store. It features a user-replaceable battery and mine is now it is on its fourth battery and it will fail again in 2025.

Installing a new UPS is a cinch: Plug it into the wall. Plug in the computer and monitor, and you are set. I should, but don't bother with the USB connector, which can tell the computer to shut down when I am away.  I use the UPS to protect me from those one or two-second power blips you see every now-and-then.

Most UPS's, including this one, have two rows of power plugs.  One side is [battery and surge-protected] and the other is [surge-protected with no battery]. Here is the back-side view of the cs350:






Although it is safe to plug an inkjet printer into a UPS (on the surge-side), never plug a laser into the UPS because it would suck even a large UPS to its death. But out of necessity, the printer and computer live on the same household circuit -- which is the same as being plugged into the same power-strip.


User Replaceable Batteries


At first, I was going to buy a new, smaller UPS, figuring it was cheaper than a new battery. That would be a mistake.  Buy this model of UPS and replace the battery for the rest of your life. 

Replacement batteries can be found at these easy locations:

BatteriesPlus $40.00 
Staples for $35 -special order  "RBC2"
Lowes Home Improvement $35, in the lighting section of all places

To replace the battery on this model, turn the UPS on its side, and pull the battery out, unplugging a red and black cable. It takes about a minute to replace.  The battery is surprisingly dense, weighing about 5 pounds.  Old batteries must be disposed of properly at any auto-parts, tire-and-battery shop, or battery store.




I have a second UPS plugged into the house wiring closet, where the routers, wireless, and SAN drives are connected.  This keeps these devices from resetting when the power goes out.  If you hate re-programming fried equipment, protect them with a UPS.

Your comments are welcome.

Related links and products:
BatteriesPlus
Staples: New cs350
Raid Volume Rebuild
Raid Power Gremlins

UPS turns off and on
PC Reboots after printing

Replacement Battery: 12V 28W 7.2AH
GP 1272 F2  (APC)  RBC2
GP1272 F2 1272A
Werker 12Volt 7Ah AGM Battery .250 Terminal WKA12-7F2

Battery size:  15cm (16") long, 6cm (2.5") wide, - about the length and width of a cell phone, by 9cm (3.5") tall.   This is a very standard size, used in this UPS, and in all kinds of battery-powered lighting fixtures.
 
Replaces:
05201050BAT, 182735, 23275, 6DW9, 6FM6, 6FM6A, 6FM7, 791181624, B00007, BAT0062, BAT0370, BD712, BERBC31, BP127F, BT712, CB1270, CFM12V65, CP1270 , CS36D12V, DG127F, EP1229W, EP1234W, EVA12-7.5F2 , F6C127BAT, GNBSP12V7F1, GP1270, GP1270F2, GP1272, GP1272F2, GT12080HG, HE12V77, HEPNP712, HEPNP712FR, HP712, HR1234WF2, HR1234WFR, HR912, LC-R127CH1, LC-R127R2CH1, LCP127R2P, LCR127R2P, LCR129CH1, LCR12V65BP1, LCR12V65P, LCR12V65P1, LCRB126R5P, MBCFM12V72, NPW3612, NPW4512V, PE12V72F1, POWPS1270F, POWPS1270F2

The vendor rates the battery for 5 years.

Sunday, September 9, 2018

Raspberry Pi - TV Signal lost

Raspberry Pi - TV Signal not found.  Video signal lost.  Also, "Switching audio to TV speakers"

During a long software update or software installation, the video signal is lost.  Switching the TV's input, from [hdmi 1 to hdmi 2, etc.,] did not help.

Issue:
I had the Raspberry Pi connected to the home TV, which was patched through a home stereo.  The stereo receiver would get bored and would power-down (energy savings). 

Powering on the stereo receiver restored the Pi's video.

Related article:
Raspberry Pi - Installing network-wide ad-blocking with Pi-Hole.

Sunday, August 12, 2018

Android Address Book Edit Icon missing - Solution

Android Address Book, Edit icon missing - Solution

Unable to edit address book entries.  Unable to edit address book entry. 

Seen by author on Android Version 8.x with a Moto X4 and reportedly with older versions of Android, and other phones, such as Verizon and AT&T.

Instead of the Pencil icon, you see an "Add Person" icon or add "multiple person" icon.




Solution:

Click the Add Person icon (illustrated); it will magically change to an Edit icon and all remaining address book entries will be fixed at the same time. 

This appears to be a bug in the Address Book and appears to only affect addresses stored in Google's online address-book.  Locally-stored addresses (why would you do that?  that is crazy-talk), appear unaffected.

Solutions that did not work:

Exporting address book and re-importing.
Deleting the Google-account and re-attaching.


Saturday, August 4, 2018

Windows Media Player not updating Album Info with Pi-Hole

Windows Media Player not updating Album Information when using a Raspberry-pi Pi-hole

If you are using a Raspberry-pi Pi-hole (DNS Sinkhole) for blocking ad traffic, the pi-hole (at least on 2018.08) was blocking album metadata updates, album queries, album art, etc.

From your pi-hole admin screen, whitelist this address:

nexus.officeapps.live.com




Related article: 
Using a Raspberry-pi to block network-wide ads and nefarious sites.  I am using this with great fanfair:

http://keyliner.blogspot.com/2018/01/network-wide-blocking-of-ads-tracking.html


Sunday, July 1, 2018

Top 21 Home security Steps


Top 21 Home PC Security Steps

Article titles with "top ten lists," are usually trolling for clicks, but these are the things I do, and these are the things I tell my family.

The number one rule
- never click unexpected popups




While surfing, if an unexpected popup appears -- ignore it by closing your browser.  The popup may be delayed, showing an earlier site, but more likely it is from the site you are at.  In either case, close the browser (or end-task on the browser).  Do not interact with the dialog.

Popups can look serious:
"You have a virus!" 
"Google Chrome has detected a problem, click here to fix," 
"In order to view this video, you must install a new driver or CODEC"
"This PDF requires an updated PDF Viewer, click here..."
"You need an updated Flash player to view this video"



No matter how badly you want to see that video, do not click the popup.
 
Because it is admittedly difficult to tell a scam from a legitimate one, abandon all of them. 
On prompts like this, I tell my mom to shut the computer down, as gracefully as possible, then reboot - or at the very least, close the browser.  Likely, the bogus warning won't return and all will be safe. 

When it comes to virus popups, in my experience, 95% of the time, a "You have a virus, click here to fix!" -- means if you click, you will get one.  It will be the exact opposite of what you want. 



If you need a new PDF reader, a new version of Flash, or a new driver, go to the vendor's site and download 




In other words, do not let a surprise popup initiate the download.  You should find and download the software update, driver, what-ever, from the vendor's site.  If it is a virus popup/download/cleanup, start a virus scanner manually.  If it claims it needs a BIOS update, go to the vendor's site and download yourself.  You initiate the update -- not from a popup, not from an email. 

But, when downloading, only download the component you need.  Uncheck all offers for additional software.  For example, Sun Java is notorious for installing McAfee Security Scan Plus -- which amazingly is *not* a virus scanner -- it is an ad-delivery program!  And do not allow them to install browser toolbars!  Curse them all.




 
Do not click unexpected links in email





Even if you know the sender, even if you have a business relationship, be suspicious of embedded links.  Emails are easily spoofed and links may say one thing but go to another.  Instead, go to the vendor's site and manually find the item of interest.  Again, you initiate the transaction. 

Unexpected invoices or purchase confirmations are always scam. 
Do not click the link; do not "login" -- no matter how legitimate the email looks.  Go to the (vendor's) site and manually confirm.

Hint: Hover the mouse over the link to see where it goes, but good scammers can make this look surprisingly realistic.


Your bank, Microsoft, Facebook, the IRS, etc., will never send an email asking for an account update or ask you to login in order to "fix a problem."




Microsoft has 10-billion accounts.  They are never going to call you out-of-the-blue to tell you your little-old PC has a problem.  Your bank already knows your account number and name and they will never call.  If you get a prompt (or phone call), where they have found some kind of problem, be-assured they will ask for a credit card and will "fix" the problem, leaving all kinds of new problems.  If worried or in doubt, contact the institution directly.
 

Do not install browser plugins or tool bars 
Do not install any Coupon programs




This includes "Ask.com", "Jeeves", Yahoo, and Google toolbars, etc.

These are spyware benefiting advertisers, not you. 
If you have them installed, go to to the browser's Add-ins menu and remove. 



The only browser plugin I allow are ad-blockers, such as "UBlock-Origin"  or "AdBlock Plus".  Be wary of copy-cats and lookalikes.


Hesitate at all UAC (User Account Control) prompts
It is trying to tell you something...




If you see a Windows UAC prompt (User Account Control) -- where the whole screen goes dark-grey and the only window you can interact with is the prompt, "Do you want to allow this application to make changes to your PC?"





You answer should almost always be "No" -- even if you were somewhat expecting it.  Unless you know exactly what you are installing, say no.  This prompt, this is serious.  This is how viruses get installed.  See rules 1-5.

An even better safeguard is to create a Windows Administrator account and demote your own account, using these steps:

1.  In Control Panel, User Accounts, Create a new Windows login account.
2.  Name as "admin", Use a "LOCAL" account"
     Change the account from "Standard user" to an Administrator

3.  Logout of your normal account.
     Login with the Admin account.

4.  In Control Panel, Users, find your original account.
     Demote it to a Standard user.

5.  Logout of Admin; log back in as you.



In the future, when UAC prompts to install something, type the admin account's credentials to allow the install.  This keeps family members from making mistakes.  Be sure to record the password.  Use a password scheme (see below).

Many say this is painful.  My response: How often do you install software?  It is rare and a minor inconvenience. 


Have a password scheme 






Use a password-scheme for all important accounts and logons -- making each password different.  Make sure your bank's password is different from Facebook's or Google's.  This is easier to do than you might think, if you follow this keyliner article: Better, safer, stronger passwords:

http://keyliner.blogspot.com/2011/08/grcs-password-haystack.html


In summary, for a two-word company, such as hotmail, invent a password like this:
hK9doggly.barksm   where h and m = hotmail

For a one-word company, such as Amazon, use:
aK9doggly.barksm    where A mazon


For sites you don't care about, such as discussion boards, use a single (same) dumb-password: "DumKats.2aa".  Again, the article discusses the idea.

In all cases, longer passwords are better than short ones.  Aim for 14 to 16 characters, using a password 'phrase.' 

Invent any scheme you like.  Be sure the scheme includes upper and lowercase, a number, and a special character, this way you won't be trapped by sites that require one or the other special characters -- include one of each.  A space or period is a perfectly fine special character, and they are easy to type.

Don't bother with a password vault.  They are cumbersome and you wont want to use it.  For those sites which make you change passwords every 90 days, and other such nonsense, store the password in your phone's address book.


Have a Junk Email account





Create a junk email account on Yahoo.com, Gmail, or other such services.  Use it for vendor and sales traffic - typically for repeat traffic, such as Amazon, Netflix, and the like.  Consider email to this account as third-class email -- worth glancing at, but easily discarded.  Expect this account to fill with spam as your email address is sold.

Use your "real" email for trusted friends and trusted businesses, such as your bank, or government agencies. 


Use Disposable Email accounts
These are so cool!




If dealing with a one-time vendor (or with a vendor who you suspect will pester you with spam), use a disposable email account.  Flowershops, photo-printers, business card companies, motels, and the like, all come to mind.  

Mailinator.com
SharkLasers.com (Mailinator)
guerrillamail.com (if attachments)

Disposable email accounts are strange beasts that take a moment to understand.  Be sure to see this keyliner article:

http://keyliner.blogspot.com/2017/12/disposable-email-accounts.html

When coining a disposable address, use a dumb scheme for your email name.  Be consistent and use the same scheme for all of these types of email.  For example, use johnsmith1123, where "1123" is your house number.  Something easy to remember.

Because disposable emails are so ethereal, what if you want the shipping invoice or other notices, but don't know when they are being sent?   Keep using the disposable account, but do all of your tracking on the vendor's site, ignoring the emails.

When closing an account, first change the address to a disposable address.  Save the changes.  Then close the account. This way, your address falls off the spam-list.




Use two-factor authentication
All major vendors (google, facebook, microsoft, most banks) support this.
Research if you don't know what this is. 



Use  PIN (or other security) on your cell phone
You need this for your two-factor authentication, above.



Speaking of phones, I have a deep distrust of all games - and I am suspicious of most programs -- always looking carefully at the permissions.  It is a dishonest world out there.


Periodically login to your routers and update the BIOS
If your router is more than a (few) years old, replace it.




Record your router IP Addresses and credentials.
Here is a tutorial: First-time router setup
http://keyliner.blogspot.com/2012/06/linksys-ea2700-router-first-time-setup.html


Use a DNS Proxy
Yes, this is geeky and takes a few minutes to setup.
I am 100% sold on this idea




Block nefarious and ad-sites with a DNS proxy. Protect from scams and phishing.

Use either a Raspberry Pi
(See this keyliner article:  http://keyliner.blogspot.com/2018/01/network-wide-blocking-of-ads-tracking.html )

Or use this easier, but less flexible method, "OpenDNS" service, (208.67.222.123 or 208.67.220.123 -- see https://www.opendns.com/home-internet-security ).  Both the Pi and this are good ideas.

 

Claim your logins





Even if you do not use your bank's website for online banking, consider creating an account there, just to claim the real-estate.  Claim an account on every entity that could harm your financial standing - broker accounts, investments, etc., all come to mind.  This suggestion is from security analyst, Brian Krebbs, who I like to follow on Twitter.  Insist on two-factor authentication.


Lock Credit-Reports





With the Equifax breach, all of your personal information has been leaked -- including your billing address, DOB, SSN, etc.   Lock your credit reports, and only open-up when you need it.  This requires pre-planning and it requires good record keeping.

Equifax
Experion
TransUnion
Innovis

When I was talking with my security co-workers, telling them I did this, they said, "Duh!  We did this years ago."  It was that important to them, it should be that important to you.


Use a local SAN drive for data backups





See this keyliner article:  Western Digital My Cloud Review
http://keyliner.blogspot.com/2014/07/western-digital-my-cloud-review.html

These types of drives automatically backup files, keeping multiple generations of your data.  For example, my drive keeps the last 5 versions.  Read the article for important tips and tricks.  There are many vendors with similar products in this arena.  This is a good safety net.





Use a portable (offline) USB drive for "Image" backups
This takes a snapshot of the entire PC, all files, the operating system, and drivers.  Useful in the event of a disaster. 





This is for desktops and laptops.  Use "Acronis" to make the backup.



Virus scanners?





I suppose one is needed.  Use Microsoft's built-in Windows Defender scanner, unless you have a college student who does not follow rules 1-6, above, then I might consider a more industrial and expensive product, but even then, I have reservations about all commercial products.


Quit giving stuff away 





Don't fill out surveys on Facebook and other such sites.

When registering online forms, password-reset-forms, etc., do not divulge real information.

For example, "what city were you born?"  -- use a scheme, similar to the password scheme above, and answer every question with the word "purple."   On Facebook, you might say the city born was "fPurpleCityBorn.B1aa" -- where you do not list the city, literally saying "cityborn".  For your favorite book, "fPurpleFavoriteBook.B1aa".  This way you never have to remember your favorite book (or city born...). 

See this keyliner article:  http://keyliner.blogspot.com/search?q=password+scheme   (Better, safer, stronger passwords).


Get a Google Voice Number (a new phone number).





Give this number to all vendors.  For example, my dry-cleaner, Lowes, Home Depot, grocery-store-rewards program, etc., all use my phone-number as an account number.  This is less of a security concern than a sanity issue.  No sense getting spam calls when they sell your number, and they will sell your number. 

Some people I know use a phone number scheme -- where they always give a fictitious number, such as 208.123.4567 -- always using the same number. One friend gives an old land-line number, which was probably re-assigned to some poor schmuck who now gets all of his spam calls. 



Drivers License
Nobody should get a copy!




Many hotels and banks scan your drivers license, storing an image, usually of the front and back side, including the CIV number.  For banks, this seems legitimate, but for hotels, they are using the image in case there is a dispute about who charged the room.  Some also scan your credit card.

Admittedly, you can't always avoid them scanning your license, but I am no longer comfortable with the idea.  Lord knows where they keep these files and how secure they are.  Can employees see these?  You bet! 

Your driver's license is used for e-filed taxes and to register online accounts with the IRS.  It is also used for credit applications.  If you can, argue and don't let them scan the license.

I realized this was a problem when a seedy motel scanned (or xeroxed) my driver's license ostensibly to prove that my credit-card was used and authorized -- many, if not most hotels and motels do this.  I have no idea where those images are now.

Consider using tape to cover some of the fields and bar-codes (Younger drivers will have to leave the DOB exposed for obvious reasons).


I have just started doing this and am unsure how well it will be accepted.  If needed, the tape is easily removed.  I will follow-up with this in a later post.


-end.


Your suggestions on this topic are welcome.

Friday, June 22, 2018

Hiya - Stopping Phone Spam - Caller ID Call Blocking robocalls

Hiya - Stopping Phone Spam - Caller ID Call Blocking robocalls - A product recommendation.

My phone, like yours, has been the target of repeated and persistent robo, spam, and spoofed calls, using unknown numbers, unlisted and, "neighborhood" numbers.

How did they get your phone number?  It seems every company from Home Depot, to Equifax, to Chilis, and T-mobile, have lost their database.  Your number is out in the wild.  Plus, it is easy to robo-dial every possible number.

The numbers change daily.  For example, in Area-Code 202 (DC), 16 million calls were placed this quarter, using 1,300 different numbers.  Texas Area-Code 469 had 10 million calls, using 1,000 different numbers.

Don't register with the National Do Not Call database.  This list is mostly used by non-profits to call you directly (they are exempt from the list are are known to use it.  Meanwhile, spammers and crooks don't subscribe to the database -- because they are dishonest, and they use it it validate numbers.

If you are like me, you no-longer accept un-recognized that are not in your address book.  This works to-a-point, until your voice mail fills.


You need Software

On the Android and Apple App stores, consider installing the free Hiya Call Blocking software.  This program examines inbound calls and compares with a database. Reported calls are blocked.

Most spam calls ring one time while the database is searched, then are deleted/intercepted.

If an unknown (non-reported) call makes it to your phone, hang up.  Then, in the Hiya application's pop-up, "Block" the call and "Report" to the database; this appears to be a two-step process; see below for comments.  Once that number reaches a database threshold (number of reports), the number blocks for all users in the system.

Installing Hiya

Install "Hiya Caller-ID & Block" from the App Store.  Naturally, at least on the Android Play Store, you'll find several look-alike apps; be-careful and look for the icon displayed above.

The free version is really free.  No strings attached.  No advertising.  No gimmicks.  Refreshing. It updates the phone's spam-database once-a-day.

There is reportedly a premium version, for $3 per month ($20 per year); this updates the database three-times-per-day -- I have seen, but cannot find this option.  A note has been sent to the vendor and I am waiting for a response. [Update:  They have now de-nuded the free program, making it useless.  The regular version is now on a monthly/yearly subscription)

AT&T customers can use Hiya's program, through the AT&T network.  As before, this used to be free, but is now double-the cost of Hiya's).  AT&T's install is convoluted and difficult to install, requiring  two different AT&T apps:  "AT&T Mobile Security" and then "AT&T Call protect."  I am unclear why they require the first program to use the second.  Under the hood, it is the Hiya program.  It is a serious pain to install. 


Recommended Settings:

When installed, create an optional setup account (I tied mine to Google); this way your "block database" is backed-up and can be used with a new phone.

Next, in the "Settings screen (gear icon)," Incoming Calls, make these recommended changes:

"Scam and fraud Calls"  - Block (send to Voice Mail).
"Suspected Spam Calls"  - Block (send to Voice Mail).
"Calls from Private Numbers" - Block (send to Voice Mail).
"All other incoming calls" -  Show caller ID.
"Outgoing Calls" - set to "Do nothing".

A "Block (do not send to Voice Mail)" is a needed option, especially on the first two menu choices.

Note the app does not require permissions to use the address book -- but probably benefits, if granted rights.  Consider this change:  In the System Apps screen, under Hiya, under "Permissions," grant access to the Address Book -- presumably giving it permission to allow those calls to pass through.  It is unclear if this is indeed what happens, and the website does not have details.  Similarly, would granting "SMS" rights allow it to block unwanted text messages?  Unclear, un-documented.


Idiosyncrasies

The Hiya program has some strange oddities. 

For example, when launching the program manually, it is not obvious how to see the list of incoming calls and numbers.  It turns out the bottom "phone-menu" icon is really the recent-call report.  For the longest time, I thought this was an icon to place a new call, even though the icon next to it is number-pad icon, which made it doubly-confusing.  This is an interface problem.

The Today-report (phone icon) does not always show phone numbers, sometimes showing "general spam" -- with no phone number.  With this said, today I looked at the report and the numbers are listed.  This may be a bug.  Calls from the Address Book are listed by name -- but again, no phone number.  This is inconsistent and confusion.  If this is a phone-number-blocking program, we need to always see the numbers!

An irritation:  When reporting a spam call, it seems to take four or five clicks to make the report.  It should be two:  1) to report; 2) to choose the type of spam [marketer, general spam, IRS Scam, Survey, etc.].  Too many clicks; too many options.  We are already annoyed the call made it through, don't want to be annoyed at a data-entry screen.

A confusion:  The program is unclear if you choose "Report" -- does this also "Block" the call?  I am always unsure and end up clicking both buttons.  We need clarification here.  Why would we ever want to Report a number and not block it?  The button should read, "Report and Block."   The Block option is understandable -- block, but don't bother filling out a 5-click report.  But even this is confusing.  If I block, does it still "report" the number back to the home database?  Gosh, I hope so.

"Mr. Number"

The publisher has a second program called "MN" (Mr Number), which is similar to the the Hiya program -- doing the exact same features.  The program is listed prominently on their website, but again, there is no explanation on what it does and why it is different than the main program.  It appears to be older and possibly obsolete.

The App and Play Store reviews roundly trounce the "Mr. Number" application -- with many 1-star reviews.  Again, I can't tell why this program even exists and I cannot tell what makes this one different than their flagship program.  This makes the company, or at least their webpage, a little flaky.


Conclusion:

Inbound phone calls from numbers outside your address book are unusable because of spam.  Unless you want to be pestered all the time, you will have to use a program, such as Hiya's Caller ID and Block.  Despite its idiosyncrasies, this is a good program, and is worth installing.  I liked it better than competing programs, Caller ID and TrueCaller.


Monday, May 14, 2018

Disposable Email Accounts

Disposable Email Accounts - Recommendations

Quit giving your email to vendors that you never want to hear from again.


Summary, with details below:
InventedName@mailinator.com
or www.guerrillamail.com and setup an account




You have a regular email, for private and personal business -- and if you are smart, you also have a junk email -- one you give away to vendors and other parties.  The "junk" email is probably less-important but it still requires cleanup and monitoring, which makes it a pain.  Likely, the junkmail account is inundated with spam.  (See the end of this article for a discussion on Junk Email accounts.)

Wouldn't it be nice to have an email address that you use once and then discard and never have to worry about it again.  You could use this for confirmation emails, one-time-survey questions, and the like. 
What can you do when a site requires an email address,
and they send a confirmation email,
 -- but you don't want to give them your real address and you 
never want to hear from them again?


The Solution:  Disposable email addresses!

With a disposable address, look when needed and ignore otherwise.  Disposable email accounts automatically delete emails after an hour or two -- no cleanup is needed!  Vendors can spam you every hour and you won't care.

The vendor can still send you wanted emails, but you chose when to look.

I recommend the following disposable email services -- all are free and easy-to-use and quirky.

Each service has benefits and drawbacks.  Most are public, meaning they are visible to anyone who knows the account name.  This means there is no passwords and no security!  As scary as this sounds, it is not bad.  They are "secure by obscurity" because nobody but you and the vendor know the email address.

If they send you a confirmation email or an invoice, run up there and grab it, then delete.  From then-on, ignore the address.  You don't even have to use that same address the next time you deal with them; invent a new address and do the same thing.

Admittedly this is weird and it takes some mental energy to get used to.  Consider these two services.  Read how they work, then pick one and try it out the next time you have to deal with a vendor.



Mailinator
Recommended


www.mailinator.com

Summary:
  • No signup, setup, or registration required.
  • Optional signup recommended if you need to delete, save, or forward.
  • Free
  • No advertising
  • Read-only, no outbound email
  • !Inbox created by the sender - the moment they send
  • No need to pre-setup; no benefit to pre-setup.

Mailinator can be used on-the-fly; address can be invented at any time, using any address, without using a computer or app.  Just coin the address on-the-spot. 

Using Mailinator:

Give vendors any made-up address, tacking @mailinator.com at the end.
You can do this over the phone.
You can do this when filling an online form.
Don't forget what address you used or it is lost.

Amazingly, it does not matter if the email account has been used before, by you or anyone.

Literally, at any time, any place,
make-up an email address and give it to your vendor.
This becomes the inbox.

For example:  JSmith-123Street@mailinator.com


By design, arriving email is visible to everyone ('public' emails)!
If you know the account name, you can read the email.  Notice you do not need a password and anyone can go to that address to read the mail.  See example, below.

No Risk - Try this now:

Open browser to www.mailinator.com
At the "Go" prompt, type "Jsmith"
Read jsmith's inbox (a popular inbox)

Additional test:
To prove how easy this is, from your normal email client, send an email to this slightly-more complicated email address:  jsmith-andme-2018@mailinator.com.  Open www.mailinator.com and go to that email account.


Recommended use:
For registering on websites for one-time or limited transactions.
For registering with businesses where you expect them to spam or sell your address.
Public email lives for apx 5 to 10 hours -- longer than most.

I recommend clicking the "Signup" link and registering (where you only need to give a real email address and a password).  With a sign-up, you can save and forward emails in a dedicated inbox (exact retention unclear -- but it lasts more than a few hours).

To their credit, mailinator uses 2-factor authentication to register the account (good), but they use an unencrypted login page (bad) -- your browser will warn you the login is not SSL-encyrpted.  This is a low-risk email account, so the fault is survivable.

Drawbacks:

Important:  Mailinator does not handle attachments.  If you expect attachments (typically .pdf), use Guerrillamail.  

If your vendor sends a shipping confirmation, etc., you have to monitor the inbox before it deletes.  In other words, you have to know when to expect the email - you must watch for it before it deletes.  Mail auto-deletes after a "few hours." 

For sites, such as Dell.com, they immediately send an order-confirmation, but it might not be for a few days before they send the Shipping confirmation - this makes it hard to monitor.  In these cases, log into the vendor's website (e.g. Dell) and check the shipping-status there.

If anyone knows the account name (the vendor knows!), they can open and act in the inbox.  For expected emails, you can be watching the box and Save (moving to your private box), or Print and delete -- quicker than anyone could discover the account.

If things like SSN's or the credit-card number are exposed in emails, you should use a normal email account.   But for most invoices and confirmations, where your name and address are exposed, along with an invoice and dollar-amount, it is reasonable and safe to use the account. Login and delete the email as soon as you can. 


Some vendors are wise to Mailinator and block the domain on their intake forms.  Mailinator has alternate domains, all going to Mailinator's same address.  For example,
@suremail.info,
@zippymail.info

These 'alternate' domains are not published.  Mailinator's author wrote an interesting blog post about alternate domains.)







Guerilla Mail
Recommended

www.guerrillamail.com

  • Anonymous setup required (to create the email address)
    Setup one-time, use the address as often as needed
    or invent a new address each time - it really doesn't matter
  • (No login to setup)
  • Free
  • No advertising
  • Send or receive email 
  • Sent email is semi-anonymous (IP Address tracked)
  • Supports Attachments
  • There is a nice Android app for those times when not near a computer.

To Use:
1.  Open a browser to www.guerrillamail.com



2.  Select a domain, such as SharkLasers, Pokemail.net (or the impossible-to-spell guerrillamail.com) -- all are aliases for guerrillamail.com.  Click "forget me" to reset the address.

3.  Click the alias field (illustrated as asdfasdf), type a memorable name of your choosing.  Click "Set".

This is your key to the mail-box.  Make it a long, multi-word phrase.  Do not use common words like "Reservations" or "Shipping".  Consider a name like "RobertSmith-Invoices2018".  Or, if you have no intention of ever reading the email or just don't care about the email, use "jsmith" or "invoice".

Jot this name down or take a screen shot.  You must have it to retrieve the emails

4.  Copy the scrambled address.  This is the one you give vendors. As illustrated,

The Scrambled-address is that same alias-key name as above, but it is long and complicated and cannot be easily-converted back to the original account's name.  It is re-create-able and generates with the alias-name.  Guerrillamail may change how they generate the scramble, but both the original and new scramble will work to the same address.

9kbf7z+91t1zt2gufyfc@sharklasers.com   :Give to Vendor
asdfasdf@sharklasers.com               :Your alias/access key


Do not give away the account's alias-address (asdfasdf@sharklasers.com) because you are giving them the rights to the inbox-- the address will be discarded on the webclient (but oddly, arrives on the Android client -- I think this is a bug).  Plus, you would be giving them rights to see the inbox!  No matter how ugly, vendors get the scrambled email address.

Similar to mailinator, no password is needed to view the emails.  If you know the (alias), you have the inbox. 

No Risk - Try now:
Open the browser to www.guerrillamail.com
Click 'forget-me' and type a username you will remember.
Copy to-clipboard the generated address.  Re-use this address as often and as long-as needed.
If you want (to prove how this works), close your browser.
From your regular client, send an email to the long address.
Re-open www.guerrillamail.com; "forget me", type the alias address and view the inbound email.

Drawbacks:
You must 'setup' the email address before using -- e.g. you need to get the scrambled address.
Account setup is easy, but requires a PC or Android app.  This is anonymous; no login to setup.
The Android app is handy when you need to give out the email when not at your computer.

External email addresses are long and complicated; the only real way to use is to copy to clipboard.  Sadly, external email address cannot be changed to a more readable format.  On the plus side, the scrambled address will always resolve back to your alias account.  Guerrillamail often changes how your alias is scrambled, but the old scrambles still work. 

Similar to mailinator, you must monitor the account for inbound emails.
Mail is religiously deleted after 1 hour; shorter than mailinator.

The Guerrillamail domain is harder to spell than mailinator.  Use one of the other default domains, such as sharklasers.com or pokemail.net.  All resolve to the same location.

Inbound emails are visible for one hour, then auto-delete.  This is a problem if a shipping notice or other confirmation is sent the next day, but with most vendors, you can go to their website to see the transaction, so all is not lost.  If you happen to see the subsequent email, you can forward to your real address.

I have had (undefined) troubles using this site with Google's Chrome browser.

Benefits over Mailinator:

Guerrillamail has an Android app can notify you if an email arrives (but notifications do not always happen; seems somewhat buggy for notifications - but works well for all other tasks -- mainly holding your address(es) in a convenient list).

Outbound emails are immediately sent, and once sent, are not visible from the web-client.

Attachments, up to 150mb, are handled well.

For outbound, composed email, they are semi-anonymous -- tracking only your IP address.  Since most people's IP address is transitory, this offers reasonable and superficial protection from the recipient getting your real contact information.  However, your ISP can divulge your account.

Outbound emails will only send to one address at-a-time; no CC, or BCC.  And there is a horribly-difficult captcha test to pass, proving you are not a robot.  It seems to take three attempts to navigate.

Summary:

Choosing a favorite between Guerillamail and Mailinator is hard.  They are both good and both are different.  If I knew a PDF attachment was going to arrive, or if I was unsure, chose Guerillamail (sharklasers).  If it is just some stupid email required for a login or registration screen, and you will never deal with this vendor again, use mailinator.


More on Junk Email Accounts
Consider creating a free junk email account (I use Yahoo), where you give this address to all non-personal, non-professional contacts.  Email arriving here is from a vendor and the email is not fully-trusted and likely not important or critical but may contain invoices, shipping details, confirmations, etc., and are personal enough to guard from prying eyes.

But there is a limit to how many of these accounts one is willing to create.  Building the accounts, remembering credentials, and cleaning out inboxes, all take time.  For me, even one box is busy enough to where I loath all the cleanup.  For these reasons, I no longer consider these types of accounts as disposable.

Google+Email accounts
Google's gmail supports ad-hoc email accounts.  When giving out your gmail address, append a "+" (plus) and some text, making a new, unique address.  For example:

jsmith+someName@gmail.com

The email will arrive at your normal inbox (jsmith), as if it were sent to your real account.

This is not a disposable account, nor is the account secretive or anonymous.  The vendor can continue to send emails to the +address and you cannot block or disband the address.  The only benefit of this address is you could tell if "some-name" sold your email to another. Vendors know if there is a + in the address, they can strip the appendage and get the real destination.


Discussions on the morality of disposable accounts:
 

Many sites hate disposable email addresses.
Vendors want legitimate contact information, while most of us
want to restrict our addresses because we have been abused.

I argue that disposable accounts are no different than a junk mail account -- they are as legitimate of an address as any -- it is just that I get to chose when to look and am willing to accept lost spam that never gets my review.  I will look when needed.  Otherwise, I can appreciate their ephemeral and self-cleaning nature.

A heated discussion on this can be found at this link:  https://gist.github.com/nocturnalgeek/1b8fa44283314544c487  see the comment section for the back-and-forth



 
Other Services, not yet reviewed by keyliner.
Hide Your Email
Hide-your-email.com
pidmail.com
No signup required; no setup
To build an account, make-up an address, tacking on @pidmail.com
You can reserve an address at no cost

TrashMail.com
Requires registration and setup
This is not an on-the-fly email service
Create a new email account from provided domains
Trashmail will forward to your regular email account
Site has an address-manager to keep track of all of your made-up addresses
It will keep the email for a life-span determined by you
Has a limitation on how many "Forwards" are allowed; pay for extra capacity

Related Articles:
Better, stronger and easier passwords

Edit history: 
2017.12  Originally published
2018.05  Re-wrote and re-designed article, moving more important points higher in the article.

Sunday, January 14, 2018

Wolfhouse Wiring Closet

For fun:  I got tired of the tangle of wires in the bedroom closet, where all the networking gear lives.  Built a peg-board-door to hold the equipment.  Power and wire-runs hide behind the hinged door.  Equipment mounted with velcro.


Note the Raspberry Pi "Pi-Hole," the newest edition to the network.

This entire setup is protected with an APC cs350 UPS.  See this keyliner article:
https://keyliner.blogspot.com/2010/04/ups-battery-replacement.html



Related Articles:
Network-wide blocking of ads and Tracking Cookies with a Raspberry Pi
Western Digital My Cloud - Review
Zycel CL11000 DSL Modem Setup
Wireless Router Setup