places, people & stuffs

Chrome hidden feature continue...

2009-01-30T15:24:00.000-08:00

Interesting hidden eggs

Chrome has a few hidden functions; to check them out, type the following in the address bar of Chrome.
1. about:memory-shows the memory usage vis-à-vis other open browsers of the system and also the break-up of all the tab windows.
2. about:stats-shows complete stats of various parameters that Chrome is dependent on.
3. about:internets-starts a screensaver of 3D Pipes (doesn't work in Vista as the Pipes screensaver was available in XP only)
4. about:dns-shows the DNS listing of sites visited and used for pre-fetching.
5. about:plugins-lists all the installed and supported plugins.
6. about:network-shows the network activity that is going on for I/O requests, etc.

hidden configuration for Chrome

2009-01-30T15:22:00.000-08:00

http://www.blogsdna.com/828/seven-hidden-configuration-pages-of-google-chrome-browser.htm

job and career

2008-01-17T23:38:00.000-08:00

I just realized "job" is a bigger word than "career"

攝影家手札論壇

2007-12-21T13:16:00.000-08:00

http://www.photosharp.com.tw/photosharp/

攝影技巧入門

2007-12-21T13:14:00.000-08:00

http://www.lib.ncu.edu.tw/~hong/atmhmpg/fotog/fotog2.htm

瞭解景深

2007-12-21T13:08:00.000-08:00

http://jhchen62.vbird.org/photo/camera_dep.htm

瞭解景深，在攝影裡是一個重要的基礎

　　一般提到景深時，或多或少都會提到光圈值與景深的相互關係，而光圈值在一般常提及的有1.4, 2, 2.8, 4, 5.6, 8, 11, 16, 22, 32, 45, 64不等

　　請注意到：

光圈：指鏡頭裡葉片開闔的大小
光圈值：以數值來表光圈的開啟大小

　　而光圈開啟愈大，則光圈值的數字愈小，請參見光圈一文，所以我們可以知道，光圈值愈小，則鏡頭裡的光圈葉片開啟得愈大，而進光量也愈多(即曝光量大)，了解了光圈與光圈值的相互關係，我們便要來提一提光圈與景深的關係了

　　一般提到景深時，我們會以深與淺來評斷；

景深較淺，表示在對焦點的前後，看到的東西會比較模糊
景深較深，表示在對焦點的前後，看到的東西會比較清楚

景深效果

2007-12-21T13:05:00.000-08:00

我們很難單從字面上了去瞭解景深的含義，我覺得『模糊圈』這個概念或可稍微表達。在這裡我們也必須接收一個觀念，CCD成像是由無數個光點所組成，但鏡頭所產生的投射影像並非是一個點，而是一整個圓圈，而這個圓圈的直徑是可以測量的。真實世界是立體呈現，但在相片上卻是 2D 平面，有時『模糊圈』會區隔中央產生前後一致的模糊景深效果，我們也稱之為『前』、『後』景深的表現。

一般來說在一張照片上，景深的大小取決於三個方面：

鏡頭的焦距：使用鏡頭的焦距越短，景深越大；反之，景深越小。
光圈的大小：光圈越小，景深越大；反之，景深越小。
相機到主體的距離：相機離被攝體越遠，景深就越大；反之，景深就越小。

我們先不要談論複雜的變焦鏡頭，以簡單的『定焦』50mm鏡頭來說，當聚焦在一定距離時，景深與光團大小直接有關；許多人像攝影師偏愛大光圈所產生的散景效果，其來有自；一般的商品攝影，則習慣縮小光圈達到前後景深寬廣的目的。儘管，對任何鏡頭來說，都有某種最佳光圈，例如：多數的鏡頭在 F8 光圈下擁有極佳的影像表現，但比此光圈更小的光圈值，例如：F22，儘管能產生更大的景深，但從藝術的效果來看，將是使影像的清晰度降低而不是提高。

長短焦距的交互運用

相較於『定焦』鏡頭，『變焦鏡頭』可以幫助你快速的調動遠近，或者可以說迅速掌握廣角和特寫鏡頭。雖然，構造上此一鏡頭有變形的問題，但現代科技已經大幅簡單此一缺陷。大部份的專業級數位相機都具有 PSAM 手動模式，而最適合景深攝影者使用的莫過於光圈先決模式了！此模式的優點是能夠直接控制景深，部分相機例如：PENTAX *istD*系列附帶有景深預測按鈕，允許使用者預先判斷景物在最後照片上的清晰範圍。如果你想要拍攝景深照片，按上述的三種鏡頭方法＋機體景深預觀，在攝影上就可以產生十分精確的效果。

http://www.digital.idv.tw/DIGITAL/newuser/Skill/BasicSkill10/BasicSkill-2.htm

2007-11-30T15:32:00.000-08:00

difficult and challenge are not equal.
Challenge has favors of excitement, motivation, sexy, eager and passion.
difficult, however, sometimes, just a matter of times.
Be aware of this on the career path.

10 slides

2007-10-04T16:32:00.001-07:00

Problem
Your solution
Business model
Underlying magic/technology
Marketing and sales
Competition
Team
Projections and milestones
Status and timeline
Summary and call to action

2 paths

2007-07-24T15:58:00.000-07:00

If you want an average successful life, it doesn’t take much planning. Just stay out of trouble, go to school, and apply for jobs you might like. But if you want something extraordinary, you have two paths:
1. Become the best at one specific thing.2. Become very good (top 25%) at two or more things.

2007-01-23T15:28:00.000-08:00

2007-01-23T15:27:00.000-08:00

2007-01-23T15:25:00.002-08:00

2007-01-23T15:25:00.001-08:00

garden at 5th floor

2007-01-23T15:25:00.000-08:00

2007-01-23T15:22:00.001-08:00

grill station

2007-01-23T15:22:00.000-08:00

2007-01-23T15:21:00.000-08:00

2007-01-23T15:20:00.000-08:00

2007-01-23T15:19:00.000-08:00

2007-01-23T15:18:00.000-08:00

Breakfast

2007-01-23T15:17:00.000-08:00

Breakfast

2007-01-23T15:16:00.000-08:00

Jan 2007 Singapore Grand Hyatt Orchard

2007-01-23T15:15:00.000-08:00

Taipei street NOV 2006

2006-11-07T15:31:00.000-08:00

Beijing OCT 2006

2006-11-07T15:24:00.000-08:00

Beijing OCT 2006

2006-11-07T15:23:00.000-08:00

Taipei NOV 2006

2006-11-07T15:22:00.000-08:00

Taipei NOV 2006

2006-11-07T15:20:00.000-08:00

Taipei street NOV 2006

2006-11-07T15:19:00.000-08:00

Taipei street NOV 2006

2006-11-07T15:18:00.000-08:00

Taipei street NOV 2006

2006-11-07T15:17:00.000-08:00

EAP types

2006-11-01T20:13:00.000-08:00

NAC

2006-09-16T15:58:00.000-07:00

802.1x

2006-09-04T15:16:00.000-07:00

2006-08-22T15:48:00.000-07:00

2006-08-22T15:44:00.000-07:00

my memories are usually blended with smells and voices

2006-06-18T22:09:00.000-07:00

my memories are usually blended with smells and voices;

2001 Stockton, 5am, "Hope floats" soundtrack, driving to work with BurgerKing breakfast;

1999 Hoboken, at Stevens, MSA, leaking gas from stoves and cooking spaghetti; my room is almost empty: a forzen turkey sandwidth, a chair, a small TV and my laptop playing "Pieces of You" album;

2006-05-19T10:29:00.000-07:00

天母鄉村蛋糕

2006-05-19T10:20:00.000-07:00

-- copied from here

我要說的這間已經開業很久了
也是在天母,店面超級小,就算走過去,都不會發覺它是一間蛋糕店
名字...應該是叫鄉村蛋糕吧!!
(拍謝,只知道位置,但是正確地址跟店名...老是沒用力去記)
店面很小,幾乎只能說...就是一個小玄關的大小吧!!
只有賣3種蛋糕
CHEESE CAKE,黑森林跟藍莓蛋糕
黑森林就普普啦!!(大概是因為我對巧克力沒興趣)
CHEESE CAKE就很好吃
還有藍莓蛋糕一定要試試.藍莓旁邊還有灑上椰子細絲
一口吃到嘴裡....有點淡淡的椰子味道及口感,搭配的超正.
正確的地點,上中山北路7段到圓環的地方...會看到7-11,在隔壁一點有間賣羹的麵攤,這個時候腳步就要放的非常慢...因為小小小小小小蛋糕但就在麵攤的旁邊.剛好在隔壁.蛋糕的門,就是鵝黃色的鐵門(印象中)上面掛了小小的招牌.門的大小就跟一般家庭的鐵門一樣.入口處是一個透明的直立式冷藏櫃.老板通常就在做蛋糕前的長桌.....反正,店很小很小很小
希望大家不要不小心就錯過了
也希望我這樣描述的夠清楚

a screenshot away from home~

2006-05-19T10:13:00.000-07:00

A Touch of Love

2006-05-19T09:25:00.000-07:00

-- Article & Image Credit: NASA --

As the Apollo 10 crew walks along a corridor on the way to Launch Complex 39B, mission commander Thomas P. Stafford pats the nose of Snoopy, the mission's mascot, held by Jamye Flowers, astronaut Gordon Coopers' secretary.

The Apollo 10 crew nicknamed the Lunar Module (LM) "Snoopy" and the Command/Service Module (CSM) "Charlie Brown" after characters in the Charles Schulz comic strip "Peanuts."

Launched on May 18, 1969, the Apollo 10 mission was a 'dress rehearsal' for the lunar landing that occurred later that year.

The mission successfully completed the first manned CSM and LM docking and undocking operations in a lunar environment. Apollo 10 orbited the moon 31 times during its eight-day mission and took the LM to within 50,000 feet of the lunar surface, simulating a lunar landing.

After all these historic 'firsts,' the crew also sent the first live color television from space.

Taipei home view

2006-05-18T16:25:00.000-07:00

Taipei home view

2006-05-18T16:24:00.000-07:00

802.1x types

2006-04-18T12:06:00.000-07:00

EAP-MD5 (Message Digest #5)
LEAP (Lightweight EAP)
EAP-TLS (Transport Layer Security)
EAP-TTLS (Tunneled TLS)
PEAP (Protected EAP)
EAP-MSCHAPv2 (Microsoft Challenge Handshake Protocol)
EAP-GTC (Generic Token Card)
EAP-SIM (Subscriber Identity Module)
EAP-AKA (Authentication and Key Agreement)
EAP-FAST (Flexible Authentication via Secure Tunneling)
Wi-Fi Alliance Certification

EAP-MD5 (Message Digest #5)
This EAP type provides one-way client authentication. The server sends the client a random challenge. The client proves its identity by hashing the challenge and its password with MD5. Because a man in the middle could see both the challenge and response, EAP-MD5 is vulnerable to dictionary attack when used over an open medium. Since there is no server authentication, it's also vulnerable to spoofing. Finally, EAP-MD5 cannot deliver keys. As a result, EAP-MD5 may be used over Ethernet but should never be used over a WLAN.

LEAP (Lightweight EAP)
Also known as EAP-Cisco Wireless, this EAP type provides mutual client and server authentication over Cisco WLANs. As with EAP-MD5, a LEAP server sends the client a random challenge, which the client uses to return a hashed password. The authenticated client challenges the server for its password, followed by a key exchange. Because LEAP is a proprietary protocol, it can only be used in corporate WLANs with Cisco APs and Cisco-compatible cards. Like EAP-MD5, LEAP is vulnerable to dictionary attack. Today, many attack tools can be used to crack LEAP-authenticated passwords. New WLANs should therefore avoid LEAP. If your WLAN already uses LEAP, ensure that every client and server uses long random passwords, and upgrade to a stronger EAP type as soon as possible.

EAP-TLS (Transport Layer Security)
This EAP type is generally regarded as the strongest available and the most expensive to deploy. It provides mutual certificate authentication between client and server, using the standard TLS protocol (a descendant of the SSL protocol used to secure most Web transactions.) The server uses TLS to demonstrate that it holds a digital certificate, requesting the same from the client. The client uses its certificate to prove its identity and keying material is exchanged. The TLS tunnel ends once authentication has been completed, but the keys delivered by EAP-TLS can be used to encrypt data with AES, TKIP or WEP. EAP-TLS is a good fit in WLANs where clients already have digital certificates or where high security needs justify investment in a public key infrastructure to manage those certificates.

EAP-TTLS (Tunneled TLS)
This EAP type balances security vs. deployment cost by replacing client-side certificates with legacy password authentication methods like PAP, CHAP and MSCHAPv2. EAP-TTLS requires the server to authenticate itself by certificate and establish a TLS tunnel through which to challenge the client. Even when a cleartext password is returned, the client's response is obscured by the TLS tunnel. To avoid exposing the client's name, EAP-TTLS should be configured to send an "anonymous" identity when 802.1X starts, then send the actual identity through the TLS tunnel. That tunnel ends when authentication is completed and keys are delivered. EAP-TTLS is a good fit for WLANs that wish to reuse legacy user authentication databases (e.g., LDAP, Active Directory) in a secure fashion.

PEAP (Protected EAP)
PEAP is very similar to EAP-TTLS but uses different client authentication protocols. Like EAP-TTLS, PEAP provides mutual authentication, using server certificates, a TLS tunnel and client authentication through that encrypted tunnel. Unlike EAP-TTLS, PEAP requires the client to use another EAP type, like EAP-MSCHAPv2 or EAP-GTC (see below). Although the same user credentials can be used with EAP-TTLS, a PEAP authentication server must be able to parse both EAP and the contained legacy authentication protocols.

Note: It is critical to use the same version of PEAP on clients and servers. PEAPv0/EAP-MSCHAPv2 requires 802.1X supplicant (client) software included in Windows XP SP2 and 2000 SP4. PEAPv1/EAP-GTC requires another 802.1X supplicant, like the one installed with Cisco's Aironet Client Utility. These supplicants are mutually exclusive -- installing a PEAPv1 client replaces any existing PEAPv0 client.

EAP-MSCHAPv2 (Microsoft Challenge Handshake Protocol)
This EAP type can be used inside the TLS tunnel created by Protected EAP. EAP-MSCHAPv2 wraps Microsoft's Challenge Handshake Protocol inside the Extensible Authentication Protocol. It is a good fit for companies that want to reuse Microsoft user credentials and servers (e.g., NT Domain Controllers, Windows Active Directories) for wireless authentication. Similar goals can also be accomplished with EAP-TTLS/MSCHAPv2.

EAP-GTC (Generic Token Card)
This EAP type can be used inside the TLS tunnel created by Protected EAP. EAP-GTC defines an EAP envelope to carry "one time passwords" generated by token cards like RSA SecurID. It is a good fit for companies that use two-factor authentication to avoid common password compromises (e.g., passwords shared with others, written on sticky notes, stored on stolen laptops) – especially where such tokens are already in use by a remote access VPN. Those starting a WLAN from scratch must decide whether token deployment cost is justified.

EAP-SIM (Subscriber Identity Module)
This EAP type provides mutual authentication, based on the SIM card found in cellular telephones sold by GSM carriers. A SIM may be a small chip inserted into in a dual-mode phone, a wireless data card or a USB stick. That smartcard implements the authentication algorithm normally used by cellular handsets to authenticate to GSM telephone networks. 802.1X requests carrying EAP-SIM are relayed through the carrier's roaming gateway to a GSM authentication server. This type can be used to authenticate devices like smartphones that roam between commercial 802.11 hotspots and GSM networks.

EAP-AKA (Authentication and Key Agreement)
EAP-AKA is similar to EAP-SIM, but meets the needs of non-GSM carriers by using the User Service Identity Module (USIM) employed by Universal Mobile Telecommunications System (UMTS) networks. Although your carrier's network determines which type your smartphone must use, the permanent authentication keys used by EAP-AKA are considered stronger than the derived authentication keys used by EAP-SIM.

EAP-FAST (Flexible Authentication via Secure Tunneling)
This EAP type was created by Cisco as a replacement for LEAP; it is available today in some Cisco APs and Cisco-compatible wireless cards. Like PEAP and EAP-TTLS, FAST provides tunneled mutual authentication. However, EAP-FAST does not require the server to authenticate itself with a digital certificate. Instead, a one-time provisioning exchange establishes a shared secret, called a Protected Access Credential (PAC) Key. That PAC Key is used for all subsequent authentications. EAP-FAST caters to small footprint clients, like VoWiFi handsets, that would be noticeably slowed by digital certificate signature verification. Currently, EAP-FAST is limited to use in Cisco-based WLANs.

EAP-FAST: phases, Marketing vs. reality

2006-04-18T12:02:00.000-07:00

< copied from Author: George C. Ou, Network and Information Systems Architect>

Introducing EAP-FAST
With the threat of ASLEAP looming, Cisco created their new EAP-FAST protocol and submitted it to the IETF. EAP-FAST as proclaimed by Cisco marketing would be “as secure as PEAP” and “as easy as LEAP”! EAP-FAST achieves this by creating the same secure encrypted tunnel used to protect user credentials during the authentication session as PEAP without the need for any kind of PKI on the client end or even the server end. Naturally, I immediately became skeptical of that claim anytime someone starts talking about secure key exchanges without the use of PKI. Of course there are other ways such as secret key cryptography of achieving a secure key exchange without PKI, but none are ever as elegant or as easy to deploy in large scale. Will EAP-FAST be the exception? Read on and see for yourself.

EAP-FAST phases
EAP-FAST under normal operation is just like PEAP and has two phases. Phase 1 sets up a secure encrypted tunnel and Phase 2 is a MS-CHAPv2 session that verifies the client to the authentication server. Since MS-CHAPv2 is widely known to be very weak against dictionary attacks, the encrypted tunnels established in Phase 1 provides a safe environment for the MS-CHAPv2 session. The difference is that EAP-FAST uses a PAC (Protected Access Credentials) shared secret to set up the tunnel where as PEAP uses the server side digital certificate to set up a TLS tunnel (similar to how secure web servers work). A unique user specific PAC file is generated from a single EAP-FAST Master Key on the authentication server for each and every user. Distributing the PAC can be achieved by an optional “Phase 0” (AKA automatic provisioning) or by other out-of-band methods such as sneaker net, protected admin-only file share, or user specific restricted directory.

Marketing vs. reality
After carefully reading through the IETF draft of the EAP-FAST protocol submitted by Cisco, it became fairly obvious that Cisco’s marketing claims were not entirely accurate. Although it was technically true that EAP-FAST “could” be as secure as PEAP and it “could” be as easy as LEAP, Cisco’s marketing left out the fine print and omitted the fact that you just couldn’t have both at the same time.

The fact of the matter is, in order for EAP-FAST to truly be as secure as PEAP, it would have to run in “server-side authentication Diffie-Hellman mode” in “Phase 0” which ironically requires a server side Digital Certificate. As you recall, the very need for a server side Digital Certificate was the very thing that scared people away from PEAP in the first place. Cisco says that you could resort to other “out-of-band” methods of PAC provisioning which doesn’t require a server side certificate but the practicality of manual PAC provisioning is rather dubious. The EAP-FAST PAC refresh mechanism on the other hand does automatically provision keys in a secure manner but it can only be used to maintain the PAC but does not address the need for initial PAC provisioning.

In order to be as easy as LEAP, EAP-FAST had to run “Phase 0” in anonymous Diffie-Hellman mode. An anonymous Diffie-Hellman key exchange by definition means that you can’t verify who is on the other end. In this case, a hacker can pose as your access-point and authentication server in Phase 0 and wait for an unsuspecting user to connect at phase 0 and wait for the clear text username and the hashed passwords. Since the server is obviously a fake, it would fail the server challenge and phase 0 would be aborted by the client. However, enough of the MS-CHAPv2 session has been captured to perform an offline ASLEAP attack. If the user’s password is not extremely complex which is usually the case, then game over and the hacker gains both user credentials and access to your wireless LAN. According to the EAP-FAST IETF draft paper, if such a man in the middle exploit is attempted, the user is to immediately change their password. However, I couldn’t determine from the draft or anywhere on Cisco’s website if the EAP-FAST client will automatically warn the user and administrator or force the password change but I doubt it. In all fairness, running EAP-FAST with this convenient but weak form of automatic PAC provisioning is still significantly more secure than running LEAP for two reasons. First, PAC provisioning is only done once to set up the PAC secret between the server and client and all subsequent EAP-FAST sessions skip “Phase 0”. LEAP on the other hand is vulnerable each and every time a user authenticates with the radius server during the wireless LAN authentication. Second, even during a phase 0 anonymous DH session, the attack must be active which exposes the hacker to detection and is significantly more risky. A LEAP attacker on the other hand can perform the exploit with virtual impunity. Even though this is a significant improvement over LEAP, EAP-FAST can never be as secure as EAP-TLS, EAP-TTLS, or PEAP while running in this mode.

The one thing that EAP-FAST does deliver on is speed of the actual authentication session because it uses symmetric cryptography instead of the asymmetric cryptography that EAP-TLS, EAP-TTLS, or PEAP uses. However, this is pretty much a moot point in my experience because I have tried PEAP authentication on 266 MHz PDA devices which is just about the slowest platform you would run EAP on and I can't see any significant delays with running PEAP. I really doubt you will ever miss a few milliseconds on your notebook when authenticating with PEAP for wireless LAN access. Speed in deployment is what I’m concerned about, and we shall see in the next section if EAP-FAST passes or fails in the speed that counts department.

view from hotel room, the wall

2006-03-30T13:46:00.000-08:00

Vancouver library square

2006-03-30T13:45:00.000-08:00

view to the library, from hotel room

2006-03-30T13:44:00.001-08:00

Vancouver

2006-03-30T13:44:00.000-08:00

the frozen creek, Whistler

2006-03-30T13:42:00.000-08:00

view to the Vancouver city

2006-03-30T13:41:00.001-08:00

view to the Vancouver city

2006-03-30T13:41:00.000-08:00

view to the Vancouver city

2006-03-30T13:40:00.000-08:00

view to the Vancouver city

2006-03-30T13:39:00.000-08:00

city view

2006-03-30T12:26:00.001-08:00

Public Market view to the city

2006-03-30T12:26:00.000-08:00

2006-03-30T12:15:00.000-08:00

Public Market

Public Market Granville Isaland

2006-03-30T12:09:00.000-08:00

PKI

2006-03-07T11:42:00.000-08:00

Public Key Infrastructure (PKI) offers a scalable method to secure networks, reduce management overhead, and simplify the deployment of network infrastructures by enabling Cisco IOS Security features , including Cisco IOS IPsec, Secure Shell (SSH), Secure Socket Layer (SSL) , and Cisco IOS Firewall . Cisco IOS Software can also use PKI for authorization via access lists and authentication resources. Additional features build upon the value-added proposition of Cisco IOS Software to simplify the provisioning and management of Cisco IOS Security technologies.

PKI manages encryption keys and identity information for the human and mechanical components of a network, which participate in secured communications. Any network, from small business networks to the core systems of the world's largest service provider networks, can benefit the enhanced security in Cisco IOS Software.

NAC

2006-03-06T23:02:00.000-08:00

NAC

802.1X

2006-03-06T22:55:00.000-08:00

The use of IEEE 802.1X offers an effective framework for authenticating and controlling user traffic to a protected network, as well as dynamically varying encryption keys. 802.1X ties a protocol called EAP (Extensible Authentication Protocol) to both the wired and wireless LAN media and supports multiple authentication methods, such as token cards, Kerberos, one-time passwords, certificates, and public key authentication. For details on EAP specifically, refer to IETF's RFC 2284.

Initial 802.1X communications begins with an unauthenticated supplicant (i.e., client device) attempting to connect with an authenticator (i.e., 802.11 access point). The access point responds by enabling a port for passing only EAP packets from the client to an authentication server located on the wired side of the access point. The access point blocks all other traffic, such as HTTP, DHCP, and POP3 packets, until the access point can verify the client's identity using an authentication server (e.g., RADIUS). Once authenticated, the access point opens the client's port for other types of traffic.

To get a better idea of how 802.1X operates, the following are specific interactions that take place among the various 802.1X elements:

1. The client sends an EAP-start message. This begins a series of message exchanges to authenticate the client; think of this as a group of visitors entering the front gate of a theme park and the group's leader (i.e., client) asking the gatekeeper (i.e., access point) whether they can enter.

2. The access point replies with an EAP-request identity message. In the case of the theme park, the gatekeeper will ask the leader for their name and drivers license.

3. The client sends an EAP-response packet containing the identity to the authentication server. The leader in our example will provide their name and drivers license, and the gatekeeper forwards this information to the group tour manager (i.e., authentication server) who determines whether the group has rights to enter the park.

4. The authentication server uses a specific authentication algorithm to verify the client's identity. This could be through the use of digital certificates or other EAP authentication type. In the case of our example, this process simply involves verifying the validity of the leader's drivers' license and ensuring that the picture on the license matches the leader. In our example, we'll assume the leader is authorized.

5. The authentication server will either send an accept or reject message to the access point. So the group tour manager at the theme park tells the gatekeeper to let the group enter.

6. The access point sends an EAP-success packet (or reject packet) to the client. The gatekeeper informs the leader that the group can enter the park. Of course the gatekeeper would not let the group in if the group tour manager had rejected the group's admittance.

7. If the authentication server accepts the client, then the access point will transition the client's port to an authorized state and forward additional traffic. This is similar to the gatekeeper automatically opening the gate to let in only people belonging to the group cleared for entry.

The basic 802.1X protocol provides effective authentication regardless of whether you implement 802.11 WEP keys or no encryption at all. Most of major wireless LAN vendors, however, are offering proprietary versions of dynamic key management using 802.1X as a delivery mechanism. If configured to implement dynamic key exchange, the 802.1X authentication server can return session keys to the access point along with the accept message. The access point uses the session keys to build, sign and encrypt an EAP key message that is sent to the client immediately after sending the success message. The client can then use contents of the key message to define applicable encryption keys. In typical 802.1X implementations, the client can automatically change encryption keys as often as necessary to minimize the possibility of eavesdroppers having enough time to crack the key in current use.

It's important to note that 802.1X doesn't provide the actual authentication mechanisms. When utilizing 802.1X, you need to choose an EAP type, such as Transport Layer Security (EAP-TLS) or EAP Tunneled Transport Layer Security (EAP-TTLS), which defines how the authentication takes place. There are many EAP types, so we'll leave details on EAP types to a future tutorial.

The important part to know at this point is that the software supporting the specific EAP type resides on the authentication server and within the operating system or application software on the client devices. The access point acts as a "pass through" for 802.1X messages, which means that you can specify any EAP type without needing to upgrade an 802.1X-compliant access point. As a result, you can update the EAP authentication type as newer types become available and your requirements for security change.

Images of Wendy's Cooking Album -8

2006-02-27T11:24:00.000-08:00

Webshots - Images of Wendy's Cooking Album -8

Taiwanese Food

2006-02-27T11:17:00.000-08:00

Taiwanese Food

Taiwan

2006-02-27T11:14:00.000-08:00

Taiwan

Point Reyes, CA Feb 25 2006

2006-02-26T09:57:00.000-08:00

2006-01-13T15:35:00.000-08:00

2006-01-13T15:32:00.000-08:00

sleeping Elmo :)

2005-12-31T17:30:00.000-08:00

books I have been reading recently

2005-12-31T17:03:00.000-08:00

my memories of music, at the time

2005-12-28T20:43:00.000-08:00

my memories of some times associate with either music or flavor, sometimes both:

1999, Stevens, Pieces of You, Jewel, spaghetti cooking in my dorm room.
2001, Stockton, Hope Floats, breakfast from BurgerKing, around 5:30am.

on my way home from XNA, Bentonville, AR

2005-11-17T09:42:00.000-08:00

WMM & WME?

2005-09-27T11:21:00.000-07:00

Where Is Wi-Fi QoS? ( http://www.netstumbler.com/2004/11/23/where_is_wi_fi_qos)

At the Internet Telephony show in Los Angeles last month, it was fitting that the subject of QoS came up often. During the Wi-Fi conference track, someone joked that the IEEE 802.11e QoS standard “has been six to nine months away - for five to six years.”

Indeed, mid-2005 is now the expected time frame for full 802.11e approval.

However, last month, the Wi-Fi Alliance did begin taking action, by launching a programme it had announced back in May. Just as it did when the sorely needed 802.11i security standard was a while in coming, it began certifying product interoperability among the completed components of the standard so that the industry could begin benefiting from some of the advancements

In the case of QoS, it is the packet-prioritisation portion - dubbed Wi-Fi Multimedia, or WMM, by the alliance - which is ready for prime time.

Don't be confused, but WMM is the Wi-Fi Alliance's brand for a part of the 802.11e (the part that is "ready") called WME. This is a basic classification and prioritisation scheme, designed by data networking players. The other half of 802.11e is a more sophisticated scheme from voice equipment manufacturers. Read Quality of Service over WLANs , and WLANs need quality for Voice.

Not many products are certified
At this juncture, the only WLAN system to be WMM-certified is Cisco’s Aironet 1200 802.11a/g AP; other certified products are system components, such as Wi-Fi chips and software. However, many Wi-Fi vendors (including Cisco) already support the long-proven Spectralink Voice Priority (SVP) scheme in their APs.

The availability of the WMM capability could allow does makers of consumer-electronics devices such as DVD players and televisions to prioritise types of traffic travelling over Wi-Fi links between their devices.

In addition, AP makers that have not implemented SVP could implement WMM for prioritisation. For voice applications, their customers might still require Spectralink’s SVP server or NetLink Telephony Gateway in their configurations for admission control until the full 802.11e standard, which includes scheduled RF media access and possibly bandwidth provisioning, is implemented.

SVP still has a role
The role of SVP on the wired side is to coordinate the timing of voice calls when sending voice packets to and from an AP. Packets flow isochronously upstream and downstream to eliminate the possibility that traffic will collide.
WMM differs from SVP in that it works across different applications, not just voice. It is based on the IP Differentiated Services model without incurring IP’s overhead, and supports four priority levels.

The priority buckets default to voice as highest, then video, then best effort, then background. The background class, for example, might get print traffic and file downloads. You can, however, customise the settings to suit your own priorities.

Original URL: http://www.techworld.com/mobility/features/inde...
Content Copyright ? Original Author

2005-08-08T17:20:00.000-07:00

fsdfsd
Originally uploaded by grackle.

Nice green photo.

From Toyko somewhere

2005-08-08T16:00:00.001-07:00

From Toyko somewhere
Originally uploaded by chenricky.

A sign says the phone signal is good indoor. Took it in Tokyo somwwhere.

books I have been reading recently

2005-08-08T16:00:00.000-07:00

books I have been reading recently
Originally uploaded by chenricky.

The one on top is my favorite; Read it so many times but still learn

something new everytime.

2005-08-07T18:32:00.001-07:00

morning

2005-08-07T18:32:00.000-07:00

camp site

2005-08-07T18:30:00.000-07:00

Big Basin

ACS configuration guide

2005-08-07T17:58:00.000-07:00

ACS Config link

2005-06-05T09:38:00.000-07:00

Sausalito, CA ~ rock on rock, no glue ~

2005-06-05T09:37:00.000-07:00

Sausalito, CA ~ the guy making the rock on rock ~

2005-06-05T09:36:00.000-07:00

Sausalito, CA

2005-06-05T09:35:00.000-07:00

Sausalito, CA ~ the rocks without glue ~

2005-06-05T09:34:00.001-07:00

Sausalito, CA

2005-06-05T09:34:00.000-07:00

Sausalito, CA

2005-06-05T09:33:00.000-07:00

Sausalito, CA

2005-06-05T09:32:00.000-07:00

Sausalito, CA

2005-06-05T09:29:00.000-07:00

China Camp

2005-06-05T09:27:00.000-07:00

China Camp

2005-06-05T09:26:00.000-07:00

China Camp

2005-06-05T09:25:00.001-07:00

China Camp

2005-06-05T09:25:00.000-07:00

China Camp

2005-05-21T10:05:00.001-07:00

bay

2005-05-21T10:05:00.000-07:00

bay

2005-05-21T10:04:00.002-07:00

bay

2005-05-21T10:04:00.001-07:00

bay

2005-05-21T10:04:00.000-07:00

bay

2005-05-21T10:03:00.001-07:00

bay

2005-05-21T10:03:00.000-07:00

bay

places, people & stuffs

Chrome hidden feature continue...

hidden configuration for Chrome

job and career

攝影家手札論壇

攝影技巧入門

瞭解景深

景深效果

長短焦距的交互運用

10 slides

2 paths

garden at 5th floor

grill station

Breakfast

Breakfast

Jan 2007 Singapore Grand Hyatt Orchard

Taipei street NOV 2006

Beijing OCT 2006

Beijing OCT 2006

Taipei NOV 2006

Taipei NOV 2006

Taipei street NOV 2006

Taipei street NOV 2006

Taipei street NOV 2006

EAP types

NAC

802.1x

my memories are usually blended with smells and voices

天母 鄉村蛋糕

a screenshot away from home~

A Touch of Love

Taipei home view

Taipei home view

802.1x types

EAP-FAST: phases, Marketing vs. reality

view from hotel room, the wall

Vancouver library square

view to the library, from hotel room

Vancouver

the frozen creek, Whistler

view to the Vancouver city

view to the Vancouver city

view to the Vancouver city

view to the Vancouver city

city view

Public Market view to the city

Public Market Granville Isaland

PKI

NAC

802.1X

Images of Wendy's Cooking Album -8

Taiwanese Food

Taiwan

Point Reyes, CA Feb 25 2006

sleeping Elmo :)

books I have been reading recently

my memories of music, at the time

on my way home from XNA, Bentonville, AR

WMM & WME?

From Toyko somewhere

books I have been reading recently

ACS configuration guide

天母鄉村蛋糕