TidBITS#503/25-Oct-99
=====================

  Saturday's release of Mac OS 9 dictates the tone for this issue,
  with in-depth coverage of Apple's latest version of the Mac OS.
  Geoff Duncan first looks at Mac OS 9 installation and
  compatibility issues and then focuses on three major features in
  Mac OS 9: Sherlock 2, Multiple Users, and the Keychain. Tune in
  next week for more Mac OS 9 coverage. Also this week, we cover the
  releases of Action Menus 1.0, Microsoft Outlook Express 5.0, and
  iDo Script Scheduler 1.1.

Topics:
    MailBITS/25-Oct-99
    Mac OS 9 Installation & Compatibility
    Major Features in Mac OS 9

<http://www.tidbits.com/tb-issues/TidBITS-503.html>
<ftp://ftp.tidbits.com/pub/tidbits/issues/1999/TidBITS#503_25-Oct-99.etx>

Copyright 1999 TidBITS Electronic Publishing. All rights reserved.
   Information: <info@tidbits.com> Comments: <editors@tidbits.com>
   ---------------------------------------------------------------

This issue of TidBITS sponsored in part by:
* READERS LIKE YOU! You can help support TidBITS via our voluntary <- NEW!
   contribution program. Special thanks this week to Pierce Flynn,
   Kenneth Workman, and Jeffrey McPheeters for their support!
   <http://www.tidbits.com/about/support/contributors.html>

* APS Technologies -- 800/443-4199 -- <sales@apstech.com> -- How
   do you back up your APS hard disks? Try APS tape, removable,
   magneto-optical, and CD-R drives! <http://www.apstech.com/>

* WinStar Northwest Nexus. Visit us at <http://www.nwnexus.com/>.
   Internet business solutions throughout the Pacific Northwest.

* Small Dog Electronics -- Dayna 8-Port Hub 100Base-T: $25! <-------- NEW!
   Newer 300 MHz G3 w/512K for 44/54/55/64/65/UMAX/StarMax: $299!
   Power Mac G3 Blue/350 64/6 GB/DVD factory refurbished: $1,399!
   For Details: <http://www.smalldog.com/> -- 802/496-7171

* OUTPOST.COM: SAVE YOUR RELATIONSHIP & YOUR MONEY! Troubled by <---- NEW!
   your relationship with your computer? We have the solution:
   Mac OS 9 for only $69.95 after upgrade rebate! Get $20 rebate &
   FREE U.S. shipping! <http://www.tidbits.com/tbp/macos9.html>

* UPDATE your COMPUTER SKILLS for the New Millennium!! Get the <----- NEW!
   computer and software training you need today. CD-ROM, video,
   and live seminar training available. Call 800/527-1914 or visit
   us on the Web at <http://www.macacademy.com/tidbits.html>.

* NEW DRIVER! Farallon's optimized Fast EtherTX-10/100 CardBus <----- NEW!
   Macintosh 2.0 driver improves throughput in G3 PowerBooks up to
   69%! DOWNLOAD the new driver and SAVE TIME!
   <http://www.farallon.com/tidbits/cardbus.html>

* ~ Internet Live Radio ~ TV ~ Weather ~ News ~ Sports ~ Stocks
                  ********************************
                  See anything that interests you?
       Visit The MacAlive Store at <http://www.macalive.com/>

* THE INTERNET'S DISCOUNT MAC SUPERSTORE! --> 999mac.com <----------- NEW!
   Give a friend a $5.00 999software coupon for their first visit.
   TidBITS customers special: Buy 2 Get 1 Free!
   Tons of new products! <http://www.999software.com/mac/tb4.tmpl>
   ---------------------------------------------------------------

MailBITS/25-Oct-99
------------------

**Now Menus Reincarnated as Action Menus** -- Power On Software
  has released Action Menus 1.0, a new component of the company's
  Action Utilities control panel that provides functionality
  equivalent to the defunct Now Menus (see "Living in the Now - Now
  Utilities 5.0, Newer and Better" in TidBITS-248_ and "Now
  Utilities Turns 6-Point-Something" in TidBITS-345_). Action Menus
  makes the Apple menu hierarchical, like Apple Menu Options, and
  you can flexibly rearrange items within the Apple menu. In the
  Applications menu, each application hierarchically displays its
  current windows and recently opened documents. You can also create
  additional custom menus that show recently used applications (with
  their recent documents hierarchically attached), recent documents,
  recent folders (hierarchical), the frontmost application's windows
  and recent documents, current volumes and servers (hierarchical).
  Custom menus accept drag & drop of Finder icons: drag into a menu
  to add an item to the menu, drag into a folder to move or copy an
  item to that folder, and drag onto an application to open the item
  with that application. Custom menus can open, quit, or get info on
  multiple items simultaneously; they can open either an item or its
  containing folder. You can also modify keyboard shortcuts for all
  menu items on the fly. Unfortunately, Action Menus does not
  provide a desktop pop-up menu and is incompatible with Kensington
  MouseWorks' desktop pop-up menu option. Action Menus requires a
  color-capable Mac and System 7.5.3 or later; it's available as a
  30-day demo (2.2 MB download) or for online purchase at $30. [MAN]

<http://www.poweronsw.com/site2/html/products/am.html>
<http://db.tidbits.com/getbits.acgi?tbart=01792>
<http://db.tidbits.com/getbits.acgi?tbart=00875>


**Microsoft Outlook Express 5.0 Ships** -- Microsoft has released
  Outlook Express 5.0, a major upgrade to the company's free
  Internet email and Usenet news client. New features aimed at
  simplifying Outlook Express for novice users include an Account
  setup wizard, improved attachment handling, interface changes,
  address auto-complete, a Mailing List Manager, and a Junk Mail
  Filter. Microsoft has also added features aimed at heavy email
  users, including custom fields in the Address Book, message
  histories, support for using the Spacebar to scroll through
  messages, enhanced IMAP support, scheduled events, and an Advanced
  Find feature that supports multiple criteria. However, users with
  a great deal of stored mail should be aware that Outlook Express
  5.0 now stores all messages in a single mail database, which makes
  for a single point of failure (make sure to read the Read Me for
  instructions on rebuilding the mail database in case of
  corruption) and forces inefficient backups. Outlook Express also
  includes integration with HotMail for email messages (but not
  contacts) and can synchronize contacts (but not email) with Palm
  devices. Outlook Express 5.0 requires a PowerPC-based Macintosh
  with Mac OS 8.1 or later. The program is a 12.5 MB download. [ACE]

<http://www.microsoft.com/mac/oe/>


**iDo Script Scheduler 1.1** -- Sophisticated Circuits has
  released version 1.1 of its iDo Script Scheduler, a system
  enhancement that enables users to schedule execution of
  AppleScript scripts. iDo Script Scheduler debuted as a free extra
  on the Mac OS 8.6 CD-ROM and on Apple's AppleScript site; it could
  schedule up to three scripts for automatic execution. (See
  "Putting URL Access Scripting to Work" in TidBITS-481_.) Version
  1.1 still offers a free "lite" mode that's compatible with Mac OS
  9's multiple users feature, enabling different users of the same
  Mac to schedule up to three scripts for automatic execution; iDo
  Script Scheduler can also pass arbitrary parameters to scripts
  when it runs them. For $25, you can upgrade version 1.1 to an
  "enhanced" version that allows for an unlimited number of
  scheduled scripts and can execute scripts at system idle time or
  in response to a hot key. The iDo Script Scheduler is a great
  add-on for serious AppleScript users, particularly under Mac OS 9,
  which enables AppleScript scripts to connect to remote file
  servers and applications over the Internet. [GD]

<http://www.sophisticated.com/products/ido/ido_ss.html>
<http://www.apple.com/applescript/>
<http://db.tidbits.com/getbits.acgi?tbart=05396>


**Poll Results: Appeal of Digital Video Editing** -- We're getting
  together this week for a staff lunch of eating our hats, since
  none of us expected that digital video editing would be nearly as
  popular with TidBITS readers as last week's poll indicated. We
  figured you for a 7-bit ASCII kind of crowd, but in fact 55
  percent of respondents claimed they found the iMac DV's digital
  video editing capabilities "very appealing," with another 20
  percent answering "moderately" appealing, and the rest signing on
  to "a little" and to "not at all." TidBITS Talk participants
  foreshadowed the poll results, offering a variety of experiences
  and reasons why digital video editing's time has finally come. The
  proof will be in the video pudding, though, and we'll be watching
  to see how heavily the iMac DVs are actually used for digital
  video editing. [ACE]

<http://db.tidbits.com/getbits.acgi?tlkthrd=814>


**Poll Preview: Mac OS 9 Upgrade Plans** -- You'll read about Mac
  OS 9's major features and compatibility in this issue, and our Mac
  OS 9 coverage will continue next week. The question is, are you an
  early adopter who plans to buy into Mac OS 9's new features and
  $99 price tag now, or are you the cautious sort who plans to wait
  to hear reports from the field? Visit our home page and register
  your opinion! [ACE]

<http://www.tidbits.com/>


Mac OS 9 Installation & Compatibility
-------------------------------------
  by Geoff Duncan <geoff@tidbits.com>

  Apple has released Mac OS 9 with fanfare, billing it as "the best
  Internet OS ever" and touting more than 50 new features. Some of
  these features add significant new capabilities (like file sharing
  over the Internet, encryption, support for multiple users, and
  automatic software updating via the Internet); other features mark
  the return of old ideas (the Keychain password management tool, a
  Sound control panel, and flexible PlainTalk speech recognition);
  and still other features are extensions of previous enhancements,
  like the almost unrecognizable Sherlock 2. Under the hood, Mac OS
  9 makes some fundamental changes that may break some of your
  applications but will also be welcome to anyone pushing the limits
  of what their Macs can do.

<http://www.apple.com/macos/>


**Pricing & Requirements** -- Apple officially began selling Mac
  OS 9 23-Oct-99, so it's available now to U.S. and Canadian
  customers from Apple and virtually all Macintosh software
  retailers for U.S. $99 or less, such as the $70 after-rebate deals
  from TidBITS sponsors Outpost.com and Small Dog Electronics (who
  throw in a pint of Ben & Jerry's ice cream). Apple and those same
  retailers have been accepting pre-orders for months, so if you've
  already purchased Mac OS 9, your copy should arrive shortly. Apple
  says international versions of Mac OS 9 will be available in
  November.

  If you purchased the Mac OS - either on its own or with a new
  computer - after 05-Oct-99, you may be able to upgrade to Mac OS 9
  for $20. Owners of Mac OS 8.5 or 8.6 may qualify for a $20 mail-in
  rebate from Apple; details are inside the Mac OS 9 box.
  Unfortunately, both these offers are available only to U.S.
  customers.

<http://www.apple.com/macos/uptodate/>

  Mac OS 9 requires a Macintosh with a PowerPC processor, at least
  32 MB of physical RAM (though 48 to 64 MB of RAM is a more
  reasonable minimum), and 150 to 400 MB of free disk space
  depending on selected options. Apple has not certified Mac OS 9
  for use with Macintosh clone systems or on systems using third-
  party processor upgrades, although it may work. Folks with third-
  party processor upgrades should check with the upgrade
  manufacturer before trying to install Mac OS 9.


**Installation** -- Installing Mac OS 9 is self-explanatory, but
  is best done by booting from the Mac OS 9 CD-ROM - installing Mac
  OS 9 while booted from other disks almost always proceeded
  correctly in my tests, but sometimes with unexpected alerts and
  errors. As always, make a _complete_backup_ before attempting to
  install Mac OS 9. If you use third party hard disk formatting
  utilities like La Cie's Silverlining or FWB's Hard Disk Toolkit,
  check to make sure your hard disk drivers are compatible with Mac
  OS 9 before installing.

  In general, Mac OS 9 wants more memory than previous versions.
  Starting up with extensions disabled, Mac OS 9 uses about 18 MB of
  RAM. With reasonable extensions, the system software could balloon
  up to 30 MB with virtual memory turned on; without virtual memory
  it could require as much as 10 MB of additional RAM.

  Apple's Language Kits are included in Mac OS 9; they were sold
  separately for earlier versions of the Mac OS. If you're using one
  of the kits (Arabic, Cyrillic, Japanese, etc.) be sure to perform
  a customized installation of Mac OS 9 that includes the Language
  Kit you were previously using - otherwise it will not be updated.
  Also check the Language Kits CD Extras folder on the Mac OS 9
  CD-ROM for localized versions of SimpleText, fonts, and utilities.


**FCBs & Compatibility** -- Mac OS 9's file systems includes two
  significant under-the-hood enhancements: one allows applications
  to open files larger than 2 GB; the other increases the maximum
  number of open file forks from 348 to 8,169. Opening 348 file
  forks simultaneously might seem unusual, but both the problem and
  the fix turn out to be significant. The limit predates even the
  HFS file system, and it's a problem because a typical Mac has many
  open files you never see: modern applications and versions of the
  Mac OS rely heavily on shared libraries, temporary files, and
  plug-ins - all those items count against the open file limit.
  Plus, we all know people with hundreds of fonts and sounds.

  To allow more open files, Apple had to change the file control
  block (FCB) table the Mac OS uses to track open files. Apple has
  been warning developers not to access the FCBs directly since
  1986, but few developers took Apple seriously because Apple had
  never revised its own code. So long as Apple software depended on
  unapproved methods, developers figured their programs could depend
  on those same methods.

  The resulting situation was a mess, and Apple couldn't find a way
  to increase the number of open files and retain compatibility with
  widely deployed code. So, in Mac OS 9 Apple instead prevents that
  code from running and possibly crashing the system or corrupting
  data. Whenever a program tries to use unsupported methods for
  accessing information about open files, Mac OS 9 shuts down the
  application with an error number 119, and displays a dialog saying
  you need an updated version of that application. It's annoying.

<http://til.info.apple.com/techinfo.nsf/artnum/n60533>

  What's more annoying is that many commonly used applications and
  utilities need updating - I've included a partial list of major
  problems below. Disk tools, file utilities, font management tools,
  and anti-virus software are especially likely to be impacted.
  Alsoft has released a checker that can inspect PowerPC
  applications for compatibility with the Mac OS 9 file system - it
  produces an HTML report you can view in a Web browser. I can't
  vouch for its results, but it could prove useful.

<http://www.alsoft.com/AskAl/askalreport-9comp.html>

* Versions of Adobe's ATM and ATM Deluxe prior to 4.5.2 are
  incompatible with Mac OS 9, and the Mac OS 9 installer
  automatically disables them if present. Versions of Adobe Type
  Reunion prior to 2.5.2 are also incompatible. Adobe has released
  updates to these utilities for use only under Mac OS 9; keep in
  mind that Type 1 fonts still print correctly without ATM and
  current versions of some Adobe applications (such as Acrobat and
  InDesign) no longer require ATM to rasterize PostScript fonts on
  screen.

<http://www.adobe.com/support/downloads/>

* New versions of StuffIt Deluxe and the StuffIt Engine compatible
  with Mac OS 9 ship on the Mac OS 9 CD-ROM - be sure you install
  the Internet Utilities. StuffIt Deluxe and components of Private
  File are not compatible with Mac OS 9; Aladdin expects to ship an
  update to StuffIt Deluxe soon.

<http://www.aladdinsys.com/faqs/macos9.html>

* RAM Doubler 8 is reportedly incompatible with Mac OS 9;
  Connectix expects to have an update available in Jan-00.

* Drivers for several Hewlett-Packard DeskWriter and DeskJet
  printers are incompatible with Mac OS 9; HP says it will update
  its drivers for compatibility.

<http://www.hp.com/cposupport/printers/support_doc/bpm06276.html>

* AppleWorks must be updated to version 5.0.4 to work with Mac OS
  9; an updater is on the Mac OS 9 CD-ROM.

* Netscape's TalkBack Quality Feedback Agent - which might be
  present with Netscape Communicator 4.5 or later - is incompatible
  with Mac OS 9. You can remove the TalkBack folder from
  Communicator's folder.

* If you use MacsBug, Apple's low-level debugger, you'll need to
  obtain version 6.6f2c1 for use under Mac OS 9.

<http://developer.apple.com/tools/debuggers/MacsBug/>
<http://db.tidbits.com/getbits.acgi?tbser=1057>

  As always, there may be additional compatibility problems related
  to upgrading to Mac OS 9, particularly if you haven't been staying
  up to date on all of your software. Until you've become
  comfortable with the stability of Mac OS 9 for your particular
  uses, save often and back up religiously.


Major Features in Mac OS 9
--------------------------
  by Geoff Duncan <geoff@tidbits.com>

  Although Apple claims there are 50 new features in Mac OS 9, most
  people are likely to care about only a few. The question is: do
  Mac OS 9's new features make it compelling for _you_? This article
  takes quick looks at some major features in Mac OS 9, and next
  week we'll look at additional features, more subtle changes, and
  under-the-hood tweaks.


**Sherlock 2** -- The most-hyped feature of Mac OS 9 is Sherlock
  2, a significant revision to the Internet-enabled Find feature
  that debuted with Mac OS 8.5. If anyone's counting, Sherlock 2's
  version number is actually 3.0.1. The old Find File applications
  were version 1.x, and previous versions of Sherlock were version
  2.x.

<http://www.apple.com/sherlock/>

  The first thing you'll notice about Sherlock 2 is its brushed-
  metal interface resembling the QuickTime 4 Player, which been
  justly criticized for its non-standard interface; Sherlock 2 has
  fewer unexplained elements and offers balloon help (and some tool
  tips) for its somewhat inscrutable controls. Nonetheless, Sherlock
  2 features non-standard windows that can't be rolled up or zoomed,
  and Sherlock 2 hides, shows, disables, and nudges window elements
  in confusing ways. Also, Sherlock no longer opens new search
  results windows for each search, instead combining the query,
  settings, and search results into a single window.

<http://db.tidbits.com/getbits.acgi?tbart=05433>

  Sherlock 2 divides its capabilities into "search channels." The
  Files channel represents the contents of volumes accessible to
  your computer - and sports additional controls to modify search
  queries and search the contents of files - while all other
  channels represent collections of Internet searching plug-ins.
  Sherlock 2 ships with Internet, People, Apple, Shopping, News,
  Reference, and My Channel channels that you cannot delete
  (although you can remove and add specific site plug-ins). My
  Channel is a custom channel that includes whatever additional
  Internet site plug-ins you like - and inherits any custom plug-ins
  you may have previously installed, like the TidBITS plug-in - and
  you can create and delete additional custom channels for Internet
  sites. Sherlock 2 can communicate with Lightweight Directory
  Access Protocol (LDAP) servers; as such, the People channel points
  to LDAP servers at Yahoo, Bigfoot, and Four11.

<http://www.tidbits.com/search/>

  Sherlock 2's Internet-related channels may not be to everyone's
  taste, but they do facilitate sensible management of Sherlock
  plug-in sets. Instead of managing a long list of plug-ins - or
  simply leaving all plug-ins enabled all the time - you can focus
  your searches to appropriate sites. You'll also notice that plug-
  ins in the News and Shopping channels can add new elements to
  search results, including prices, dates, and availability. Dates
  are useful for news items, and Apple is promoting pricing and
  other information from Shopping channel plug-ins as a way to
  comparison-shop across many Internet retailers. That might be true
  when more sites customize their plug-ins for Sherlock 2; my
  searches revealed the default sites sell the same items at nearly
  identical prices. Sherlock 2 also offers no way to check for
  updated plug-ins manually - all plug-in updates happen
  transparently in the background.

  Sherlock support from many Internet sites may now be in question
  because of Sherlock 2's handling of banner advertisements. When
  Apple released Sherlock with Mac OS 8.5, the company introduced a
  capability late in the development cycle to display banner
  advertisements in Internet search results windows. This capability
  was intended to make supporting Sherlock palatable to major ad-
  supported Internet sites, who were upset about Sherlock users
  bypassing their advertising. Apple's decision was controversial
  not only for its explicit approval of advertising on users'
  desktops, but also because banner advertisements aren't always
  appropriate to all audiences. Within a day of Mac OS 8.5's
  release, TidBITS began receiving outraged letters from parents,
  educators, and even kids astonished to see banner advertisements
  with explicit adult content and other objectionable material (we
  still receive similar letters). Although major search engines like
  AltaVista aren't as likely to serve up ads featuring nude models
  today as they were a year ago, you never know what might appear -
  major Internet sites still carry ads many teachers and parents
  would find objectionable.

  Sherlock 2 now displays banner ads only from Apple and partners
  whose plug-ins ship with Mac OS 9. I don't know whether Apple made
  this change to address issues of objectionable content or whether
  it simply regards Sherlock's banner area as prime advertising
  space available only to partners. In any case, Sherlock does not
  display banner graphics from other sites, instead substituting an
  Apple banner. This move may help Apple in schools and homes, but
  may dissuade many sites from developing or supporting Sherlock
  plug-ins. After all, such sites' banner advertising apparently
  won't be displayed - even if it's perfectly innocuous - unless
  they can somehow become an "approved" site. This could reduce
  Sherlock's Internet searching capability to a mere bundling
  opportunity for large Internet services and retailers.

  Sherlock 2 retains the file-searching capabilities of its
  predecessors and can search for files by name and by content if
  you first index your disks. However, Sherlock 2 takes a giant step
  backwards in searching for multiple file attributes. Additional
  file search options available via More Choices entries appended to
  the Sherlock window have been replaced by a mammoth More Search
  Options dialog that sports a cacophony of 16 checkboxes, 9 text
  areas, and 18 pop-up menus that enable users to create custom
  searches based on multiple criteria. To use these options, you
  must first select Custom from a pop-up menu (or choose More
  Options from Sherlock's Find menu), hunt through this enormous
  dialog to click checkboxes next to each desired criterion (and if
  you typed a file name or file contents in the main Sherlock
  window, you may get to type it again here), fiddle with the
  requisite pop-up menus and text entries, click OK to return to the
  Sherlock window, and finally click the (unlabeled) Find button.

  In short, search options are a mess. You can (unintuitively) drop
  files from the Finder into the modal More Choices dialog to fill
  in dates and text areas with the dragged file's attributes -
  though the new data overwrites anything you may have already typed
  - but you must still hunt and peck checkboxes to enable or disable
  appropriate items. If you find yourself in the More Search Options
  dialog often, see if you can save common search criteria as
  reusable files. If that isn't enough, you can script more flexible
  Sherlock searches using AppleScript.


**Multiple Users** -- Another high profile feature of Mac OS 9 is
  Multiple Users, which enables a number of people to use a single
  Macintosh, each with their own preferences and customized
  environment. Multiple Users also provides some basic file
  security. With Multiple Users enabled, the Mac starts up normally,
  then runs a Login program that displays a screen where users can
  enter or select their login ID or choose guest access (if
  permitted). Users then type a password to log in or use a slick
  Voice Verification option to identify themselves to the computer.
  It's less secure than a typed password but distinctly cooler.
  Multiple Users does not currently load a different set of
  extensions for each user but can provide different sets of
  preferences, Apple Menu items, startup items, Favorites, and
  desktop items. Users can also be set up as Limited users with
  access only to specific applications, printers, removable media,
  specific CD/DVD titles, the Chooser, control panels, and other
  items. Users can also be defined as Panel users who launch
  programs and manage documents from a shell application called
  Panel, which behaves much like At Ease or a full-screen Launcher.
  In Panel, users can expand and collapse panels that provide icon-
  based access to permitted items, but they can't reach the full
  range of Finder features. A Mac can use users and passwords set up
  locally, or it can pick them up from a Macintosh Manager account
  on the network - handy for lab or classroom administrators using
  Mac OS X Server. Users can be timed out after a period of
  inactivity.

<http://til.info.apple.com/techinfo.nsf/artnum/n31060>

  Mac OS 9's Voice Verification feature integrates with Multiple
  Users. If Multiple Users is activated with voice verification
  enabled, users can speak a passphrase into a PlainTalk-capable
  microphone to identify themselves to the computer, rather than
  typing a password. The default passphrase is "My voice is my
  password," but you can supply your own, taking care it has enough
  phonemes to be distinct. I immediately changed my passphrase to
  "Soylent Green is people," although Apple recommends phrases with
  five to seven words. To set up a voice password, you record
  yourself saying your passphrase four times - if the voice
  verification system thinks the recordings are sufficiently
  similar, you're all set. It's important that you speak normally
  when setting up a spoken password: speaking loudly or with unusual
  emphasis seems to do more harm than good.

  Apple is promoting Voice Verification as revolutionary technology
  - and they worked out an appealing presentation with animated
  spectrum graphs as you record and verify passphrases. Behind the
  scenes, the authentication system can supposedly be extended,
  potentially enabling developers to identify users using digital
  cameras, card keys, or even fingerprint scanners. Nonetheless,
  Voice Verification seems like a stunt with limited utility. Folks
  concerned with the security of their Macs don't necessarily use
  them in environments where it's safe to speak a passphrase - or
  where it's quiet enough for the computer to distinguish a voice
  over background noise.

  Although Multiple Users could keep an over-inquisitive child (or
  parent) out of sensitive parts of a Macintosh, its security is
  easily bypassed by starting up from another device (such as the
  internal CD-ROM) and limited access privileges may interfere with
  automated backups or other scheduled operations. Just remember:
  Multiple Users provides lightweight security and user
  configuration tools - definitely useful for many people but not
  enough to protect sensitive data or manage large groups.


**Keychain & Data Security** -- Mac OS 9 does include security
  features more robust than Multiple Users. The first is the
  Keychain, which originally debuted as part of PowerTalk back with
  System 7 Pro in 1993. The Keychain is a secure place to store
  passwords to Internet and AppleShare servers, digital signatures,
  certificates, and other sensitive information - all behind a
  single password. Applications can access the Keychain directly, so
  in theory users only have to remember one password to access any
  Keychain data. Current versions of applications like Eudora,
  Anarchie, Fetch, and Web Confidential already work with the
  Keychain, as do the Mac OS 9 Finder, Apple File Security (see
  below), and AppleShare services. Mac OS 9 can handle multiple
  Keychain files, and you can unlock Keychain files and move them
  between computers - they live in the Keychain folder in the
  Preferences folder. The Keychain file itself is reasonably secure:
  it never stores the Keychain password on disk (instead using an
  encryption key derived from the password), and uses export-
  approved 128-bit RC2 encryption for storage. The Keychain resists
  repeated attempts to guess a password by exponentially increasing
  a delay between failed authentication attempts - the more often
  you guess the wrong password, the longer you have to wait to try
  again.

  The Keychain provides no way for users to maintain or change
  passwords on remote systems, so users can't quite forget about
  passwords and login information - they'll still need to access
  systems manually to manage their accounts. The process is a bit
  tedious; you open the Keychain Access control panel to look at
  individual items stored in a Keychain file, including stored
  passwords. So long as you remember your Keychain password, you
  should be able to view the password for any item stored in your
  Keychain. The Keychain is a big improvement over time-honored
  methods of storing passwords like typing them into a SimpleText
  document or keeping them on slips of paper. If you find yourself
  relying on the Keychain, let us emphasize the importance of
  regular backups - if your Keychain file is lost or corrupted, you
  could lose access to important files and services.

  Another security enhancement in Mac OS 9 is Apple File Security,
  which can encrypt and decrypt specific files using an arbitrary
  password. You can run Apple File Security as an application - it's
  in the Security folder in Mac OS 9's Applications folder - or
  encrypt files using the Encrypt menu command that appears in the
  Finder's File menu and in contextual menus. When you encrypt an
  item, you're asked to type and confirm a password; by default,
  Apple File Security adds the password to your Keychain. Apple File
  Security then compresses the file and encrypts it using a 56-bit
  key - a small yellow key appears on the file's Finder icon. (Apple
  File Security does not go back to wipe out the disk sectors where
  the unencrypted file was stored, so somone with disk recovery
  tools could potentially pull back data from its pre-encrypted
  state.) A 56-bit encryption key is considered weak security in the
  cryptographic community - Distributed.net successfully cracked a
  56-bit RC5 key in 1997 - but it's currently the largest key size
  the U.S. government permits for export, and it's strong enough to
  deter all but the most determined and well-equipped crackers. If
  someone wants to get into the file, they'll have better luck
  guessing your password or coercing you into revealing it. Apple
  File Security cannot encrypt a folder, which also means it can't
  encrypt a package, a special kind of folder introduced with Mac OS
  9 for handling Carbon "application bundles" - collections of files
  which together form a Carbon application. You'll see more packages
  as Mac OS X gets closer to reality and developers begin to make
  programs designed to run under both Mac OS X and Mac OS 9.

<http://db.tidbits.com/getbits.acgi?tbart=04215>

  To decrypt a file, simply double-click it: Apple File Security
  launches, prompts you for the password, then proceeds to decrypt
  and open the file. (You can also decrypt a file without opening it
  using the Apple File Security application.) Note, however, that
  once you decrypt a file, it _stays_ decrypted. If you want to
  secure the file once you've viewed or modified it, you must
  remember to locate the file in the Finder and encrypt it again.
  Also, if you forget the password used to encrypt the file, there's
  no way Apple or anyone else can retrieve the data for you.


**More Next Week** -- Space constraints require us to delay
  discussion of some of Mac OS 9's other features and enhancements -
  tune in next week for additional details.

$$

 Non-profit, non-commercial publications may reprint articles if
 full credit is given. Others please contact us. We don't guarantee
 accuracy of articles. Caveat lector. Publication, product, and
 company names may be registered trademarks of their companies.

 This file is formatted as setext. For more information send email
 to <setext@tidbits.com>. A file will be returned shortly.

 For information: how to subscribe, where to find back issues,
 and more, email <info@tidbits.com>. TidBITS ISSN 1090-7017.
 Send comments and editorial submissions to: <editors@tidbits.com>
 Back issues available at: <http://www.tidbits.com/tb-issues/>
 And: <ftp://ftp.tidbits.com/pub/tidbits/issues/>
 Full text searching available at: <http://www.tidbits.com/search/>
 -------------------------------------------------------------------

