Wednesday, September 27, 2017

Walk over The Bosley Cloud

Wanting a short, but slightly strenuous walk today, we decided to follow a walk that appeared in the walking guide 100 Walks in Cheshire by David Bishop (Route no. 52).

Near the start of the walk, Timbers Brook.

The route was easy to follow as it stayed on well developed paths, although we did decide to come of the route as the road that this follows was a bit busier than we would have liked.  There were a couple of times that we had to think about the directions on after we had reached the summit and were on our way down, but checking the map in and a bit of thought showed us the right way.

Panorama near the top.
Even though the weather was hazy, from the summit we could just about make out the radio telescope at Jodrell bank, which according to the sign by the trig point was 8 miles away as well as some of the larger buildings in Macclesfield and would look forward to popping up here again when the weather is clearer.

The walk starts off on an open track and heads through woodland most of the way to the summit.  Pausing at the first clearing that had a view we took advantage of the low seat that was there and had lunch.

As we approached the summit it cleared to open moorland where the best views are to be had in all directions, including a view down towards Rudyard lake.

By the trig point there is a metal plaque pointing out directions and distances to some of the local landmarks, but it is probably optimistic to say you can see London.

The Bridestones.
The walk downhill is also pleasant passing down steps and through more woodland down to the main road, here we walked the short distance to visit The Bridestones, which is the remains of a burial mound, the stones being those that surrounded the burial chamber itself.

Turning to the road we started walking towards the coach and horses, but gave up on this as it stayed to get into tight bends so we checked the map and found a small footpath that cut a corner back to one of the lanes that lead back to the car park.

Overall this was a nice walk, not too strenuous and with great views and a nice variety of terrain and landscape to walk through.

The directions in the guide were reasonably easy to follow and lead us on our way quite well.

Monday, September 25, 2017

Pilots licence renewal (after 17 years)

For a number of reasons 17 years ago I let my pilots licence lapse and stopped flying.

At the end of last year a few people suggested that I should see if I could get flying again. Fortunately I obtained my original licence under the old CAA rules which meant that it was valid for life as long as the pilot kept in current practice or satisfied an instructor during a flight test that the pilot possessed the necessary skills to continue flying.

First thing though was to visit an Aeromedical Examiner (AME) to get a medical sorted out, unfortunately the last test of the medical threw up a problem and the AME could not issue the medical at the time, extra tests would be required and he took a few minutes explaining how I could go about getting them done through the NHS, and provided a letter to take to my GP to get the ball rolling.

It took a few months and a number of tests, but eventually the Consultant declared me all clear, a letter was sent to the AME and a brand new medical certificate, backdated of course to the earlier date that the medical was undertaken.  So with a good 20 months medical it was time to move onto the next step.

Whilst waiting for the medical I had been looking around for a training operator, also checking what steps I need to actually renew.  The consensus was that renewal should be a proficiency check with a flight instructor, following a period of training to bring my skills back up to the standard.

Although there are a number of flying schools near me that had Cessna 152s.  In the past I had rarely flown high wing aircraft and decided to go with a school that had the more familiar, to me, PA28 series of aircraft, although they are around £15/hour more expensive.

My first lesson involved checking to see if I could land OK and getting used to the aircraft.  The first landing was really rusty and was a bit heavy on the nose wheel, not exactly the best way to land a PA28.  Also throughout the flight I was trending to lead with the rudder too much.  After around 10 circuits there was some improvement, but I left for the day feeling a bit deflated and thinking this was going to take a little longer than I originally thought.

Unfortunately this year's appalling weather the second lesson was cancelled due to fog on the airfield.

During the enforced gap I was able to go over the flying in my head, what I did wrong and what went right.  When getting in the aircraft I had lowered the seat quite low and thought it might help if I didn't the next time.

A few weeks later I was back and with a string of lessons already booked over the following couple of weeks.  The second lesson was better, I was relaxed with the aircraft from the start and the higher seating position made me more comfortable and in control.  At the end of the lesson and feeling a lot better about my flying the instructor said that the following day's lesson would be outside the circuit.

The third lesson started with a take off and heading out of the circuit to do some upper air work, I was asked to demonstrate a clean stall.  After carrying out the necessary HASELL checks I closed the throttle and lifted the nose quite high into the air, and executed quite a savage stall.  My instructor was impressed that I had remembered the HASELL checks, but didn't quite want such an aggressive stall. We continued with the lesson, through a clean stall and a stall in landing configuration. Then onto steep turns, a couple of practice forced landings.  Boy PA28 really falls out the sky if you stay at  100 kts and don't set up for best glide.

Returning to the circuit we finished off the lesson with a practice forced landing over the airfield and different landing configurations such as flapless and glide approaches.

I was feeling a bit better after this and even better still when after the flight he said that we should try for the test on the next flight.

Almost a week later and having planned a short navigation exercise to a disused airfield we set off into the air again.

Climbing out of the airfield, I set course for the airfield checking my course as we went along, the halfway point as we crossed the motorway and not forgetting to do a FREDA check the disused airfield appeared just to the right of the nose.

Happy with the Navex we turned back roughly towards the airfield and was given a heading to steer, once over open countryside carried out the upper airwork, stalls and steep turns etc.

A well executed PFL and we were heading back for an overhead join at the airfield and then into the circuit for a number of landings.

Landing off the glide approach we taxied back and after shut down from the passenger seat came the words “You tidy this up and I'll get the computer started and we will sort the paperwork out.”  I Smiled.

After the paperwork was finished, and a well earned coffee, I had a nice beaming smile all the way home.

Tuesday, August 1, 2017

Methods of two factor authentication

Most people are used to logging into a website using a username and password, however a number of security breaches have been caused by the weaknesses in the username/password login methods.

To combat these breaches most online organisations offer some form of 2nd factor login methods.  2nd factor (sometimes called two step) means providing a secondary method of authentication of a different type than the initial verification, eg. using a password and a thumbprint, or a password and a number provided by an SMS message.  This allows for the password to have been discovered by a third party by some method, but the account to remain secure.  It is important to note that the 2nd factor needs to be provided by some other method than the original factor, having a password and a pin number would not be useful as they would probably be exposed by the same weaknesses.

There are a number of two factor authentication methods that online organisations use in addition to passwords and I will take a look at three of the most popular methods for private 2 Factor authentication.

Authentication App

There are a number of authentication apps that you install on your mobile phone and then synchronise with the website with some method.

These offer time-based codes that change every thirty seconds or so, usually 6 digits long.  The user logs in with their username and password and is then presented with a request for the authentication code, the user opens the app and enters the authentication code for that website.  Most of these apps offer a countdown of the number of seconds left that the code is valid for so the user can wait until the next time slot if the current one is running out.

Once the app is installed on the phone setting up for websites that use this method is straightforward.  More than one website’s authentication code can be stored in the app so there is some flexibility.

A few apps and websites allow a slightly different method, when you log into the website a pop-up appears on your phone telling you someone is logging into your account and asks you whether to approve or block the login.

This is my prefered method of 2nd factor for websites, as it is simple and a lot of websites are supporting this method.  Twitter and Facebook have an authentication code app installed in their mobile apps that you can use to authenticate with their services.

Hardware token

Corporate organisations have used hardware tokens for a number of years for remote workers, the most common of these is the RSA token which was a small device with an LED display which displayed a code, similar to the authenticator apps, the main problem with these devices were that they are locked to one system so if you have to authenticate to multiple systems you need multiple keys.

Over the last few year a standard has been created called Universal 2nd Factor (U2F) has been created and has been implemented by online services, the U2F devices are low cost physical devices that use USB or NFC chips to present an authentication code to the service.

Physically they come in a number of shapes, some like small traditional USB sticks, others as flat sheets with just the USB pins at one end.  Often they have a push button or sensitive pad that you press to send the code, there is even one available with a fingerprint reader for extra security.
Yubikey U2F key

Initial setup requires that you register the device with the website or service that you wish to authenticate to and then the next time you need to authenticate with the service you are asked to insert the key, once inserted tapping the activation pad inputs a time sensitive code into the device that provides the authentication.

SMS messages

Often websites offer SMS message authentication, this is simply where you register your mobile number with the website and after you have entered your username and password the website sends you a text message with a login code, enter this code and the login is complete.

If this is the only option available on the website then using it is better than not using it however due to the nature of SMS, it not being encrypted and a few other faults it has been used in a number of banking frauds.  If there is a different option for 2 factor authentication then SMS codes should be disabled.


When enabling 2 factor authentication, a backup method of logging in should be set up and maintained just in case the authentication device is lost or has failed.  Most sites offer a set up backup login codes which you can print off and lock away in a safe.  Also you can use additional methods of 2 factor, such as an authenticator app and a hardware token.

In summary

If you haven’t turned on 2 factor authentication when it is available, please give it a try, the above methods are fairly straightforward to set up and use and provide a huge increase in the level of protection available to your data. have a list of websites that support 2nd factor.

If you only enable it for one or two websites, please set it up for your main email account or the one that receives all your password reset links to.