15 April 2016--Today is the deadline for users who have not enabled Secure Login in their accounts, and use passwords in connections to RMS and CMS systems. Today, the CMS detects if a connecting user has a password and also does not have secure login enabled. If so, secure login is enabled and a message is posted to the user with details of that action.

Also, since secure login is not an option and is set automatically, it has been removed from user's account settings.

The CMS also will detect if a connecting user has not set a password. If so, it creates a random password for the account, enables secure login, and posts a message to the user with details of that action.

In both cases, the CMS will continue to allow insecure access until the notification message that was sent has been retrieved from the user's radio mail account. After which, the secure login setting is enforced.

If you find yourself unable to connect, please contact the system manager, Steve Waterman, K4CJX, for instructions if you have difficulty with instructions already published. For your reference, a previous message is reprinted below.

--The Winlink Development Team

18 Dec 2015--Last October we announced system-wide changes to enhance privacy and anti-piracy for the Winlink community. Today, we are announcing a deadline date on which the use of account passwords and secure login will become required and not optional: April 15th, 2016

If you’ve already set a password, turned on secure login in your account, and entered the password in your client software, you don’t have to make any other changes. The transition taking place on April 15, 2016 won’t change your operation. If you haven’t set a password for your account and enabled secure login, we recommend you do it now so you won’t be surprised on April 15, 2016. Here's how:

If you use RMS Express:

1. Connect your computer to the Internet.
2. Run RMS Express.
3. Click “Files” then “RMS Express Setup”
4. Double check that you have the latest version. Check the box in the lower right, "Automatically install field-test (beta) versions..." and allow the program to update and restart. Go back to "RMS Express Setup" as above if you updated the program.
5. Enter your password in the field next to your callsign, and check the “Require password on connections (Enable Secure Login)” checkbox (it may already be checked by default).
6. Enter a password recovery e-mail in the appropriate field. This must be a non-Winlink address.
7. Click "Update".
8. RMS Express will set your password on the Winlink system and enable the secure login option.

If you’re using a different Winlink e-mail client program, you must follow these steps:

1. Go to www.winlink.org, and select the My Account tab.
2. If you haven’t previously selected a password, select one now. Otherwise log in.
3. Navigate to the screen that lists your account information, and click “Edit”.
4. Scroll down and enter your password-recovery e-mail.
5. Check the box to enable Secure Login.
6. Click “Save” at the bottom of the screen.
7. Last, find the place in your client program where you can enter your password, and set it.

Note: there may be Winlink client programs that cannot use passwords and secure login. If your client is one of them, contact the author and urge them to update their program!

--The Winlink Development Team

Next spring, FEMA Region X, county emergency management agencies statewide, many others and Oregon ARES/RACES will participate in the FEMA Cascadia Rising exercise. This is a functional exercise that will play out what might happen should/when a major earthquake strike the Pacific Northwest. The drill scenario anticipates widespread loss of normal communication modes such as cell phones, Internet and public safety radio as well as major power outages.

Both keyboard mode and the APRS gateway now allow access with your Winlink password to the CMS using a simple challenge/response protocol. Your password is never sent in the clear over the air.

LOGIN
If secure login is enabled for your account (or, in the future, required). Send any command to initiate login. The CMS will respond with a challenge consisting of three digits who's values represent positions of characters within your password..

[RESPONSE]
This is a six character response to the login challenge. Respond with three password characters corresponding to the positions in the challenge plus three additional characters of your choosing (in any order). Example: Password is ABC123. Login challenge is: 425. You send '1B2AZ5'. ABZ21TY would also be valid since it contains the characters 1, B, and 2.

No password is needed if the secure login account setting is off (check 'My account>Edit' at the Winlink web site). This option will go away once secure login (password validation) becomes mandatory next year.

Keyboard access will continue to accept the PW syntax announced earlier, but that will be disabled in a few weeks. Use the above method instead.

-Lee, K0QED
Winlink Development Team