LoTW

[X-Rated]

Well, for years I have been signed up for LoTW and never got it to work for me. I finally called the assistance on that and figured out the problem. So now I have some stuff uploaded to that. I think I signed up 3 years ago now.

That was fun.

[WØTKX]

I have some old XP machines that I updated before the cut-off. I think.

[KJ3N]

I'm already on eQSL and I'm using the QRZ logbook.

Don't see much point in LoTW. It's basically good for ARRL awards, but in order to get any of those, you have to be an ARRL member (for USA licensees). No ARRL membership, no reason to be on LoTW.

YMMV

[NQ6U]

I signed up for LoTW but never used it. A couple of months ago I got e-mail from ARRL that my certificate needed to be renewed so I went the the Web site and followed their instructions to the letter. The renewal process didn't work. Tried it again, it still didn't work. After close to two hours wasted on the process, I said "fuck it."

Until the ARRL gets their act together, I'll stick with eQSL and paper.

[AE1PT]

I signed up for LoTH but never used it. A couple of months ago I got e-mail from ARRL that my certificate needed to be renewed so I went the the Web site and followed their instructions to the letter. The renewal process didn't work. Tried it again, it still didn't work. After close to two hours wasted on the process, I said "fuck it."

Until the ARRL gets their act together, I'll stick with eQSL and paper.

^^^^^ this.

Setup time and success is variable. Moving it to another machine or updating the cert can lead to crash and burn. Last time it had issues Norm Fusaro, W3IZ at ARRL generated a new cert and provided TA to overcome the issue with the loading. No problems since, and with the new HRD v6 it uploads nicely to LoTW simply by selecting a range or particular records and hitting upload.

I hear many hams say they are not interested in the hoops, awards, or the BS to keep it running. I personally don't care about the awards--but there are those out there that do--and I run the LoTW as a courtesy to them.

Who knows? I think I might be eligible or getting close to an award myself. :-D

[KC2UGV]

I signed up for LoTH but never used it. A couple of months ago I got e-mail from ARRL that my certificate needed to be renewed so I went the the Web site and followed their instructions to the letter. The renewal process didn't work. Tried it again, it still didn't work. After close to two hours wasted on the process, I said "fuck it."

Until the ARRL gets their act together, I'll stick with eQSL and paper.

But, then, the LoTW fanbois will jump on you about how it only took them 3 minutes to get up and running... And ignore the notion that signed logs for uploading to a site is just overkill. Username/password would suffice.

Requiring signed logs is saying that banking information is less important than ham radio logs.

[W3WN]

Getting Logbook of the World set up is not difficult. Just tedious. And no, it doesn't take 3 minutes. More like about 15, if you follow the instructions.

Could the instructions be written better? Yes. Could the process be streamlined? Yes. Is the interface old-fashioned? Yes, and it was when it was first debuted -- and has never changed. And that's why the ARRL finally got off their collective a$$ and are FINALLY starting to move, at the usual glaciar-like speed, of updating the system.

Now with that said: Corey, that's a bull$h!tt argument. "Requiring signed logs" isn't saying that LotW is more important than banking information... hardly. What it IS saying is that your bank or financial institution hasn't put the proper steps in place to secure YOUR financial information.

In other words, it should NOT be easier to access my checking account, car payment, or mortgage accounts, than it is to access my on-line log. Now, who's fault is this? The League's, for providing proper security? Or your financial institution's, for cutting corners, putting profits ahead of security, and hoping that no hacker will break in and steal from them... oh, wait, that keeps happening, doesn't it... hmmmm...

And besides, what's the big deal? Takes me all of 15 seconds to encrypt my log prior to uploading. If that. Pffft. Not worth the time to grouse about it, if I was going to grouse about it, which I'm not.

If you don't want to use Logbook of the World... don't. Nobody's forcing you to.

[NQ6U]

Getting Logbook of the World set up is not difficult. Just tedious. And no, it doesn't take 3 minutes. More like about 15, if you follow the instructions.

But, for me at least, the certification renewal process didn't work. That's the rub—I wouldn't mind jumping through the hoops if I got something out of it but to waste a bunch of time and have nothing to show for it is, at the very least, frustrating as hell.

[KC2UGV]

Getting Logbook of the World set up is not difficult. Just tedious. And no, it doesn't take 3 minutes. More like about 15, if you follow the instructions.

Could the instructions be written better? Yes. Could the process be streamlined? Yes. Is the interface old-fashioned? Yes, and it was when it was first debuted -- and has never changed. And that's why the ARRL finally got off their collective a$$ and are FINALLY starting to move, at the usual glaciar-like speed, of updating the system.

Now with that said: Corey, that's a bull$h!tt argument. "Requiring signed logs" isn't saying that LotW is more important than banking information... hardly. What it IS saying is that your bank or financial institution hasn't put the proper steps in place to secure YOUR financial information.

In other words, it should NOT be easier to access my checking account, car payment, or mortgage accounts, than it is to access my on-line log. Now, who's fault is this? The League's, for providing proper security? Or your financial institution's, for cutting corners, putting profits ahead of security, and hoping that no hacker will break in and steal from them... oh, wait, that keeps happening, doesn't it... hmmmm...

And besides, what's the big deal? Takes me all of 15 seconds to encrypt my log prior to uploading. If that. Pffft. Not worth the time to grouse about it, if I was going to grouse about it, which I'm not.

If you don't want to use Logbook of the World... don't. Nobody's forcing you to.

Does your bank issue you a certificate, in order to log in?

Should they? Why?

If the entirety of the banking industry doesn't require 2 factor auth for web transaction, why is it required for ham radio logs?

[X-Rated]

But, for me at least, the certification renewal process didn't work. That's the rub—I wouldn't mind jumping through the hoops if I got something out of it but to waste a bunch of time and have nothing to show for it is, at the very least, frustrating as hell.

Yup. There is nothing the ARRL offers that details the specifics. I guess they might if you have made many correct assumptions, but yeah. It is tons easier to log out thousands from my checking account than to log in a few contacts on LoTW.

[KJ3N]

If the entirety of the banking industry doesn't require 2 factor auth for web transaction, why is it required for ham radio logs?

Because ham radio logs are....

http://emotibot.net/pix/160.jpg

[ki4itv]

I used LoTW for a few years, but a computer crash took me out. Not worth the trouble.
They could make it easier to regain access to your own account.
I haven't been active in some time, so meh.

[wa6mhz]

LOTW is a PITA, but I finally got it going and now (Once I transcribe the paper logs into a logging program and upload the ADIF FILE, another PITA!) I can get credit for ALOT of QSOs. I am going for a CW and DIGITAL DXCC, and it would cost HUNDREDS of dollars and countless hours to send out QSLs with SAEs and Greenstamps to get each card (Just like I had to do over 40 years to get my PHONE DXCC)! So in the long run, it is alot easier and painless way to get the confirmations. But I still send off for DXpedition cards (like the TX5K and 5W0M) just because they were so much fun to work and the QSL is a great Keepsake. The LOTW experience misses out on the wonderful cards, but just qualifying for endorsements, it sure makes it easier.

[K7SGJ]

I only use paper. If the is a FU, I have only myself to blame. As far as having my log entries on a computer, I can manage to FU my computer just fine without them.

[W3WN]

But, for me at least, the certification renewal process didn't work. That's the rub—I wouldn't mind jumping through the hoops if I got something out of it but to waste a bunch of time and have nothing to show for it is, at the very least, frustrating as hell.To be honest, I don't know what to tell you.

I've never had a problem renewing my cert, and I've never had a problem transferring my certs between computers, to date. (Knock on fake wood)

[W3WN]

Does your bank issue you a certificate, in order to log in?

Should they? Why?

If the entirety of the banking industry doesn't require 2 factor auth for web transaction, why is it required for ham radio logs?They do for the company's account(s). Of course, that's in part because we're uploading scanned checks and other financial data.

That aside... you're missing my point. IMHO, the issue is not that LotW had a high level of encryption & related security... it's that way too many of our financial institutions do NOT. Now, if you want to argue that the banks (etc) OUGHT to have a higher level of security than LotW, believe it or not, I actually agree with you. So why don't they?

I find it more than a little scary that for the vast majority of accounts I pay online, there's only a simple logon with a simple password check. A HANDFUL of institutions take it one step further... usually showing you a picture & asking you to confirm that the picture (& caption you selected) are yours... but that really shouldn't be all there is. And then, when some miscreant hacks into your account, the banks & finance institutions blame YOU 100% for the incident... but absolve themselves of all responsibility, even when they have a system in place that's way too easy to hack.

I don't want to veer off into that tangent, at least not in this thread. But understand that your complaining about the wrong thing.

[W3WN]

< snip >
It is tons easier to log out thousands from my checking account than to log in a few contacts on LoTW.And that doesn't bother you?

Not to be snarky, but IMHO security is worth a little inconvenience. The risk of a serious financial loss alone...

[KC2UGV]

They do for the company's account(s). Of course, that's in part because we're uploading scanned checks and other financial data.

That aside... you're missing my point. IMHO, the issue is not that LotW had a high level of encryption & related security... it's that way too many of our financial institutions do NOT. Now, if you want to argue that the banks (etc) OUGHT to have a higher level of security than LotW, believe it or not, I actually agree with you. So why don't they?

I find it more than a little scary that for the vast majority of accounts I pay online, there's only a simple logon with a simple password check. A HANDFUL of institutions take it one step further... usually showing you a picture & asking you to confirm that the picture (& caption you selected) are yours... but that really shouldn't be all there is. And then, when some miscreant hacks into your account, the banks & finance institutions blame YOU 100% for the incident... but absolve themselves of all responsibility, even when they have a system in place that's way too easy to hack.

I don't want to veer off into that tangent, at least not in this thread. But understand that your complaining about the wrong thing.

I'll argue that it's not needed for banks, nor is it needed for ham radio logs. Something about using an anti-aircraft gun to shoot a mosquito comes to mind.

[NQ6U]

I'll argue that it's not needed for banks, nor is it needed for ham radio logs. Something about using an anti-aircraft gun to shoot a mosquito comes to mind.

Or using a cruise missile to weed your lawn.

[W3WN]

I'll argue that it's not needed for banks, nor is it needed for ham radio logs. Something about using an anti-aircraft gun to shoot a mosquito comes to mind.And I'd counter-argue that it IS needed for banks. Whether or not it is overkill for radio logs.

Now, we could go round & round, but let me put it this way:

Shanna, they bought their tickets, they knew what they were getting into. I say, let 'em crash!

http://www.youtube.com/watch?v=Pn0WdJx-Wkw

That, and it sure looks like I picked the wrong week to quit drinking...

[KJ3N]

Maybe it's because I started out on eQSL before the ARRL ever got its act together, but the one thing that really torques me about the LoTW system is that I can't see anything that might be waiting for me. I like having a list of incoming QSLs I can see and manually confirm. LoTW doesn't work like that, AFAIK.

[AE1PT]

Maybe it's because I started out on eQSL before the ARRL ever got its act together, but the one thing that really torques me about the LoTW system is that I can't see anything that might be waiting for me. I like having a list of incoming QSLs I can see and manually confirm. LoTW doesn't work like that, AFAIK.

What is waiting may simply be satisfaction in having provided your contact with "the final courtesy" of formal acknowledgement. Used to be that was the QSL card--but today that is often more difficult and certainly more expensive than LoTW.

Your call may be just what Elmer, A1OF needs to complete his Triple Play WHATSIT award...

[W3WN]

Maybe it's because I started out on eQSL before the ARRL ever got its act together, but the one thing that really torques me about the LoTW system is that I can't see anything that might be waiting for me. I like having a list of incoming QSLs I can see and manually confirm. LoTW doesn't work like that, AFAIK.
Actually, that's exactly right. That's by design. Logbook of the World works on a double-blind system... you don't know if or when our logs match up, until both of us upload, AND the software matches up our log entries.

This prevents cheating. That is, if you actually worked W3WH, but accidentally log my call, it prevents me from claiming a "confirmation" for a QSO that never took place.

LotW & eQSL have two fundamentally different designs... and you've highlighted what it is. But there is a reason for it. It's not an accident.

[KJ3N]

Your call may be just what Elmer, A1OF needs to complete his Triple Play WHATSIT award...

If he's going to rely on LoTW to bag me, he's SOL. Same thing would go for him if he needed me on CW. That ain't gonna happen, either. ;)

[NQ6U]

Your call may be just what Elmer, A1OF needs to complete his Triple Play WHATSIT award...

No way. I'm a Six Lander.

[KJ3N]

Actually, that's exactly right. That's by design. Logbook of the World works on a double-blind system... you don't know if or when our logs match up, until both of us upload, AND the software matches up our log entries.

And what's the window for a match? Do both have to be within a minute? 5 minutes?


This prevents cheating. That is, if you actually worked W3WH, but accidentally log my call, it prevents me from claiming a "confirmation" for a QSO that never took place.

I can see how it prevents a claim if you log the contact wrong. I don't see how that prevents cheating. Any 2 people could agree to upload a non-existent contact and game the system. That's no different than trying the same thing on eQSL.


LotW & eQSL have two fundamentally different designs... and you've highlighted what it is. But there is a reason for it. It's not an accident.

And that will keep me from using it. Ever.

[KC2UGV]

Actually, that's exactly right. That's by design. Logbook of the World works on a double-blind system... you don't know if or when our logs match up, until both of us upload, AND the software matches up our log entries.

This prevents cheating. That is, if you actually worked W3WH, but accidentally log my call, it prevents me from claiming a "confirmation" for a QSO that never took place.

LotW & eQSL have two fundamentally different designs... and you've highlighted what it is. But there is a reason for it. It's not an accident.

Since I export eQSL, sign, and upload to LoTW; I don't think the double blind system, the using signed files, or any of the other hoops LoTW has prevents anything; unless you are saying eQSL also prevents cheating.

[W3WN]

And what's the window for a match? Do both have to be within a minute? 5 minutes?
< snip >I think it's either an hour or a half-hour. I'd have to look it up to be certain.

< snip >
I can see how it prevents a claim if you log the contact wrong. I don't see how that prevents cheating. Any 2 people could agree to upload a non-existent contact and game the system. That's no different than trying the same thing on eQSL.
< snip >Well, if both parties are willing to cheat, there's not much either system can do about it.

But then, if your buddy the QSL manager offers to send you a P51SLIM card, for a QSO that never happened, just so you can claim DPRK as a worked entity... well, what's the difference? That's cheating as well.

Now, if an eQSL entry shows up in my "log" saying, say, that I worked 5A7A on 40 RTTY... which actually happened, by the way... when I never have worked RTTY on any band... what's to stop me from subsequently using THAT information to make a LotW "matching entry" to claim non-existant credit? (Ditto if it shows up on the printed QSL card... and I'm very disappointed in the sloppy log keeping that occurred after the fact, but that's another story)

So. ultimately, it comes down to the individual. Do you have ethical standards or not? If you lack ethics, and are determined enough, you can find a way around any system. If you have ethics, then you have nothing to worry about. But that aside, the point is that with a double-blind system, the opportunity (and thus the temptation) to... fudge things WITHIN the system does not exist. Regardless of whether or not external forces provide said opportunity/temptation.

[W3WN]

Since I export eQSL, sign, and upload to LoTW; I don't think the double blind system, the using signed files, or any of the other hoops LoTW has prevents anything; unless you are saying eQSL also prevents cheating.eQSL does not prevent cheating. Never has. And I have a P51SLIM "confirmation" to prove it.

I know of at least 2 other ways to "game" the eQSL system. And no, I'm not going to post what they are... but I know that they worked as late as 5 years ago. Whether or not N5UP & his crew of miscreants have plugged the holes (which have been pointed out to them more than a few times), I can't say. But that's their problem.

However Corey, all you have proven is that the system, any system, is only as good as the data that's inputted. SISO... or in more polite terms, GIGO. So if someone (and I'm not saying you) deliberatly uploads to LotW information that they KNOW to be false... well, see comment above about ethics.

[KC2UGV]

eQSL does not prevent cheating. Never has. And I have a P51SLIM "confirmation" to prove it.

I know of at least 2 other ways to "game" the eQSL system. And no, I'm not going to post what they are... but I know that they worked as late as 5 years ago. Whether or not N5UP & his crew of miscreants have plugged the holes (which have been pointed out to them more than a few times), I can't say. But that's their problem.

However Corey, all you have proven is that the system, any system, is only as good as the data that's inputted. SISO... or in more polite terms, GIGO. So if someone (and I'm not saying you) deliberatly uploads to LotW information that they KNOW to be false... well, see comment above about ethics.

Exactly.

Which means the whole facetious story about how LoTW's processes make it secure from cheating, or even mistakes, are just that. Facetious tall tales.

Which, again leads to the point: If the entirety of the banking industry doesn't see the need to issue personal certificates to upload/download financial data from Joe Public (Like me, or you), what would lead anyone to believe it's needed for something as mundane as ham radio QSO logs?

About the only use I can see for signed logs are for transmitting the logs via amateur bands, to prevent both corruption and tampering. But via the web interface? It's pointless, and a needless exercise in utilizing an anti-aircraft gun to shoot down a mosquito. Or, as eloquently put earlier: Using Close Air Support to get rid of weeds on your lawn.

Signed logs do not prevent cheating. Signed logs don't offer much (If any) benefit. And, signed logs make the process needlessly more painful for people trying to get it up and running.

[KJ3N]

And what's the window for a match? Do both have to be within a minute? 5 minutes?
I think it's either an hour or a half-hour. I'd have to look it up to be certain.

Wow, that's broader than a barn door, if it's an hour. Thirty minutes sounds more reasonable.


Now, if an eQSL entry shows up in my "log" saying, say, that I worked 5A7A on 40 RTTY... which actually happened, by the way... when I never have worked RTTY on any band... what's to stop me from subsequently using THAT information to make a LotW "matching entry" to claim non-existant credit?

Nothing, which is kind of my point. If you know there's a matching LoTW entry, you could every well do it and nobody (except you) would know the difference.

I've had bogus eQSLs in the past. Some of them are quite amusing. I recall one that was waiting for me for a CW contact. I just about fell out of my chair laughing (for obvious reasons). I simply reject the bogus ones and that's the end of it.


So. ultimately, it comes down to the individual.

It always has. I won't claim an eQSL that isn't correct, or is obviously false.

[W3WN]

Exactly.

Which means the whole facetious story about how LoTW's processes make it secure from cheating, or even mistakes, are just that. Facetious tall tales.

Which, again leads to the point: If the entirety of the banking industry doesn't see the need to issue personal certificates to upload/download financial data from Joe Public (Like me, or you), what would lead anyone to believe it's needed for something as mundane as ham radio QSO logs?

About the only use I can see for signed logs are for transmitting the logs via amateur bands, to prevent both corruption and tampering. But via the web interface? It's pointless, and a needless exercise in utilizing an anti-aircraft gun to shoot down a mosquito. Or, as eloquently put earlier: Using Close Air Support to get rid of weeds on your lawn.

Signed logs do not prevent cheating. Signed logs don't offer much (If any) benefit. And, signed logs make the process needlessly more painful for people trying to get it up and running.I'm not going to argue with you Corey. Take it up with the League.

No, signed logs don't stop deliberate false actions by two individuals who are colluding to cheat the system. They never have been. But that's not what they're talking about.

They do prevent me from claiming a credit with you that you haven't verified. That's what you're overlooking.

In short, you're trying to hang the system, so to speak, on the wrong type of cheating.

But, you know what? If it bothers you that much... don't use it. No one's forcing you to. I know of no major DXpedition that requires only LotW confirmations... every one I know of still uses the traditional QSL manager, or alternatives like OQRS, ClubLog, or even eQSL... and not all of them use LotW (though of late, seems that most do). So if it's that much of a hassle to you... don't use it.

[KC2UGV]

I'm not going to argue with you Corey. Take it up with the League.

No, signed logs don't stop deliberate false actions by two individuals who are colluding to cheat the system. They never have been. But that's not what they're talking about.

They do prevent me from claiming a credit with you that you haven't verified. That's what you're overlooking.


eQSL does the same thing. So, why the need for signed logs? This is the question you are dodging. What does requiring signed logs actually do, when ADIFs are just being uploaded to LoTW via a web interface, that is secured with SSL, and a username/password?



In short, you're trying to hang the system, so to speak, on the wrong type of cheating.


I'm contending that all of the hoops prevent nothing of what it's trying to solve. The only thing it might prevent are accidental confirmations.



But, you know what? If it bothers you that much... don't use it. No one's forcing you to. I know of no major DXpedition that requires only LotW confirmations... every one I know of still uses the traditional QSL manager, or alternatives like OQRS, ClubLog, or even eQSL... and not all of them use LotW (though of late, seems that most do). So if it's that much of a hassle to you... don't use it.

And, of course, this is the attitude that causes things to not get fixed. Don't like it? Don't use it! How about: Don't like it? Many users don't like it? Fix it!

Yes, signed logs have a purpose, which I will admit: Transmitting logs via amateur packet. Prevents anyone in the transmission chain from tampering with the logs, and adding a "Me too!"

But for a guy like me (And, most others), who just upload an ADIF to LoTW? Signed logs prevent nothing of what it's purported to prevent.

My gripe isn't with the double blind method: It's the requiring of signed logs that are being uploaded to LoTW's site.

[W3WN]

No. eQSL does not do the same thing.
-------------------------------------
What does a signed log do? It verifies that I am actually the one who uploded the log. That is the key difference.

Anyone can go to eQSL; create an account; upload a log. If that log happens to have my call in it, it shows up in my list of calls to confirm or deny. (I was going to pull out an example, but eQSL is down for maintenance right now). And if another party happens to guess or otherwise acquire your password, there's nothing to stop them from uploding a bogus log.

OTOH, while anyone can request a LotW account, they don't get one until their identity, so to speak, has been verified. (Difficult? No. Tedious? Yes.). Once they get one, they have to encrypt their log, with a password known only to them. So even if someone else knows your password, they can't upload a bogus log. The certificate portion includes, if I'm not mistaken, the LotW system password (hidden within the cert, encrypted), which lets them decrypt the log -- without knowing my password. And unless my uploaded log & your uploaded log matches, I will never know what you've uploaded; only when there's a match will the system acknowledge it.

Does that answer your question?

Disagree with the methodology if you desire. But that's why they do it the way they do. Now, if you can come up with a better system, an easier system, that will pass muster with the ARRL and the faithful that use LotW, I'm all ears.

[X-Rated]

Oh. I get it now. The deal is that old farty type hams can't come up with passwords other than "N9XR" for me, or abc123. Now I understand where the ARRL is coming from. Interesting. I guess I had better change my passwords to aaa111 or something difficult.

[NQ6U]

Oh. I get it now. The deal is that old farty type hams can't come up with passwords other than "N9XR" for me, or abc123. Now I understand where the ARRL is coming from. Interesting. I guess I had better change my passwords to aaa111 or something difficult.

No, that's my password! You can't use it!

Oh, wait, I shouldn't have said that...

[X-Rated]

Okay then. I will change mine to "password". I doubt anyone will figure that one out.

[W3WN]

Try using 1 2 3 4 5

Nobody uses it anymore, not since the word got around that it's the type of combination that only an idiot would use... on his luggage...

[K7SGJ]

Try using 1 2 3 4 5

Nobody uses it anymore, not since the word got around that it's the type of combination that only an idiot would use... on his luggage...

Thanks for telling everyone ya bastid. Now I'm going to have to get all new luggage.

[W3WN]

Thanks for telling everyone ya bastid. Now I'm going to have to get all new luggage.Hey, it wasn't me (first)...
https://encrypted-tbn2.gstatic.com/images?q=tbn:ANd9GcR2j3JsKfScFiEOAwRjCJmjhwIPkBqd1 oye2tAkg1nWtp9JtbDQbQhttps://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcRdSfYb56UulMW5HkJJQHbDrO0fz377Q ClHI7Z3jFsoSiHAq2BIaw

[X-Rated]

On eQSL, I had a confirmation waiting for me from Gibraltar. It was to N9XR in 1992. As far as I know, there was no N9XR call being used until 2000 when I got this one. I rejected that QSL. It was nowhere in my WB5L logs or nothing. France on 6M was there as well. I never worked France on 6M. I rejected it. I accepted only the ones I could see I had worked. I don't need any certified signed logs to do that.

I reject a lot on eQSL. I have rejected card QSL's as well.

[K7SGJ]

http://a.tgcdn.net/images/products/frontsquare/eb9a_mythbusters_reality.jpg

[KC2UGV]

No. eQSL does not do the same thing.
-------------------------------------
What does a signed log do? It verifies that I am actually the one who uploded the log. That is the key difference.


How does it prove you uploaded the log more so than a username/password?



Anyone can go to eQSL; create an account; upload a log. If that log happens to have my call in it, it shows up in my list of calls to confirm or deny. (I was going to pull out an example, but eQSL is down for maintenance right now). And if another party happens to guess or otherwise acquire your password, there's nothing to stop them from uploding a bogus log.


Anyone can go to LoTW and create an account with my callsign (Well, not mine, I already did), request a cert, and upload logs. What's the difference?

That being said: Who the fuck is going to hack a ham radio account, and start uploading logs for that person? What would be the point?

Are you getting where I'm coming from now? It's overkill for the problem at hand.



OTOH, while anyone can request a LotW account, they don't get one until their identity, so to speak, has been verified. (Difficult? No. Tedious? Yes.). Once they get one, they have to encrypt their log, with a password known only to them. So even if someone else knows your password, they can't upload a bogus log. The certificate portion includes, if I'm not mistaken, the LotW system password (hidden within the cert, encrypted), which lets them decrypt the log -- without knowing my password. And unless my uploaded log & your uploaded log matches, I will never know what you've uploaded; only when there's a match will the system acknowledge it.

Does that answer your question?


Not really. It's just as hard to get a "Verified" status from eQSL as it is from LoTW. And, eQSL doesn't require signed uploads.

FWIW, LoTW doesn't encrypt any logs. It signs them. That's all. Prevents adding a "Me too!" in the logs as they make their way to LoTW. When it's done directly at the LoTW site, the signed logs are superfluous. Over packet? Sure, I can see that being required. By email too. Over an SSL connection? Overkill. It's like VPN'ing your VPN connection.

The only thing that signed logs ensure is that the person who obtained the certificate is the one who generated the logs. That's it. And, it's overkill. Does your bank require you to jump through hoops to get a certificate, and sign every data transfer with them using your cert, over SSL connections?

No. Because it's superfluous. For banking data and for even more so for ham radio QSO logs.



Disagree with the methodology if you desire. But that's why they do it the way they do. Now, if you can come up with a better system, an easier system, that will pass muster with the ARRL and the faithful that use LotW, I'm all ears.

Sure: QRZ and eQSL have already come up with a better system. Both verify their users, and both just require logging in to upload logs, over an SSL connection.

No tomfoolery when switching PC's. No 2 week wait time on getting your first log done.

[W3WN]

< snip >
Anyone can go to LoTW and create an account with my callsign (Well, not mine, I already did), request a cert, and upload logs. What's the difference?

That being said: Who the fuck is going to hack a ham radio account, and start uploading logs for that person? What would be the point?

Are you getting where I'm coming from now? It's overkill for the problem at hand.
< snip >Yeah. I get it.

OK, first off... yes, it's overkill (at present at least) to some degree. I wouldn't have designed the system that way... but I didn't design it. I can see what the designers did, and why... and can explain why... but if you ask me point blank if it is overkill, well, I can't deny it.

I'm not saying that they were wrong (I'm also not saying that they were right), but only because I don't know all of the criteria behind the decision to do it this way. In other words... if this is what the client (ie the ARRL, specifically the DXCC desk, the Board, or the overpaid executives who run Newington) put in the specs, and they delievered as per the specs, they did their job.

So: If you think the security level is overkill, as you obviously do, I kindly suggest you take it up with your Division Director, since only the Board can mandate a change here.

Personally, I won't make such a request. Yes, I think it's a bit much, but only a bit much... and I don't find it a major inconvenience.

Now, you have to remember something... The primary purpose of Logbook of the World is to electronically confirm QSO's for the purposes of the ARRL awards program. And the reality is that there are many hams (if you want to say "too many" I won't agree but I won't argue either) who take that VERY seriously. They are the ones who want that level of security. Why? Because of the antics of people like Dr. Don Miller (ex) W9WNV (etc) and Romeo Stepanenko P5RS7 (etc) and others that haven't gotten that level of notoriety.

Oh, one other little thing...

< snip >
When it's done directly at the LoTW site, the signed logs are superfluous. Over packet? Sure, I can see that being required. By email too.
< snip >You can email your signed logs to the LotW system, lotw-logs@arrl.org , and they will upload. So by your own admission, since they can be uploaded via email, you agree that the cert process is NOT unneccesary.

And clearly they want to keep things simple by having all logs encrypted, regardless of delivery method. In the long term, saves hassles. Just sayin'

[KC2UGV]

Yeah. I get it.

OK, first off... yes, it's overkill (at present at least) to some degree. I wouldn't have designed the system that way... but I didn't design it. I can see what the designers did, and why... and can explain why... but if you ask me point blank if it is overkill, well, I can't deny it.


And this is my only point of contention. It's overkill.



I'm not saying that they were wrong (I'm also not saying that they were right), but only because I don't know all of the criteria behind the decision to do it this way. In other words... if this is what the client (ie the ARRL, specifically the DXCC desk, the Board, or the overpaid executives who run Newington) put in the specs, and they delievered as per the specs, they did their job.


You can be technically right, but still wrong. As in the decision to change the softlink in Ubuntu for sh from bash to dash.



So: If you think the security level is overkill, as you obviously do, I kindly suggest you take it up with your Division Director, since only the Board can mandate a change here.

Personally, I won't make such a request. Yes, I think it's a bit much, but only a bit much... and I don't find it a major inconvenience.


I find it more than a bit much, to the point of being laughable.



Now, you have to remember something... The primary purpose of Logbook of the World is to electronically confirm QSO's for the purposes of the ARRL awards program. And the reality is that there are many hams (if you want to say "too many" I won't agree but I won't argue either) who take that VERY seriously. They are the ones who want that level of security. Why? Because of the antics of people like Dr. Don Miller (ex) W9WNV (etc) and Romeo Stepanenko P5RS7 (etc) and others that haven't gotten that level of notoriety.


And, signed logs don't do anything towards that goal.



Oh, one other little thing...
You can email your signed logs to the LotW system, lotw-logs@arrl.org , and they will upload. So by your own admission, since they can be uploaded via email, you agree that the cert process is NOT unneccesary.


Yes, I admit, signed logs do serve a purpose, whose user base that would use that use case is small. The vast majority hop onto LoTW's site, and upload them there, after logging in. And, the vast majority upload their own logs.

If I wanted to upload logs from someone else? I should need to have the logs signed by that person. If I email them up, I should need to have the logs signed. If I am getting them there via packet, the logs should be signed. But these three cases make a very small minority of how the system is used.



And clearly they want to keep things simple by having all logs encrypted, regardless of delivery method. In the long term, saves hassles. Just sayin'

You can keep it simple for the vast majority of your users by not requiring them to be signed when uploaded after logging in, and only needing them signed when a third party is doing it.

[WV6Z]

Still trying to get all of the LoTW stuff to click for me and I am also trying to use it as a courtesy to those who are going for awards and etc. Everything seems to be all set up and ready to go and my cert is loaded so I seem to be ready to upload my log, but, I seem to be missing a password that is quite obviously not one of the ones I usually use (The one that it plainly states is NOT the one that ARRL provided to you, or some other such 'stuff'). Anywho, until I figure it out I will continue to use eQSL and t3H Zed's stuff I suppose. I have received many requests via both to please also confirm a QSO via LoTW and reply remains the same....... if I figure out how the hell to use such a nonsensical and non-intuitive system to handle 1/2 of my logging, I will be glad to confirm said QSO, until then..... it just ain't happenin'. I agree that certification is necessary, as it is with eQSL too, but, LoTW just has me baffled. Only sweet baby Jesus and the Good Lord himself know what my special password is, because I'm damned if I do.

[K7SGJ]

Still trying to get all of the LoTW stuff to click for me and I am also trying to use it as a courtesy to those who are going for awards and etc. Everything seems to be all set up and ready to go and my cert is loaded so I seem to be ready to upload my log, but, I seem to be missing a password that is quite obviously not one of the ones I usually use (The one that it plainly states is NOT the one that ARRL provided to you, or some other such 'stuff'). Anywho, until I figure it out I will continue to use eQSL and t3H Zed's stuff I suppose. I have received many requests via both to please also confirm a QSO via LoTW and reply remains the same....... if I figure out how the hell to use such a nonsensical and non-intuitive system to handle 1/2 of my logging, I will be glad to confirm said QSO, until then..... it just ain't happenin'. I agree that certification is necessary, as it is with eQSL too, but, LoTW just has me baffled. Only sweet baby Jesus and the Good Lord himself know what my special password is, because I'm damned if I do.

Have you tried to enter Sweet Baby Jesus as the password?

[WV6Z]

Dammit! Why the hell didn't I think of that?!?! As I am Father Jack, that would have made sense...... or maybe it's ARSE, DRINK, FECK or NUNS........ oh, woah is me.....

[WV6Z]

Or was it GOBSHITE....... oh, dammit!

[W3WN]

No, don't use "oh, dammit!". Try "Øh_damm1t!" (substitute zero for O, and one for I) Much stronger password.

[K7SGJ]

Or try the Irish password O'horseshit.

[X-Rated]

Still trying to get all of the LoTW stuff to click for me and I am also trying to use it as a courtesy to those who are going for awards and etc. Everything seems to be all set up and ready to go and my cert is loaded so I seem to be ready to upload my log, but, I seem to be missing a password that is quite obviously not one of the ones I usually use (The one that it plainly states is NOT the one that ARRL provided to you, or some other such 'stuff'). Anywho, until I figure it out I will continue to use eQSL and t3H Zed's stuff I suppose. I have received many requests via both to please also confirm a QSO via LoTW and reply remains the same....... if I figure out how the hell to use such a nonsensical and non-intuitive system to handle 1/2 of my logging, I will be glad to confirm said QSO, until then..... it just ain't happenin'. I agree that certification is necessary, as it is with eQSL too, but, LoTW just has me baffled. Only sweet baby Jesus and the Good Lord himself know what my special password is, because I'm damned if I do.

Go back and create a new cert request. When you do this, amongst other things, it will ask you to create a password. Skip over that and create no password. It is just one more thing that causes problems. Try this and see if it works better. If you look at the password creation page it says you MAY do the password thingy and that they recommend it. I mean, I don't. There are enough passwords and hoops already. Generate the request file and send it to LoTW. Wait a few hours and get your cert back and install that.

[NQ6U]

That's the advantage of being a 6-Lander: absolutely no one is going to ask for a fake confirmation because everyone already has all the 6-call QSOs they'll ever need in this lifetime after a couple of weeks of being on the air.

[N2RJ]

Go back and create a new cert request. When you do this, amongst other things, it will ask you to create a password. Skip over that and create no password. It is just one more thing that causes problems. Try this and see if it works better. If you look at the password creation page it says you MAY do the password thingy and that they recommend it. I mean, I don't. There are enough passwords and hoops already. Generate the request file and send it to LoTW. Wait a few hours and get your cert back and install that.

I have always used a password, no problems whatsoever. Been using LoTW for 7+ years now.

[X-Rated]

I have always used a password, no problems whatsoever. Been using LoTW for 7+ years now.

And I am sure your log entries are more secure. That and $2 can get you a cheap cup of coffee.

[N2RJ]

And I am sure your log entries are more secure. That and $2 can get you a cheap cup of coffee.

It's just habit. I don't even need to use my password because it's stored in my log software. I just select what I want to upload, right click, select "upload to LoTW" and it's done.

[X-Rated]

It's just habit. I don't even need to use my password because it's stored in my log software. I just select what I want to upload, right click, select "upload to LoTW" and it's done.

I totally understand. But when my friend comes on and says, "...but, I seem to be missing a password that is quite obviously not one of the ones I usually use (The one that it plainly states is NOT the one that ARRL provided to you, or some other such 'stuff'). Anywho, until I figure it out I will continue to use eQSL and t3H Zed's stuff I suppose," rather than blathering that I do not have a problem with the system, I offered a solution that I would hope would help him and others through obstacles that they seem to be incurring that I know a way around. I am glad you have not had a problem with LoTW. I am happy you use another password in the signed logs. I was hoping to start this thread in hopes of getting the discussion going that would help people and offer solutions.

[N2RJ]

Anyone can go to LoTW and create an account with my callsign (Well, not mine, I already did), request a cert, and upload logs. What's the difference?

They can't.

ARRL mails a postcard with a passcode to your FCC address. So for someone to do what you said they can do they also need to be stealing your mail and reading your e-mail, and if they are doing that you have bigger problems.


That being said: Who the fuck is going to hack a ham radio account, and start uploading logs for that person? What would be the point?

Someone who wants to win the DeSoto cup? Someone who wants to be #1 honor roll? It's a competitive international competition and nothing is wrong with having standards. And having verification keeps people honest because unfortunately people DO cheat.


Not really. It's just as hard to get a "Verified" status from eQSL as it is from LoTW. And, eQSL doesn't require signed uploads.

Not true at all. All eQSL requires is a scan of your license. You can print a fake one on the internet and be verified AG very easily.

ARRL actually sends a snail mail to verify your physical address. Hard to get in the system unless someone is stealing your postal mail.



FWIW, LoTW doesn't encrypt any logs. It signs them. That's all. Prevents adding a "Me too!" in the logs as they make their way to LoTW. When it's done directly at the LoTW site, the signed logs are superfluous. Over packet? Sure, I can see that being required. By email too. Over an SSL connection? Overkill. It's like VPN'ing your VPN connection.

Eh, SSL is so cheap these days I'm surprised more people aren't doing it.

Even this site (hamisland.net) is on SSL, right? I have no idea why Jeff did that but according to you that is overkill. Maybe it is, but a SSL cert is cheap and a SAN cert is even cheaper. It doesn't stop your office's IT department from snooping either because websense can decrypt traffic. It just requires a CA to be deployed on the client side which is easy when corporate IT can push this out as a "security fix."




The only thing that signed logs ensure is that the person who obtained the certificate is the one who generated the logs. That's it. And, it's overkill. Does your bank require you to jump through hoops to get a certificate, and sign every data transfer with them using your cert, over SSL connections?

My bank actually requires physical verification to setup an online account and all online banking is done over SSL.

If a bank has online banking that is not SSL, I wouldn't want to put my money there. Even the smallest 50 cent credit unions have SSL for online banking.

[X-Rated]

They can't.

ARRL mails a postcard with a passcode to your FCC address. So for someone to do what you said they can do they also need to be stealing your mail and reading your e-mail, and if they are doing that you have bigger problems.

Not really an obstacle. They only mail out post cards one time. After that you can phone in and get the information you need. If you target comatose hams or dead hams with active callsigns, all you need to do is to use your email when you sign them up and their family will throw the post card away. WAS would be easy without making one single radio wave.


Someone who wants to win the DeSoto cup? Someone who wants to be #1 honor roll? It's a competitive international competition and nothing is wrong with having standards. And having verification keeps people honest because unfortunately people DO cheat.

Verification of this level pisses good people off and drives them away from the system.

...


ARRL actually sends a snail mail to verify your physical address. Hard to get in the system unless someone is stealing your postal mail.

Whatever.

[N2RJ]

Most serious DXers and award chasers I know are on LoTW.

498,890,565 qsos can't be wrong.

[X-Rated]

...
498,890,565 qsos can't be wrong.

After I expose a flaw in the system that would allow false QSO's to be logged, you might want to reconsider.

[KC2UGV]

Most serious DXers and award chasers I know are on LoTW.

498,890,565 qsos can't be wrong.

I'm hazarding eQSL is about on par as well. So, they can't be wrong, correct?

[W3WN]

After I expose a flaw in the system that would allow false QSO's to be logged, you might want to reconsider.This could prove interesting.

Are you angling for a technical flaw, or are you angling for a back door via social engineering?

[X-Rated]

This could prove interesting.

Are you angling for a technical flaw, or are you angling for a back door via social engineering?

I am not the back door type.

[KC2UGV]

This could prove interesting.

Are you angling for a technical flaw, or are you angling for a back door via social engineering?

Or, just by uploading what is confirmed in another system, such as eQSL (Which most likely ensure it's been uploaded to LoTW, about 99% of the time, im my experience)?

[WØTKX]

This could prove interesting.

Are you angling for a technical flaw, or are you angling for a back door via social engineering?

Anything to break it, and cause consternation.

[N2RJ]

After I expose a flaw in the system that would allow false QSO's to be logged, you might want to reconsider.

Sure, go right ahead.

Bear in mind that I've done what you are proposing with eQSL.cc already, and people were already acknowledging the fake QSOs I put up unintentionally, and since I am AG it qualified for credit for awards, including CQ awards.

I put a stop to it as soon as I realized my mistake but not after a couple dozen QSOs got logged and acknowledged as being valid even though they were invalid.

This would have never happened with LoTW due to the digital signing requirement and the double blind matching.

[KC2UGV]

Sure, go right ahead.

Bear in mind that I've done what you are proposing with eQSL.cc already, and people were already acknowledging the fake QSOs I put up unintentionally, and since I am AG it qualified for credit for awards, including CQ awards.

I put a stop to it as soon as I realized my mistake but not after a couple dozen QSOs got logged and acknowledged as being valid even though they were invalid.

This would have never happened with LoTW due to the digital signing requirement and the double blind matching.

So, if you were to confirm the contacts on eQSL, generate an ADIF to download, sign it, and upload it to LoTW, it won't work? Works for me. Every QSO I've logged on eQSL has been matched on LoTW.

I figured a guy in IT would have a little more sense as to how the double-blind, and signing requirements do nothing the make QSO's "more valid".

[X-Rated]

Sure, go right ahead.

Bear in mind that I've done what you are proposing with eQSL.cc already, and people were already acknowledging the fake QSOs I put up unintentionally, and since I am AG it qualified for credit for awards, including CQ awards.

I put a stop to it as soon as I realized my mistake but not after a couple dozen QSOs got logged and acknowledged as being valid even though they were invalid.

This would have never happened with LoTW due to the digital signing requirement and the double blind matching.

It has nothing to do with eqsl. If the kind people at LoTW told me correctly, you don't need eqsl.

[W3WN]

I am not the back door type.Now that's a loaded straight line, especially if taken out of context. I shall refrain. This time.

[W3WN]

Sure, go right ahead.

Bear in mind that I've done what you are proposing with eQSL.cc already, and people were already acknowledging the fake QSOs I put up unintentionally, and since I am AG it qualified for credit for awards, including CQ awards.

I put a stop to it as soon as I realized my mistake but not after a couple dozen QSOs got logged and acknowledged as being valid even though they were invalid.

This would have never happened with LoTW due to the digital signing requirement and the double blind matching.I hear you.

I've had North Korea "confirmed" on eQSL for over a decade now. See?
9630
And this isn't the only hoax in the system. Some even have AG class -- and yes, I know how to do it, several ways in fact, and no, I'm not going to tell you; suffice to say it's not that hard.

The eQSL folks just don't seem to care enough about their data integrity to do anything about these.

Now, if someone is able to pull off a hoax of this nature on LotW, I'd like to see it.

The only one even close that I know of is the stunt K5WW pulled. Gert had botched his uploads, mixing some of his client's data (he's a QSL manager, if you didn't know) into his own account. The IT folks at the League didn't move fast enough to suit him, to undo the mess he created. So to "prove" how flawed the system is, he applied for WAS online, using confirmations from his clients (ie, claiming that the QSO's under those calls actually belonged to him). And then bragged about it Over Yonder.

Only thing it proved to me is that if you determined enough to upload garbage data, the system will spit out garbage results. Of course, once dared to mention in that thread that maybe the fault was his, not theirs (and even further dared to use the phrase GIGO), well, he's been pretty pissed off at me ever since. I can pretty much forget about ever bothering to request a QSL card from his "service" again. But that's another story.

[X-Rated]

I hear you.

I've had North Korea "confirmed" on eQSL for over a decade now. See?
9630
And this isn't the only hoax in the system. Some even have AG class -- and yes, I know how to do it, several ways in fact, and no, I'm not going to tell you; suffice to say it's not that hard.

The eQSL folks just don't seem to care enough about their data integrity to do anything about these.

Now, if someone is able to pull off a hoax of this nature on LotW, I'd like to see it.

The only one even close that I know of is the stunt K5WW pulled. Gert had botched his uploads, mixing some of his client's data (he's a QSL manager, if you didn't know) into his own account. The IT folks at the League didn't move fast enough to suit him, to undo the mess he created. So to "prove" how flawed the system is, he applied for WAS online, using confirmations from his clients (ie, claiming that the QSO's under those calls actually belonged to him). And then bragged about it Over Yonder.

Only thing it proved to me is that if you determined enough to upload garbage data, the system will spit out garbage results. Of course, once dared to mention in that thread that maybe the fault was his, not theirs (and even further dared to use the phrase GIGO), well, he's been pretty pissed off at me ever since. I can pretty much forget about ever bothering to request a QSL card from his "service" again. But that's another story.

A. I wanted to start this thread to allow people to know that a regular ham can get into the LoTW and to offer assistance.
B. This ham is not a smug, "I love ARRL more than my children and thinks eQSL sucks" kinda ham, but someone looking to help others into the LoTW operation.
C. I have no ax to grind. If you love LoTW and the way it works, that's great. As Corey had stated earlier though, there are a lot of people who have issues with it and there is a possibility it needs to be fixed rather than left the way it is and alienate people.
D. Before I started this thread, I searched to see if there was another thread that delved into the subject of actually having issues and getting onto LoTW, but I could find none.
E. LoTW can leave their operation the way it is and I don't have a problem with that, but their instructions are a bit cryptic in helping with this particular system. It is obvious that the system functions, but I encountered and I think others encounter ambiguities that can mislead and create issues. One of the best training videos is on youtube and not related to the ARRL. This is sad.
F. I am not looking to pull off a hoax. I am looking to make LoTW work for me and for others.
G. Since LoTW is double blind, I don't see how K5WW got his WAS with botched logs unless he was logging for both sides of the contacts.
H. The flaw in the system I found was from what the guy at the league told me. He said that the postcards were only sent out once. After the initial card, they respond to your email address. It looks like a flaw to me. I have not tested it.

EDIT: In my case, yes, they sent out the password in an email rather than a postcard this month. In a way, I guess this is testing it. They send out the password cryptically like FU***CK****YO**U and then say to disregard the asterisk type thing. But I got the post card password in my email from the league.

[W3WN]

I will be amongst the first to agree that the LotW interface is, if not antiquated, certainly showing it's age.

That it can be tedious at times for new users to gain access... and if that new user is not PC literate, sometimes it can be a real pain (if I'd charged $$ everytime I'd helped someone, I could afford to buy 4 Orion II's w/auto tuner & all filters, with change left over).

Nor would I disagree that there are things that can & should be done to streamline some of the processes, especially over some of the hoops that the DX have to jump through to get access.

The simple reality is that the ARRL upper management & staff had to be dragged kicking & screaming into the late 20th century, just to get the initial project going. And that the system has lacked major updates or other progress since it's biggest advocate, Wayne Mills N7NG, left HQ.

Some of last year's issues with speed and access FINALLY got enough users upset that enough complained to their Directors, and things finally started to get done about moving the system in the right direction. But the dinosaurs running the staff in Newington move at the pace of a glacier, especially when they are doing something that they were told to do, not what they want to do.

Somehow, though, I got the impression that this thread was more about bashing LotW & complaining the need for it. If that wasn't your intention, then I got the wrong impression.

So outside of posting here, what are you going to do about it?

... and I don't know what Gert did. I could go back at his thread Over Yonder and try to figure it out, but that is based on what he SAYS he did not, what he REALLY did, which may not be one and the same. I'm not about to ask the schmuck, either. When he returns a QSL request to me for one of his stations, with a very nasty note that boils down to "how dare you argue with me on QRZ.COM, don't ever expect a QSL card again", I have no more time to waste on him.

[KC2UGV]

I will be amongst the first to agree that the LotW interface is, if not antiquated, certainly showing it's age.

That it can be tedious at times for new users to gain access... and if that new user is not PC literate, sometimes it can be a real pain (if I'd charged $$ everytime I'd helped someone, I could afford to buy 4 Orion II's w/auto tuner & all filters, with change left over).

Nor would I disagree that there are things that can & should be done to streamline some of the processes, especially over some of the hoops that the DX have to jump through to get access.

The simple reality is that the ARRL upper management & staff had to be dragged kicking & screaming into the late 20th century, just to get the initial project going. And that the system has lacked major updates or other progress since it's biggest advocate, Wayne Mills N7NG, left HQ.

Some of last year's issues with speed and access FINALLY got enough users upset that enough complained to their Directors, and things finally started to get done about moving the system in the right direction. But the dinosaurs running the staff in Newington move at the pace of a glacier, especially when they are doing something that they were told to do, not what they want to do.

Somehow, though, I got the impression that this thread was more about bashing LotW & complaining the need for it. If that wasn't your intention, then I got the wrong impression.

So outside of posting here, what are you going to do about it?

... and I don't know what Gert did. I could go back at his thread Over Yonder and try to figure it out, but that is based on what he SAYS he did not, what he REALLY did, which may not be one and the same. I'm not about to ask the schmuck, either. When he returns a QSL request to me for one of his stations, with a very nasty note that boils down to "how dare you argue with me on QRZ.COM, don't ever expect a QSL card again", I have no more time to waste on him.

And, I agree 100% here.

I'm not saying LoTW's user verification process is bad, or their signing facility is bad, or their double-blind system is bad.

It needs changes. Serious ones. I've gotten LoTW working. It took a bit to first figure out what the hell they were trying to do (They kept saying the cert ensures no fake QSO logs are uploaded), which threw me through a loop trying to figure out why I couldn't just upload logs via the web interface.

Once I read more, and saw they are trying to make it so one person can upload 30 people's logs, I started to understand it, and got it working (I thought the key was used for me signing into the site or something).

The easiest fix they can make is to get rid of TQSL for the instance where I created my logs, and I upload them via the web interface. Leave the TQSL facility there for packet sent logs and emailed logs. That single change will make it so 99% of hams can start using it within a week (Or, however long it takes the post card to arrive).

[X-Rated]

...
So outside of posting here, what are you going to do about it?

...

Well, I plan to use LoTW and I plan to help who I can. I will not defend the way it is run or try to defend its manner of existence.

[W3WN]

Well, I plan to use LoTW and I plan to help who I can. I will not defend the way it is run or try to defend its manner of existence.Fair enough.

My point, however, is that if you want change, you have to take action. Something. Not merely posting on the forums here, or Over Yonder, or anywhere else. Write your Division Director. The ADD. The turkeys running HQ. And keep writing. If they don't hear squawking, nothing will change.

[n0iu]

Well, I plan to use LoTW and I plan to help who I can. I will not defend the way it is run or try to defend its manner of existence.
I know I am getting to this party pretty late, but...

I have been using LoTW almost since the beginning and scratch my head wondering what everyone is complaining about? Yeah, you have to jump through a lot of hoops to get it working, but once that is done, its incredibly easy to use.

I use the last free version of HRD and all I have to do is click on a log entry (or entries) and select the option to upload it to LoTW and thats it! None of this bullshit of converting the log to ADI then converting it to TQ8 and then opening up the LoTW website to upload it. Its all done in 10-15 seconds... if that long. Unless I am in a contest, I upload every contact immediately after I put it in the log so there is no backlog.

I have DXCC mixed, WAS Mixed, WAS RTTY and WAS Digital (that reminds me, I need to make an appointment with my doctor) all using LoTW and I am pretty close to other endorsements for DXCC and WAS so the system does work. Now with that being said, if I wasn't interested in working for those awards, I wouldn't be all that interested in LoTW.

[X-Rated]

I know I am getting to this party pretty late, but...

I have been using LoTW almost since the beginning and scratch my head wondering what everyone is complaining about? Yeah, you have to jump through a lot of hoops to get it working, but once that is done, its incredibly easy to use.

I use the last free version of HRD and all I have to do is click on a log entry (or entries) and select the option to upload it to LoTW and thats it! None of this bullshit of converting the log to ADI then converting it to TQ8 and then opening up the LoTW website to upload it. Its all done in 10-15 seconds... if that long. Unless I am in a contest, I upload every contact immediately after I put it in the log so there is no backlog.

I have DXCC mixed, WAS Mixed, WAS RTTY and WAS Digital (that reminds me, I need to make an appointment with my doctor) all using LoTW and I am pretty close to other endorsements for DXCC and WAS so the system does work. Now with that being said, if I wasn't interested in working for those awards, I wouldn't be all that interested in LoTW.

I speak on behalf of most people here in saying that we are proud of you.

One of my problems is finding a block of time I can devote to projects. Even in responding to this post I had to devote 20 minutes to doing chores around the house. The old noggin just doesn't remember all there is to remember. So when I originally setup LoTW a few years ago, I was interrupted during the process. I failed to remember that there was 2 passwords in the system. That is enough to screw things up when you don't know a password or have them assigned incorrectly.

I don't mind the hoops. I don't see the need for all the hoops, but I accept them. I do mind hitting brick walls. The more hoops there are, the more opportunities there are for hitting brick walls.

I like your idea with free HRD. I did not realize that it was still available. I would like to try this. But this is what the forum is all about, sharing ideas. I think that anyway.

[WX7P]

I prefer paper cards. I don't care if the cards stack up in the garage, I just like them better.

They are more of a pain in the ass, and not everyone responds, but I still like them.

[K7SGJ]

I prefer paper cards. I don't care if the cards stack up in the garage, I just like them better.

They are more of a pain in the ass, and not everyone responds, but I still like them.

^^^^^+215 Maxwells.

Me, too. And, look how valuable some have become. Of course, the down side is you have to be pretty much dead for awhile. I also prefer paper logs as I'm not in the paper chase. But, like so many things in the hobby, there is pretty much something for everyone. It's just depends on how much time and effort one wants to devote to it. Since I don't use logging programs, I can't speak to their ease or complexity of set up and use. But I'm sure it's like any challenging computer program, if you nutz around with them long enough, you'll get them to work. And, if you need help, I am sure there are others that have encountered the same issues that would be glad to help out. After all, isn't that what the idea behind the hobby is? I mean, besides saving the world, orange vests, and all that shit. It seems there is a user group for just about anything these days, somewhere.

[n0iu]

It seems there is a user group for just about anything these days, somewhere.
I have been thinking about joining this one from the Paranormal University because I am afraid of spontaneous human combustion!

http://tech.groups.yahoo.com/group/PARANORMAL-UNIVERSITY/

[K7SGJ]

I have been thinking about joing this one from the Paranormal University because I am afraid of spontaneous human combustion!

http://tech.groups.yahoo.com/group/PARANORMAL-UNIVERSITY/


Don't worry about the spontaneous aspects of it, your name has come up over and over as the one to check to bottom of the volcano. Carl accidentally dropped the Pope mobile keys in there during the last sacrifice.

[n0iu]

http://www.conferencekaul.com/wp-content/uploads/2011/09/caddyshack-05.jpg

"Dammit Carl! I said kill the gophers, NOT the golfers!