text:
LG G2 ReviewLG G2 9.4
Life hasn't been so good for LG recently, at least when it comes to the smartphone market. In the last couple of years, the company has rolled out a number of high-end, flagship phones that haven't really managed to make a dent. Do you remember the Optimus 4X HD? The Optimus G? The G Pro? OK, the manufacturer scored a sweet deal with Google for the Nexus 4, though everyone knows that the Nexus 4 is anything else but a money-maker.
So, where to now? With a competitor that is becoming increasingly unbeatable, LG needs a hero device. It needs an absolute winner in order to at least get noticed by customers drowned in a sea of Galaxies. Interestingly, while HTC has decided to differentiate from Samsung by doing the exact opposite of what the South Koreans are doing, LG has employed a completely different tactic to battle the behemoth. It's mimicking the moves of its neighbor, trying to beat it in its own game.
And this is where the LG G2 comes in. The newest flagship of the company will try to outgrow, outpace and outsmart its rival, the Galaxy S4, by packing an even larger screen, an even faster processor and even more software features that would attempt (or pretend) to make your life easier.
In the box:
- USB cable
- Wall charger
- QuadBeat 2 earphones
The G2's dimensions are still bearable. LG has done a terrific job thinning those bezels, while the nicely-curved back panel makes the handset sit comfortably in the palm of the hand. Even though the G2 is slightly bigger than the S4, we wouldn't say that LG's product is more uncomfortable to hold. In terms of weight, the G2's 5.04 oz doesn't make such a notable difference, compared to the Galaxy S4's 4.59 oz.
The most peculiar thing about the LG G2's design are the rear keys. Instead of positioning the power/lock and volume buttons on the sides of the handset, LG has placed those right on its back. This has been done for a couple of reasons. One, the side bezels have gotten so thin that the can no longer house any keys; and two, LG argues that placing the keys on the back would allow for a more intuitive access to those controls, as a user's index finger almost always defaults to that position upon picking up the phone. While we did not find the new positioning to be significantly worse than the good-old one, we can't say that it benefited our experience with the phone in any way. As a matter of fact, we feel that finding the desired rear key by touch alone is harder than finding it if it was placed somewhere around the sides of the device. Of course, this might simply be a matter of getting used to, which is why we'll continue using the handset during the days ahead and will update this review appropriately.
However, one thing we definitely didn't like about the rear volume keys is how cheap they feel – almost toy-like. Having in mind this is supposed to be a top-shelf product, LG should have tried a bit harder in this respect. Another design feature that we dislike is that the earpiece is concave, which causes a lot of dirt to permanently establish itself there. On a positive note, the manufacturer has wisely put the loudspeaker on the bottom, so that it doesn't get muffled when the device is laid on a table.
LG G2 images
LG G2 images
138.5 x 70.9 x 8.9 mm
5.04 oz (143 g)
136.6 x 69.8 x 7.9 mm
4.59 oz (130 g)
Samsung Galaxy S4
137.4 x 68.2 x 9.3 mm
5.04 oz (143 g)
HTC One
139 x 71 x 7.9 mm
5.15 oz (146 g)
Sony Xperia Z
Narrowing those bezels down has allowed LG to fit a spectacularly big screen in the still-bearable dimensions of the G2, and that's not an overstatement. We're talking of a 5.2" display here, which is 0.2" larger than what's found on the Galaxy S4, and boy is it a joy to be staring at this thing! With a resolution of 1080x1920 pixels (423 ppi) and a standard RGB matrix, this advanced IPS LCD display is extremely clean and sharp. When it comes to color balance, we can by not means say that it's bad, but it's colors are definitely towards the colder side. Don't get us wrong – it's still a great display and most users will probably not notice that the color temperature if a bit off, but when compared to the iPhone 5's display, it immediately gets noticeable that there's still some room for improvement.
The LG G2's display is very bright, and it's certainly very readable in bright daylight. It's probably not the very best out there, but it's definitely among the best in that respect. As it's now the norm, the viewing angles of this IPS LCD screen are very good, although still not perfect, as there's some noticeable brightness loss, but that's normal.
Finally, this screen's biggest advantage remains its sheer size, so if you happen to be among the users who just can have enough screen, the G2 should definitely be considered – it really makes gameplay and multimedia consumption that much more enjoyable.
Display measurements and quality
|Maximum brightness (nits)Higher is better
|Minimum brightness (nits)Lower is better
|Contrast Higher is better
|Color temperature (Kelvins)
|Delta E rgbcmy Lower is better
|Delta E grayscale Lower is better
|HTC One
|Sony Xperia Z
|Samsung Galaxy S4
The numbers below represent the amount of deviation in the respective property, observed when a display is viewed from a 45-degree angle as opposed to direct viewing.
|Maximum brightness Lower is better
|Minimum brightness Lower is better
|Contrast Lower is better
|Color temperature Lower is better
|Gamma Lower is better
|Delta E rgbcmy Lower is better
|Delta E grayscale Lower is better
|Samsung Galaxy S4
|HTC One
|Sony Xperia Z
|No data
|No data
The CIE 1931 xy color gamut chart represents the set (area) of colors that a display can reproduce, with the sRGB colorspace (the highlighted triangle) serving as reference. The chart also provides a visual representation of a display's color accuracy. The small squares across the boundaries of the triangle are the reference points for the various colors, while the small dots are the actual measurements. Ideally, each dot should be positioned on top of its respective square. The 'x: CIE31' and 'y: CIE31' values in the table below the chart indicate the position of each measurement on the chart. 'Y' shows the luminance (in nits) of each measured color, while 'Target Y' is the desired luminance level for that color. Finally, 'ΔE 2000' is the Delta E value of the measured color. Delta E values of below 2 are ideal.
This measurements are made using SpectraCal's CalMAN calibration software.
The Color accuracy chart gives an idea of how close a display's measured colors are to their referential values. The first line holds the measured (actual) colors, while the second line holds the reference (target) colors. The closer the actual colors are to the target ones, the better.
This measurements are made using SpectraCal's CalMAN calibration software.
The Grayscale accuracy chart shows whether a display has a correct white balance (balance between red, green and blue) across different levels of grey (from dark to bright). The closer the Actual colors are to the Target ones, the better.
This measurements are made using SpectraCal's CalMAN calibration software.
159 Comments
1. dickwyn (Posts: 621; Member since: 07 May 2012)
patiently waiting for the comparisons
11. Droid_X_Doug (Posts: 5993; Member since: 22 Dec 2010)
Agree. That is where the real information awaits. Interesting on its own, but compared to say, the Sony? Even the HTC One isn't that far behind for a ~6 month older phone.
Props to LG, though for stepping up their game.
16. Commentator (Posts: 3684; Member since: 16 Aug 2011)
Instead of to Moto, who stepped it back...
(Yeah yeah yeah, experience over performance, okay...)
29. Droid_X_Doug (Posts: 5993; Member since: 22 Dec 2010)
Moto's Droid offerings underwhelm with their 720p display and mushy camera function. Moto hasn't had a compelling camera offering after the Droid X. I was hoping Moto would have stepped up their game with the camera, but as you posted, more like stepping back. If the camera had been competitive, I would have even given Moto a pass on the 720p display.
145. xmusicianguy (Posts: 96; Member since: 13 Jul 2011)
This is why I have a Galaxy S4 over the Droid Ultra/Maxx. Motorola has had YEARS to step up thair game. However they never do. They are always a year behind! It's nice to have a phone that can ALMOST compete with this phone (LG G2). No Motorola phone out right now can come close. Even I can tell the G2 beats the GS4 camera hands down. But looking at where I came from with a Maxx HD. Yeah. I'm happy.
91. AnTuTu (Posts: 1580; Member since: 14 Oct 2012)
Hi Ray, you missed some points in the video:
1. Does it have NFC?
2. Has it got a removable back?
3. Can you expand storage via SD?
4. Some real usage of rear volume rocker keys?
95. special4u (Posts: 63; Member since: 22 May 2013)
ya, samsung s4 is just so old
who need removable battery when u have greater capacity power bank and no need to turn off ur phone when swap the battery.
for sd slot, i found myself doesn't used it where i used to be when cloud storage is so convenience nowadays. Perhaps some old folks still love sd slot as they havent adapt into new technology
97. AnTuTu (Posts: 1580; Member since: 14 Oct 2012)
"Perhaps some old folks still love sd slot as they haven't adapt into new technology" ?????
Does that mean Millions who have bought S4 are Old Folks who still love SD slots and haven't adapted new technology??
That's just a ridiculous comment you have made. Go do some research.
157. the.masters (Posts: 3; Member since: 08 Mar 2014)
Having a sd slot dont make the phone better and if your looking for big storige get a hdd not a phone
105. NexusKoolaid (Posts: 479; Member since: 24 Oct 2011)
@special4u - Perhaps some folks still love the SD slot because they have low data caps or don't have unlimited data plans? Maybe they don't have access to Wifi at all times of the day? Maybe they find themselves in area with poor coverage?
And does having to deal with any one of these challenges make one old?
130. mobilespecs.pk (banned) (Posts: 45; Member since: 15 Dec 2012)
Great reply +1
110. JEverettnow (Posts: 228; Member since: 11 Mar 2013)
I love having physical backups. Cloud storage isn't for me. I use dropbox, but I have a plethora of 32 and 16 gig sd cards. I want an SD card slot. Especially since SD storage capacity and speed is increasing every year.
Also, removeable batteries are great. I'm a phone tech and removing a battery can solve a lot of issues. The HTC one and Evo 4g LTE has a horrible problem with not turning back on once they fall asleep while being charged. Opening the HTC Evo 4g LTE and unplugging the battery works every time. For the one it isn't that simple. I love removeable batteries and the ability to swap them when I need extra juice and cant wait for a charge. You sir are a festigio
147. jinxed (Posts: 107; Member since: 10 Jan 2013)
i understand wad ur saying. But i had an xperia s (non removable battery)and der was dis thingy where u hold down the power button for 10 secs or sumthin and the system will power off exactly like when one removes the battery. And like u,when ma Xperia went crazy sumtyms, i just did that nd after restart worked just fine! Maybe even G2 has that. :)
121. buccob (Posts: 2564; Member since: 19 Jun 2012)
When the largest portion of the world today wants good phones but the network is poor, cloud services just dont cut it... I rather have all my music, video and pictures handy all the time, without depending on network connection...
Having options is always a plus... thats why Android is on top...
124. RiseAgainst94 (Posts: 281; Member since: 03 Mar 2012)
Samsung just got pooped on. In every way.
131. mobilespecs.pk (banned) (Posts: 45; Member since: 15 Dec 2012)
Have you seen Note 3 Yet????
134. downphoenix (Posts: 3165; Member since: 19 Jun 2010)
it also costs more, is too big to be comfortable to use, and has a stylus that most people wont need.
For the time being, G2 is on the top.
140. Michaelhall43 (Posts: 2; Member since: 15 Mar 2013)
I take it you have never used a Note device before, for any sustained period of time, because most Note users would say they got used to the size in one week.
142. mobilespecs.pk (banned) (Posts: 45; Member since: 15 Dec 2012)
Note 3 is a device with which you can actualy work. However if you just play games on a phone g2 is better
158. the.masters (Posts: 3; Member since: 08 Mar 2014)
Yes note 3 is a nice phone but plastick the only thing making it difrant is size and pen nothing more the G2 is all out difrant 1st the OIS the 1st of its kind the trim also the 1st go look at the efort that went into the phone that makes it better now look at the note3 its the note2 on crack same thing more power better look nothing more and yes i have a note3
2. HeWhoDoesNothing (Posts: 157; Member since: 15 Jul 2013)
Is there a video up? Either way, it's the G2 or the Z1, preferably both!
38. _Bone_ (Posts: 2154; Member since: 29 Oct 2012)
Usually takes some time for it to upload.
Gotta say I got caught unguarded, vowed never to have another LG device after a miserable battery failure years back with no alternative presented, but this is an absolute stunning device in every way, if this is what the Nexus 5 is based on, my Nexus 4 - coming next week - will have a short visit over here.
40. _Bone_ (Posts: 2154; Member since: 29 Oct 2012)
If I can have a small criticism about the otherwise spectacular camera: the dynamic range seems more on the average size, the same Exmor RS on the S4 Octa and the PureView 808 do a better job in more challenging bright conditions. HDR is a bit off too. That's all the negativity I can say, saturation, level of details, compression, everything is on the raw side of things.
132. mobilespecs.pk (banned) (Posts: 45; Member since: 15 Dec 2012)
For me it's Note 3
3. imkyle (Posts: 1073; Member since: 18 Nov 2010)
Was there even a mention of the phones specs as far as processor and GPU? Ant performance tests?
6. pooop (Posts: 7; Member since: 30 Aug 2013)
There's already a benchmark video; the specs are (might be off with the GPU):
-CPU: Quad-core Qualcomm Krait 400 @ 2.26GHz
-SoC: Qualcomm Snapdragon 800 MSM8974 SoC
-GPU: Adreno 330
4. Jericho (unregistered)
9.4!!!!LG G2 Rockx. NOW waiting for the Z1. LG has finally gone big with this phone.
12. GTR722 (Posts: 261; Member since: 20 Oct 2012)
Z1 and G2 are going to kill the S4...Samsung needs to hurry with the S5 xD
20. PapaSmurf (Posts: 10456; Member since: 14 May 2012)
G2 will affect the S4 sales, but Z1 won't. If the XZ didn't, what makes you think it will be different? Samsung sold over 20 million S4's already, don't see it stopping anytime soon.
22. lee480 (Posts: 197; Member since: 24 Sep 2012)
The G Pro didn't touch S4's sales. The Z did. What makes you think it will be different? Wipe your anti Sony crap here.
48. PapaSmurf (Posts: 10456; Member since: 14 May 2012)
G Pro was aimed at the Note II hence the 5.5" screen. The Z affected the S3 and the S4? Lol I'll have whatever you're smoking because it really didn't. Get that pro Sony crap out of here.
23. Long1 (banned) (Posts: 399; Member since: 18 May 2013)
"Z1 and G2 are going to kill the S4"...... NEVER.
With no SD support, and no swappable battery , all the Samsung rivals will just take the crumps.
25. Commentator (Posts: 3684; Member since: 16 Aug 2011)
Yeah, because those are OBVIOUSLY the two things consumers are clamoring for...
31. pooop (Posts: 7; Member since: 30 Aug 2013)
Actually, for some people, those things are really important. Sure, if the devices have 32GB of storage, most can be fine without the microSD card slot, but being able to remove your battery or replace it if it gets damaged or something is a nice feature. Nowadays, it's a given, unfortunately. Would love to have that back, but the G2's stolen me with everything else that is great about it (especially the 32GB of storage which should tide me over for 2 years).
34. Commentator (Posts: 3684; Member since: 16 Aug 2011)
Yeah, for "some people," but I wouldn't argue that Samsung's mainstream success has been due to its removable batteries and SD slots.
(Shout-out to me for starting two comments with "yeah"!)
159. the.masters (Posts: 3; Member since: 08 Mar 2014)
Yes for the s4 battery is a big problm g2 no prob at all so y do i need to remove it
70. taz89 (Posts: 2014; Member since: 03 May 2011)
Agree don't thinks it's something the average consumer are clamouring for but I think when they do go into a shop and say they are looking at a phone with those 2 features and a phone without it, they do take it into consideration especially if a sales person say you can add more memory for x amount or will give you a 16gb SD card for free etc, I think the average consumers might consider when it's sold to them that way. I see so many ads saying finds with free 32gb card lol my s4 cane with a free 32gb card so even though a customer might not want it, I think they might like the idea.
80. JMartin22 (Posts: 1969; Member since: 30 Apr 2013)
The G2 and some random Sony phone aren't going to be killing Samsung lol. The sales will reflect this and that's all that matters.
139. Jillxz (Posts: 149; Member since: 04 Jun 2012)
Not really they're not. The avearge consumer couldn't care less about an sd card slot and a removable battery.
146. xmusicianguy (Posts: 96; Member since: 13 Jul 2011)
I came from the Motorola Maxx HD. So I had a MASSIVE battery (non removable) and a HORRIBLE camera. To a Galaxy S4. Now I have 2, 2600 mAh batteries and an external Samsung charger. I do have to swap them durning the day sometimes. But because 1 is charging while the other is being used then I NEVER have to charge the phone itself. Now that's a downside if the phone is doing something I don't want to power it down for. But I love it compaired to the Motorola. I can see this G2 is knocking Samsung off their block. I'm not loyal to Samsung. But seeing the design of the G2 they could have made a battery removable.
39. SonyPS4 (Posts: 344; Member since: 21 May 2013)
Xperia Z and Z1 both have sd card
49. PapaSmurf (Posts: 10456; Member since: 14 May 2012)
But no removable batteries, which almost everyone I know seems to care about.
58. Commentator (Posts: 3684; Member since: 16 Aug 2011)
The last time I remember seeing "removable batteries" being marketed in any meaningful way:
I'm not saying people don't care, but I'd bet it's not a deal-breaker for most people.
Maybe if Sammy brought that commercial back now it would be a different story. People tend to want what companies advertise.
90. Long1 (banned) (Posts: 399; Member since: 18 May 2013)
I would like (because you are big fish somehow) , to see Samsung to make next GS and Note, without SD support and non-swappable battery, and then to see how much will sell. LOL.LOL.LOL
You guys are brainwashed .
122. buccob (Posts: 2564; Member since: 19 Jun 2012)
I used to care about removable batteries... but trading phones in less than 2 years make that unnecessary... also ask apple users if they care? they still are a great deal of people...
I care more about microSD support than remobable battery... last time I bought a secondary battery was for my blackberry 4 years ago.
133. mobilespecs.pk (banned) (Posts: 45; Member since: 15 Dec 2012)
Samsung have another weapon comming Galaxy Note 3. Which outclasses every smartphone in the world
106. abrahavt (Posts: 5; Member since: 10 Oct 2012)
Actually the Z1 has the same specs as this G2 and also has an SD card . The Z1 also has a camera with a bigger sensor (better low light pics) (newer and bigger sensor than the S4 and G2). If their Bravia screen is as good Sony could take over the throne of the best Android phone. We should know in a couple of days.
53. _Bone_ (Posts: 2154; Member since: 29 Oct 2012)
Don't, get this or pray to the Lord Almighty for the G2 to get Nexus'd.
5. sensefirst (Posts: 1; Member since: 31 Aug 2013)
looks very nice. Good specs too
8. PapaSmurf (Posts: 10456; Member since: 14 May 2012)
This just proves a phone doesn't have to be completely glass in order to achieve a high score. I give props to LG, this phone is a beast phone, and definitely deserves it.
9. ghassangs7 (Posts: 9; Member since: 13 Aug 2013)
This phone is crazy with uninspired design!
13. Commentator (Posts: 3684; Member since: 16 Aug 2011)
Well, I wouldn't say the back-buttons are uninspired, I'm just not sure they were inspired correctly.
I love the amount of customization LG allows with its UI, but I still hate how cartoon-y it looks. It's not 2009 any more, LG:
24. LetsBeHonest (Posts: 1442; Member since: 04 Jun 2013)
Agree it does look cartoonish...
UI should look modern like WP,Android UI
these cartoonish UI is kinda old and bored
the main reason i switched to WP is its UI
i think its fantastic modern unique lookin good job by MS.
hope LG also alter it to something close to stock.
63. Feanor (Posts: 697; Member since: 20 Jun 2012)
I agree. This seems to be a fantastic smartphone but the design is really cheap, both the hardware and the UI. If the Xperia Z1 is 80% as good a smartphone as the G2, I will go for the Sony, because it looks so much nicer and more expensive.
152. actuallyknowathingortwo (Posts: 7; Member since: 24 Sep 2013)
are you kidding???? have you not seen ios7 yet? if you think this looks cartoony check out the joke ios7 and apple are still playing on everyone! releasing a NEW iphone 5c with 1 year old specs and a 5s with a fingerprint scanner thats gonna "revolutionize" phone security. im happy another phone company besides samsung is actually improving there phones over the old models. and to anyone questioning whether or not the buttons on the back feel awkward or are misplaced.... they arent. they feel just right and actually make sense.
27. Commentator (Posts: 3684; Member since: 16 Aug 2011)
Also, camera-humps are one thing... but rear-button humps...? Is it too much to ask for a flush back from a company that isn't Apple or Sony? LG got so close, their camera lacks any kind of hump, and they blow it like this?!
30. Droid_X_Doug (Posts: 5993; Member since: 22 Dec 2010)
Rear-button hump is to 'protect' the camera lens....
35. Commentator (Posts: 3684; Member since: 16 Aug 2011)
And to accrue noticeable wear-and-tear from the pressure that's being placed on a tiny surface-area.
57. _Bone_ (Posts: 2154; Member since: 29 Oct 2012)
Completely flat back scratches like super-eary, to the point of Google adding extra bump dots to the Nexus 4. There's nothing wrong with the back buttons if it actually feels easy in the hand - which is I'm eager to test - plus you can double tap to lock or unlock, so you won't really use the power button.
LG G2OS: Android 5.0 4.4.2 4.2.2
view full specs
|5.2 inches, 1080 x 1920 pixels (423 ppi) IPS LCD
|13 megapixels
Qualcomm Snapdragon 800, Quad-core, 2260 MHz, Krait 400 processor
|5.45 x 2.79 x 0.35 inches
(138.5 x 70.9 x 8.9 mm)
5.04 oz (143 g)
|3000 mAh, 34.3 hours talk time


text:
Use G Suite on Android
This article applies only for G Suite customers. Learn more about G Suite.
Using Native Android apps
Most Android phones have mobile versions of Gmail, Calendar, Contacts, and Google Talk pre-installed. You can download other mobile apps like Google Drive for free on Google Play.
To begin using these apps, you need to add your G Suite account to your phone. You might also need to install a few apps on Google Play. For details, see Set up your Android for G Suite.
Using your phone's mobile browser
You can access many other Google products from a mobile browser. In most cases, you can just go to m.google.com in your phone's browser, touch the product you want to use, and sign in to your G Suite account. For details, see Using any smartphone's mobile browser.
Overview of Apps
Many Google products are available either as native Android apps or from the mobile browser.
- Gmail Send and receive mail. Learn more
- Google Calendar View and add calendar events.
- Google Talk Send instant messages.
- Google Drive View and edit docs. Learn more
- Contacts Manage and get in touch with your contacts.
- Google Keep Take notes even while offline. Learn more
- G Suite Lookup Quickly look up contacts at your domain. Learn more
Notice: Support for G Suite Lookup will be discontinued on September 26, 2016 and the app will be removed from Google Play. Users who have already installed G Suite Lookup will still be able to use the application, however, functionality cannot be guaranteed beyond September 26, 2016.

subset: commoncrawl


text:
The city of Milwaukee has a plan to transform foreclosured properties into urban gardens.
No email address was supplied by
To complete your registration on this site, please supply an address.
Please confirm or modify the email address to which you will have subscription offers sent.
For a more personalized experience, please supply the following optional information.


text:
Lately, Beyoncé Knowles seems to be ditching the "Halo."
With her much-talked-about Inauguration and Super Bowl performances and her revealing HBO documentary – where she showed off adorable daughter Blue Ivy, 1 – we've been seeing a lot of Queen Bey as of late.
But after a steamy (pants-less!) GQ cover shoot, her smoldering Super Bowl costume and a controversial new single, we're wondering if she's adding "bad girl" to her monikers.
She posted a new track (or what may very well be two tracks), "Bow Down/I Been On," on her Tumblr page last week, presented with a sweet-looking picture of herself as a young girl, in a ball gown and tiara. And the new music is drawing raves (and rants) from millions of fans online.
"Bow Down," presumably off of her yet-to-be-announced new album (rumored to be called Mrs. Carter), has an edgy hip-hop sound and some explicit lyrics.
"I know when you were little girls, you dreamed of being in my world," she sings. "Don't forget it, don't forget it, respect that, bow down b––."
Beyoncé Gone Bad? Weigh In on Her New Song
Courtesy Beyonce


text:
PK ��Foa�, mimetypeapplication/epub+zipPK ��F OEBPS/authmeth.htm ��
Authentication means verifying the identity of someone (a user, device, or an entity) who wants to access data, resources, or applications. Validating that identity establishes a trust relationship for further interactions. Authentication also enables accountability by making it possible to link access and actions to specific identities. After authentication, authorization processes can allow or limit the levels of access and action permitted to that entity as described in Chapter 5, "Authorization: Privileges, Roles, Profiles, and Resource Limitations".
Oracle allows a single database instance to use any or all methods. Oracle requires special authentication procedures for database administrators, because they perform special database operations. Oracle also encrypts passwords during transmission to ensure the security of network authentication.
To validate the identity of database users and prevent unauthorized use of a database user name, you can authenticate users by using any combination of the methods described in the following sections:
|Authentication Considerations About ...
|Links to Topics
|Operating Systems
|Authentication by the Operating System
|Networks and LDAP Directories
|Authentication by the Network
|Authentication by Oracle Database
|Multitier Systems
|Multitier Authentication and Authorization
|Secure Socket Layer Usage
|Authentication of Database Administrators
|Database Administrators
|Authentication of Database Administrators
See Also:
Some operating systems permit Oracle to use information they maintain to authenticate users. This has the following benefits:
Once authenticated by the operating system, users can connect to Oracle more conveniently, without specifying a user name or password. For example, an operating-system-authenticated user can invoke SQL*Plus and skip the user name and password prompts by entering the following:
With control over user authentication centralized in the operating system, Oracle need not store or manage user passwords, though it still maintains user names in the database.
Audit trails in the database and operating system can use the same user names.
When an operating system is used to authenticate database users, managing distributed database environments and database links requires special care.
See Also:
Authentication over a network is handled by the SSL protocol or by third-party services as described in the following subsections:
The Secure Socket Layer (SSL) protocol is an application layer protocol. It can be used for user authentication to a database, and it is independent of global user management in Oracle Internet Directory. That is, users can use SSL to authenticate to the database even without a directory server in place.
Authentication over a network makes use of third-party network authentication services. Prominent examples include Kerberos, Public Key Infrastructure (PKI), the Remote Authentication Dial-In User Service (RADIUS), and directory-based services, as described in the following subsections.
If network authentication services are available to you, then Oracle can accept authentication from the network service. If you use a network authentication service, then some special considerations arise for network roles and database links.
Note:To use a network authentication service with Oracle, you need Oracle Enterprise Edition with the Oracle Advanced Security option.
See Also:
Kerberos is a trusted third-party authentication system that relies on shared secrets. It presumes that the third party is secure, and provides single sign-on capabilities, centralized password storage, database link authentication, and enhanced PC security. It does this through a Kerberos authentication server, or through Cybersafe Active Trust, a commercial Kerberos-based authentication server.
See Also:Oracle Database Advanced Security Administrator's Guide for more information about Kerberos.
Authentication systems based on PKI issue digital certificates to user clients, which use them to authenticate directly to servers in the enterprise without directly involving an authentication server. Oracle provides a PKI for using public keys and certificates, consisting of the following components:
Authentication and secure session key management using SSL.
Oracle Call Interface (OCI) and PL/SQL functions
These are used to sign user-specified data using a private key and certificate. The verification of the signature on data is done by using a trusted certificate.
Trusted certificates
These are used to identify third-party entities that are trusted as signers of user certificates when an identity is being validated. When the user certificate is being validated, the signer is checked by using trust points or a trusted certificate chain of certificate authorities stored in the validating system. If there are several levels of trusted certificates in this chain, then a trusted certificate at a lower level is simply trusted without needing to have all its higher-level certificates reverified.
These are data structures that contain the private key of a user, a user certificate, and the set of trust points of a user (trusted certificate authorities).
OracleAS Certificate Authority
This is a component of the Oracle Identity Management infrastructure, which provides an integrated solution for provisioning X.509 version 3 certificates for individuals, applications, and servers that require certificates for PKI-based operations such as authentication, SSL, S/MIME, and so on.
This is a standalone Java application used to manage and edit the security credentials in Oracle wallets. It performs the following operations:
Protects user keys
Manages X.509 version 3 certificates on Oracle clients and servers
Generates a public-private key pair and creates a certificate request for submission to a certificate authority
Installs a certificate for the entity
Configures trusted certificates for the entity
Creates wallets
Opens a wallet to enable access to PKI-based services
X.509 version 3 certificates obtained from (and signed by) a trusted entity, a certificate authority. Because the certificate authority is trusted, these certificates certify that the requesting entity's information is correct and that the public key on the certificate belongs to the identified entity. The certificate is loaded into an Oracle wallet to enable future authentication.
Oracle public key infrastructure is illustrated in Figure 4-1.
Oracle supports remote authentication of users through the Remote Authentication Dial-In User Service (RADIUS), a standard lightweight protocol used for user authentication, authorization, and accounting.
See Also:Oracle Database Advanced Security Administrator's Guide for information about Oracle Advanced Security
Using a central directory can make authentication and its administration extremely efficient. Directory-based sevices include the following:
Oracle Internet Directory, which uses the Lightweight Directory Access Protocol (LDAP), enables information about users (called enterprise users) to be stored and managed centrally. Although database users must be created (with passwords) in each database that they need to access, enterprise user information is accessible centrally in the Oracle Internet Directory. You can also integrate this directory with Active Directory and iPlanet.
Oracle Internet Directory lets you manage the security attributes and privileges for users, including users authenticated by X.509 certificates. Oracle Internet Directory also enforces attribute-level access control. This feature enables read, write, or update privileges on specific attributes to be restricted to specific users, such as an enterprise security administrator. Directory queries and responses can use SSL encryption for enhanced protection during authentication and other interactions.
Oracle Enterprise Security Manager, which provides centralized privilege management to make administration easier and increase security levels. Oracle Enterprise Security Manager lets you store and retrieve roles from Oracle Internet Directory.
Oracle Database can authenticate users attempting to connect to a database, by using information stored in that database itself. To set up Oracle Database to use database authentication, you must create each user with an associated password. The user must provide this user name and password when attempting to establish a connection. This process prevents unauthorized use of the database, because the connection will be denied if the user provides an incorrect password. Oracle Database stores user passwords in the data dictionary in an encrypted format to prevent unauthorized alteration. Users can change their passwords at any time.
To identify the authentication protocols that are allowed by a client or a database, a DBA can explicitly set the
SQLNET.ALLOWED_LOGON_VERSION parameter in the server
sqlnet.ora file. Then each connection attempt is tested, and if the client or server does not meet the minimum version specified by its partner, authentication fails with an ORA-28040 error. The parameter can take the values 10, 9, or 8, which is the default. These values represent database server versions. Oracle recommends the value 10.
Database authentication includes the following features:
Password Encryption While Connecting. This protection is always in force, by default.
Passwords are always automatically and transparently encrypted during network (client/server and server/server) connections, using AES (Advanced Encryption Standard) before sending them across the network.
See Also:For more information about encrypting passwords in network systems, refer to:
Oracle can lock a user's account after a specified number of consecutive failed login attempts. You can configure the account to unlock automatically after a specified time interval or to require database administrator intervention to be unlocked.
Use the
PROFILE statement to establish how many failed login attempts a user can attempt before the account locks, and how long it remains locked before it unlocks automatically.
The database administrator can also lock accounts manually, so that they cannot unlock automatically but must be unlocked explicitly by the database administrator.
See Also:"Profiles"
Note:Failed login attempts will be limited by default in future Oracle Database releases.
The database administrator can specify a lifetime for passwords, after which they expire and must be changed before account login is again permitted. A grace period can be established, during which each attempt to login to the database account receives a warning message to change the password. If it is not changed by the end of that period, then the account is locked. No further logins to that account are allowed without assistance by the database administrator.
The database administrator can also set the password state to expired, causing the user account status to change to expired. The user or the database administrator must then change the password before the user can log in to the database.
See Also:Password Management Policy in Chapter 7, "Security Policies"
The password history option checks each newly specified password to ensure that a password is not reused for a specified amount of time or for a specified number of password changes. The database administrator can configure the rules for password reuse with
PROFILE statements.
See Also:
Complexity verification checks that each password is complex enough to provide reasonable protection against intruders who try to break into the system by guessing passwords.
The sample Oracle password complexity verification routine (the PL/SQL script
UTLPWDMG.SQL, which sets the default profile parameters) checks that each password meet the following requirements:
Be a minimum of four characters in length
Not equal the userid
Include at least one alphabet character, one numeric character, and one punctuation mark
Not match any word on an internal list of simple words like welcome, account, database, user, and so on
Differ from the previous password by at least three characters
See Also:Discussion about Password Complexity Verification.
In a multitier environment, Oracle controls the security of middle-tier applications by limiting their privileges, preserving client identities through all tiers, and auditing actions taken on behalf of clients. In applications that use a heavy middle tier, such as a transaction processing monitor, the identity of the clients connecting to the middle tier must be preserved. One advantage of using a middle tier is connection pooling, which allows multiple users to access a data server without each of them needing a separate connection. In such environments, you need to be able to set up and break down connections very quickly.
For these environments, Oracle database administrators can use the Oracle Call Interface to create lightweight sessions, which allow database password authentication for each user. This method preserves the identity of the real user through the middle tier without the overhead of a separate database connection for each user.
You can create lightweight sessions with or without passwords. However, if a middle tier is outside or on a firewall, then security is better when each lightweight session has its own password. For an internal application server, lightweight sessions without passwords might be appropriate.
Issues of administration and security in multitier environments are discussed in the following sections:
In a multitier environment, an application server provides data for clients and serves as an interface from them to one or more database servers. The application server can validate the credentials of a client, such as a web browser, and the database server can audit operations performed by the application server. These auditable operations include actions performed by the application server on behalf of clients, such as requests that information be displayed on the client. A request to connect to the database server is an example of an application server operation not related to a specific client.
Note:While client-side authentication is possible, Oracle strongly recommends disabling it by setting the
remote_os_authentication parameter to
Authentication in a multitier environment is based on trust regions. Client authentication is the domain of the application server. The application server itself is authenticated by the database server. The following operations are performed:
The client provides proof of authenticity to the application server, typically, by using a password or an X.509 certificate.
The application server authenticates the client and then authenticates itself to the database server.
The database server authenticates the application server, verifies that the client exists, and verifies that the application server has the privilege to connect for this client.
Application servers can also enable roles for a client on whose behalf they connect. The application server can obtain these roles from a directory, which thus serves as an authorization repository. The application server can only request that these roles be enabled. The database verifies the following requirements:
That the client has these roles by checking its internal role repository
That the application server has the privilege to connect on behalf of the user, and thus to use these roles as the user could
Figure 4-2 shows an example of multitier authentication.
Security for middle-tier applications must address the following key issues:
Accountability: The database server must be able to distinguish between the actions of a client and the actions an application takes on behalf of a client. It must be possible to audit both kinds of actions.
Diff� m�erentiation: The database server must be able to distinguish between a client accessing the database directly and an application server acting either for itself or on behalf of a browser client.
Least privilege: Users and middle tiers should be given the fewest privileges necessary to perform their actions, to minimize the danger of inadvertent or malicious unauthorized activities.
Multitier authentication maintains the identity of the client through all tiers of the connection in order to maintain useful audit records. If the identity of the originating client is lost, then specific accountability of that client is lost. It becomes impossible to distinguish operations performed by the application server on behalf of the client from those done by the application server by itself.
Privileges in a multitier environment must be limited to those necessary to perform the requested operation.
Client privileges must be as limited as possible in a multitier environment. Operations are performed on behalf of the client by the application server.
Application server privileges in a multitier environment must also be limited, so that the application server cannot perform unwanted or unneeded operations while performing a client operation.
See Also:Chapter 10, "Administering Authentication", and the Oracle Database Administrator's Guide, for more information about multitier authentication
Database administrators perform special operations (such as shutting down or starting up a database) that should not be performed by normal database users. Oracle provides for secure authentication of database administrator user names, for which you can choose either operating system authentication or password files.
Figure 4-3 illustrates the choices you have for database administrator authentication schemes. Different choices apply to administering your database locally (on the machine where the database resides) and to administering many different database machines from a single remote client.
Operating system authentication for a database administrator typically involves establishing a group on the operating system, assigning DBA privileges to that group, and then adding the names of persons who should have those privileges to that group. On UNIX systems, the special group is called the dba group.
On Microsoft Windows systems, users who connect with the
SYSDBA privilege can take advantage of the Windows native authentication. If these users work with Oracle Database using their domain accounts, then you must explicitly grant them local administrative privileges and
ORA_DBA membership.
The database uses password files to keep track of those database user names that have been granted the
SYSDBA and
SYSOPER privileges. These privileges enable the following operations and capabilities:
SYSOPER lets database administrators perform
LOG, and
SYSOPER also includes the
SESSION privilege.
SYSDBA has all system privileges with
OPTION, including the
SYSOPER system privilege, and permits
DATABASE and time-based recovery.
Note:Connections requested
AS SYSDBA or
AS SYSOPER must use these phrases; without them, the connection fails. The Oracle parameter
07_DICTIONARY_ACCESSIBILITY is set to
FALSE by default, to limit sensitive data dictionary access only to those authorized. The parameter also enforces the required
AS SYSDBA or
AS SYSOPER syntax.
See Also:
Oracle Database 10g Release 2 (10.2) enhances password file based authentication by making it easier to use. The following enhancements have been made:
Password file based authentication is enabled by default. This means that the database is ready to use a password file for authenticating users that have
SYSDBA or
SYSOPER system privileges. Password file based authentication is activated as soon as you create a password file using the
ORAPWD utility.
A password file containing users with
SYSDBA or
SYSOPER privileges can be shared between different databases. You can have a shared password file that contains users in addition to the
SYS user.
Note:In order to share a password file between different databases, the
REMOTE_LOGIN_PASSWORDFILE parameter needs to be changed to
SHARED in the
init.ora file. The default value of this parameter is
EXCLUSIVE. This is the recommended setting.
Security considerations range from requiring backups to be done regularly and stored off-site to narrow table or data considerations, which include ensuring that unauthorized access to sensitive data, such as employee salaries, is precluded by built-in restrictions on every type of access to the table that contains them.
This chapter discusses security policies in the following sections:
This section describes the different aspects of system security policy, and contains the following topics:
Each database has one or more administrators who are responsible for maintaining all aspects of the security policy: the security administrators. If the database system is small, then the database administrator may have the responsibilities of the security administrator. However, if the database system is large, then a special person or group of people may have responsibilities limited to those of a security administrator.
After deciding who will manage the security of the system, a security policy must be developed for every database. A database security policy should include several sub-policies, as explained in the following sections.
Database users are the access paths to the information in an Oracle database. Therefore, tight security should be maintained for the management of database users. Depending on the size of a database system and the amount of work required to manage database users, the security administrator may be the only user with the privileges required to create, alter, or drop database users. On the other hand, there may be a number of administrators with privileges to manage database users. In any case, only trusted individuals should have the powerful privileges to administer database users.
See Also:Oracle Database Administrator's Guide
Database users can be authenticated (verified as the correct person) by Oracle using database passwords, the host operating system, network services, or by Secure Sockets Layer (SSL).
Note:To be authenticated using network authentication services or SSL requires that you have Oracle Advanced Security installed. Refer to the Oracle Database Advanced Security Administrator's Guide for information about these types of authentication.
User authentication and how it is specified is discussed in "User Authentication Methods".
The following security issues must also be considered for the operating system environment executing Oracle and any database applications:
Database administrators must have the operating system privileges to create and delete files.
Typical database users should not have the operating system privileges to create or delete files related to the database.
If the operating system identifies database roles for users, then the security administrators must have the operating system privileges to modify the security domain of operating system accounts.
See Also:Operating-system-specific Oracle documentation for more information about operating system security issues
Data security includes the mechanisms that control the access to and use of the database at the object level. Your data security policy determines which users have access to a specific schema object, and the specific types of actions allowed for each user on the object. For example, the policy could establish that user
scott can issue
SELECT and
INSERT statements but not
DELETE statements using the
emp table. Your data security policy should also define the actions, if any, that are audited for each schema object.
Primarily, the level of security you want to establish for the data in your database determines your data security policy. For example, it may be acceptable to have little data security in a database when you want to allow any user to create any schema object, or grant access privileges for their objects to any other user of the system. Alternatively, it might be necessary for data security to be very controlled when you want to allow only a database or security administrator to create objects and grant access privileges for objects to roles and users.
Overall data security should be based on the sensitivity of data. If information is not sensitive, then the data security policy can be more lax. However, if data is sensitive, then a security policy should be developed to maintain tight control over access to objects.
Some means of implementing data security include system and object privileges, and through roles. A role is a set of privileges grouped together that can be granted to users.
See Also:Privileges and roles are discussed in Chapter 11, "Administering User Privileges, Roles, and Profiles"
Views can also implement data security because their definition can restrict access to table data. They can exclude columns containing sensitive data.
Another means of implementing data security is through fine-grained access control and use of an associated application context. Fine-grained access control is a feature of Oracle Database that enables you to implement security policies with functions, and to associate those security policies with tables or views. In effect, the security policy function generates a
WHERE condition that is appended to relevant SQL statements, thereby restricting user access to rows of data in the table or view. An application context is a secure data cache for storing information used to make access control decisions.
This section describes aspects of user security policy, and contains the following topics:
For all types of database users, consider the following general user security issues:
If user authentication is managed by the database, then security administrators should develop a password security policy to maintain database access security. For example, database users should be required to change their passwords at regular intervals, and of course, when their passwords are revealed to others. By forcing a user to modify passwords in such situations, unauthorized database access can be reduced.
Passwords are always automatically and transparently encrypted during network (client/server and server/server) connections, by using the AES (Advanced Encryption Standard) algorithm, before sending them across the network.
Security administrators should consider issues related to privilege management for all types of users. For example, in a database with many user names, it may be beneficial to use roles (named groups of related privileges that you grant to users or other roles) to manage the privileges available to users. Alternatively, in a database with a handful of user names, it may be easier to grant privileges explicitly to users and avoid the use of roles.
Security administrators managing a database with many users, applications, or objects should take advantage of the benefits offered by roles. Roles greatly simplify the task of privilege management in complicated environments.
Security administrators must define a policy for end-user security. If a database has many users, then the security administrator can decide which groups of users can be categorized into user groups, and then create user roles for these groups. The security administrator can grant the necessary privileges or application roles to each user role, and assign the user roles to the users. To account for exceptions, the security administrator must also decide what privileges must be explicitly granted to individual users.
Roles are the easiest way to grant and manage the common privileges needed by different groups of database users.
Consider a situation where every user in the accounting department of a company needs the privileges to run the accounts receivable and accounts payable database applications (
ACCTS_REC and
ACCTS_PAY). Roles are associated with both applications, and they contain the object privileges necessary to execute those applications.
The following actions, performed by the database or security administrator, address this simple security situation:
Grant the roles for the
ACCTS_REC and
ACCTS_PAY database applications to the
accountant role.
Grant each user of the accounting department the
accountant role.
This security model is illustrated in Figure 7-1.
This plan addresses the following potential situations:
If accountants subsequently need a role for a new database application, then the role for that application can be granted to the
accountant role, and all users in the accounting department will automatically receive the privileges associated with the new database application. The role for the new application does not need to be granted to individual users requiring use of the application.
Similarly, if the accounting department no longer requires the need for a specific application, then the role associated with that application can be dropped from the
accountant role.
If the privileges required by the
ACCTS_REC and
ACCTS_PAY applications change, then the new privileges can be granted to, or revoked from, the role associated with the application. The security domain of the
accountant role, and all users granted the
accountant role, automatically reflect the privilege modification.
Use roles in all possible situations to make end-user privilege management efficient and simple.
You can also manage users and their authorizations centrally in a directory service through the enterprise user and enterprise role features of Oracle Advanced Security. See the Oracle Database Advanced Security Administrator's Guide for information about this functionality.
Security administrators should also have a policy addressing database administrator security. For example, when the database is large and there are several types of database administrators, the security administrator may decide to group related administrative privileges into several administrative roles. The administrative roles can then be granted to appropriate administrator users. Alternatively, when the database is small and has only a few administrators, it may be more convenient to create one administrative role and grant it to all administrators.
After database creation, if you used the default passwords for
SYS and
SYSTEM, then change the passwords for the
SYS and
SYSTEM administrative user names immediately. Connecting as
SYS or
SYSTEM gives a user powerful privileges to modify a database. For example, connecting as
SYS allows a user to alter data dictionary tables. The privileges associated with these user names are extremely sensitive, and should only be available to select database administrators.
If you have installed options that have caused other administrative user names to be created, then such user name accounts are initially created locked. To unlock these accounts, use the
ALTER USER statement. The
ALTER USER statement should also be used to change the associated passwords for these accounts.
The passwords for these accounts can be modified by using the procedures described in "Altering Users".
Only database administrators should be able to connect to a database with administrative privileges. For example:
CONNECT username/password AS SYSDBA/SYSOPER
Connecting as
SYSOPER gives a user the ability to perform basic operational tasks (such as
SHUTDOWN, and recovery operations). Connecting as
SYSDBA gives the user these abilities plus unrestricted privileges to perform any actions with a database or the objects within a database (including,
DROP, and
DELETE). Connecting as
SYSDBA places a user in the
SYS schema, where he can alter data dictionary tables.
Roles are the easiest way to restrict the powerful system privileges and roles required by personnel administrating the database.
Consider a scenario where the database administrator responsibilities at a large installation are shared among several database administrators, each responsible for the following specific database management jobs:
Object creation and maintenance
Database tuning and performance
Creation of new users and granting roles and privileges to database users
Routine database operation (for example:
SHUTDOWN, and backup and recovery operations)
Emergency situations, such as database recovery
There are also new, inexperienced database administrators needing limited capabilities to experiment with database management
In this scenario, the security administrator should structure the security for administrative personnel as follows:
Define six roles to contain the distinct privileges required to accomplish each type of job (for example,
Grant each role the appropriate privileges.
Grant each type of database administrator the corresponding role.
This plan reduces the likelihood of future problems in the following ways:
If a database administrator job description changes to include more responsibilities, then that database administrator can be granted other administrative roles corresponding to the new responsibilities.
If a database administrator job description changes to include fewer responsibilities, then that database administrator can have the appropriate administrative roles revoked.
The data dictionary always stores information about each role and each user, so information is available to disclose the task of each administrator.
Security administrators must define a special security policy for the application developers using a database. A security administrator could grant the privileges to create necessary objects to application developers. Alternatively, the privileges to create objects could be granted only to a database administrator, who then receives requests for object creation from developers.
Database application developers are unique database users who require special groups of privileges to accomplish their jobs. Unlike end users, developers need system privileges, such as
CREATE PROCEDURE, and so on. However, only specific system privileges should be granted to developers to restrict their overall capabilities in the database.
In many cases, application development is restricted to test databases and is not allowed on production databases. This restriction ensures that application developers do not compete with end users for database resources, and that they cannot detrimentally affect a production database.
After an application has been thoroughly developed and tested, it is permitted access to the production database and made available to the appropriate end users of the production database.
The database administrator can define the following options when determining which privileges should be granted to application developers:
An application developer is allowed to create new schema objects, including tables, indexes, procedures, packages, and so on. This option allows the application developer to develop an application independent of other objects.
An application developer is not allowed to create new schema objects. A database administrator creates all required tables, indexes, procedures, and so on, as requested by an application developer. This option allows the database administrator to completely control the space usage of a database and the access paths to information in the database.
Although some database systems use only one of these options, other systems could mix them. For example, application developers can be allowed to create new stored procedures and packages, but not allowed to create tables or indexes. Security administrators should base their decision on the following:
The control desired over the space usage of a database
The control desired over the access paths to schema objects
The database used to develop applications If a test database is being used for application development, then a more liberal development policy would be in order.
Security administrators can create roles to manage the privileges required by the typical application developer. For example, a typical role named
APPLICATION_DEVELOPER might include the
CREATE VIEW, and
CREATE PROCEDURE system privileges. Consider the following when defining roles for application developers:
CREATE system privileges are usually granted to application developers so that they can create their own objects. However,
CREATE ANY system privileges, which allow a user to create an object in any user schema, are not usually granted to developers. This restricts the creation of new objects only to the developer user account.
Object privileges are rarely granted to roles used by application developers, because granting object privileges through roles often restricts their usability in creating other objects (primarily views and stored procedures). It is more practical to allow application developers to create their own objects for development purposes.
While application developers are typically given the privileges to create objects as part of the development process, security administrators must maintain limits on what and how much database space can be used by each application developer. For example, as the security administrator, you should specifically set limits or restrict access to the following for each application developer:
The tablespaces in which the developer can create tables or indexes
The quota for each tablespace accessible to the developer
Both limitations can be set by altering a developer's security domain. This is discussed in Altering Users.
In large database systems with many database applications, you might consider assigning application administrators. An application administrator is responsible for the following types of tasks:
Creating roles for an application and managing the privileges of each application role
Creating and managing the objects used by a database application
Maintaining and updating the application code and Oracle procedures and packages as necessary
Often, an application administrator is also the application developer �� who designed an application. However, an application administrator could be any individual familiar with the database application.
Database security systems that are dependent on passwords require that passwords be kept secret at all times. Because passwords are vulnerable to theft, forgery, and misuse, Oracle Database uses a password management policy. DBAs and security officers control this policy through user profiles, enabling greater control over database security.
Use the
CREATE PROFILE statement to create a user profile. The profile is assigned to a user with the
CREATE USER or
ALTER USER statement. Details of creating and altering database users are not discussed in this section. This section is concerned with the password parameters that can be specified using the
CREATE PROFILE (or
ALTER PROFILE) statement.
This section contains the following topics relating to Oracle password management:
Password Complexity Verification
See Also:
When a particular user exceeds a designated number of failed login attempts, the server automatically locks that user account. You specify the permissible number of failed login attempts using the
CREATE PROFILE statement. You can also specify the amount of time accounts remain locked.
In the following example, the maximum number of failed login attempts for the user
johndoe is four, and the amount of time the account will remain locked is 30 days. The account will unlock automatically after the passage of 30 days.
CREATE PROFILE prof LIMIT FAILED_LOGIN_ATTEMPTS 4 PASSWORD_LOCK_TIME 30; ALTER USER johndoe PROFILE prof;
If you do not specify a time interval for unlocking the account, then
PASSWORD_LOCK_TIME assumes the value specified in a default profile. If you specify
PASSWORD_LOCK_TIME as
UNLIMITED, then the account must be explicitly unlocked using an
ALTER USER statement. For example, assuming that
UNLIMITED is specified for
johndoe, then the following statement must be used to unlock the account:
ALTER USER johndoe ACCOUNT UNLOCK;
After a user successfully logs into an account, the unsuccessful login attempt count for the user, if it exists, is reset to 0.
The security officer can also explicitly lock user accounts. When this occurs, the account cannot be unlocked automatically, and only the security officer should unlock the account. The
CREATE USER or
ALTER USER statements are used to explicitly lock or unlock user accounts. For example, the following statement locks the user account,
ALTER USER susan ACCOUNT LOCK;
Use the
CREATE PROFILE statement to specify a maximum lifetime for passwords. When the specified amount of time passes and the password expires, the user or DBA must change the password. The following statements create and assign a profile to user
johndoe, and the
PASSWORD_LIFE_TIME clause specifies that
johndoe can use the same password for 90 days before it expires.
CREATE PROFILE prof LIMIT FAILED_LOGIN_ATTEMPTS 4 PASSWORD_LOCK_TIME 30 PASSWORD_LIFE_TIME 90; ALTER USER johndoe PROFILE prof;
You can also specify a grace period for password expiration. Users enter the grace period upon the first attempt to log in to a database account after their password has expired. During the grace period, a warning message appears each time users try to log in to their accounts, and continues to appear until the grace period expires. Users must change the password within the grace period. If the password is not changed within the grace period, then users are prompted for a new password each time an attempt is made to access their accounts. Access to an account is denied until a new password is supplied.
Figure 7-2 shows the chronology of the password lifetime and grace period.
In the following example, the profile assigned to
johndoe includes the specification of a grace period:
PASSWORD_GRACE_TIME = 3. The first time
johndoe tries to log in to the database after 90 days (this can be any day after the 90th day, that is, the 70th day, 100th day, or another day), he receives a warning message that his password will expire in three days. If three days pass, and he does not change her password, then the password expires. After this, he receives a prompt to change his password on any attempt to log in, and cannot log in until he does so.
CREATE PROFILE prof LIMIT FAILED_LOGIN_ATTEMPTS 4 PASSWORD_LOCK_TIME 30 PASSWORD_LIFE_TIME 90 PASSWORD_GRACE_TIME 3; ALTER USER johndoe PROFILE prof;
Oracle provides a means of explicitly expiring a password. The
CREATE USER and
ALTER USER statements provide this functionality. The following statement creates a user with an expired password. This setting forces the user to change the password before the user can log in to the database.
CREATE USER jbrown IDENTIFIED BY zX83yT ... PASSWORD EXPIRE;
Be careful if you plan to set the
PASSWORD_LIFE_TIME parameter of
CREATE PROFILE or
ALTER PROFILE to a low value (for example, 1 day). If the user who is assigned this profile is concurrently logged in when you make this modification, then Oracle Database sets the user's account status from
OPEN to
EXPIRED(GRACE)with the warning error
ORA-28002: the password will expire within n days. You may not be notified of this change because the user can still connect to the Oracle database. You can find the concurrently logged in users by querying the
USERNAME column of the
V$SESSION dyanmic performance view.
Note the following:
If the user is not logged in when you set
PASSWORD_LIFE_TIME to a low value, then the user's account status does not change when the user does log in.
You can set the user's
PASSWORD_LIFE_TIME option to
UNLIMITED, but this only affects accounts that have not entered their grace period. If the user has already entered the grace period, then he or she must change the password.
The following two parameters control user ability to reuse an old password:
Table 7-1 Parameters Controlling Reuse of an Old Password
|Parameter Name
|Description and Use
Requires either of the following:
Requires either of the following:
If you specify neither, then the user can reuse passwords at any time, which is not a good security practice.
If neither parameter is
UNLIMITED, then password reuse is allowed, but only after meeting both conditions. The user must have changed the password the specified number of times, and the specified number of days must have passed since the old password was last used.
For example, suppose that the user A's profile had
PASSWORD_REUSE_MAX set to
10 and
PASSWORD_REUSE_TIME set to
30. Then user A cannot reuse a password until the password has been reset 10 times, and until 30 days had passed since the password was last used.
If either parameter is specified as
UNLIMITED, then the user can never reuse a password.
If both parameters are set to
UNLIMITED, then Oracle ignores both, and the user can reuse any password at any time.
Note:If you specify
DEFAULT for either parameter, then Oracle uses the value defined in the
DEFAULT profile, which sets all parameters to
UNLIMITED. Oracle thus uses
UNLIMITED for any parameter specified as
DEFAULT, unless you change the setting for that parameter in the
DEFAULT profile.
Oracle sample password complexity verification routine can be specified using a PL/SQL script (
UTLPWDMG.SQL), which sets the default profile parameters.
The password complexity verification routine ensures that the password meets the following requirements:
Is at least four characters long
Differs from the user name
Has at least one alpha, one numeric, and one punctuation mark character
Is not simple or obvious, such as
database, or
Differs from the previous password by at least 3 characters
ALTER USER command now has a
REPLACE clause by using which users can change their own unexpired passwords by supplying the old password to authenticate themselves.
If the password has expired, then the user cannot log in to SQL to issue the
A DBA with
You can enhance the existing password verification complexity routine or create other password verification routines using PL/SQL or third-party tools.
The PL/SQL call must adhere to the following format:
routine_name ( userid_parameter IN VARCHAR(30), password_parameter IN VARCHAR (30), old_password_parameter IN VARCHAR (30) ) RETURN BOOLEAN
After a new routine is created, it must be assigned as the password verification routine by using the user profile or the system default profile.
CREATE/ALTER PROFILE profile_name LIMIT
PASSWORD_VERIFY_FUNCTION routine_name
The password verification routine must be owned by the
SYS user.
You can use the following sample password verification routine as a model when developing your own complexity checks for a new password.
The default password complexity function performs the following minimum complexity checks:
The password satisfies minimum length requirements.
The password is not the username. You can modify this function based on your requirements.
This function must be created in
SYS schema, and you must
SYSDBA before running the script.
CREATE OR REPLACE FUNCTION verify_function (username varchar2, password varchar2, old_password varchar2) RETURN boolean IS n boolean; m integer; differ integer; isdigit boolean; ischar boolean; ispunct boolean; digitarray varchar2(20); punctarray varchar2(25); chararray varchar2(52); BEGIN digitarray:= '0123456789'; chararray:= 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; punctarray:='!"#$%&()''*+,-/:;<=>?_'; --Check if the password is same as the username IF password = username THEN raise_application_error(-20001, 'Password same as user'); END IF; --Check for the minimum length of the password IF length(password) < 4 THEN raise_application_error(-20002, 'Password length less than 4'); END IF; --Check if the password is too simple. A dictionary of words may be --maintained and a check may be made so as not to allow the words --that are too simple for the password. IF NLS_LOWER(password) IN ('welcome', 'database', 'account', 'user', 'password', 'oracle', 'computer', 'abcd') THEN raise_application_error(-20002, 'Password too simple'); END IF; --Check if the password contains at least one letter, --one digit and one punctuation mark. --1. Check for the digit --You may delete 1. and replace with 2. or 3. isdigit:=FALSE; m := length(password); FOR i IN 1..10 LOOP FOR j IN 1..m LOOP IF substr(password,j,1) = substr(digitarray,i,1) THEN isdigit:=TRUE; GOTO findchar; END IF; END LOOP; END LOOP; IF isdigit = FALSE THEN raise_application_error(-20003, 'Password should contain at least one \ digit, one character and one punctuation'); END IF; --2. Check for the character <<findchar>> ischar:=FALSE; FOR i IN 1..length(chararray) LOOP FOR j IN 1..m LOOP IF substr(password,j,1) = substr(chararray,i,1) THEN ischar:=TRUE; GOTO findpunct; END IF; END LOOP; END LOOP; IF ischar = FALSE THEN raise_application_error(-20003, 'Password should contain at least one digit,\ one character and one punctuation'); END IF; --3. Check for the punctuation <<findpunct>> ispunct:=FALSE; FOR i IN 1..length(punctarray) LOOP FOR j IN 1..m LOOP IF substr(password,j,1) = substr(punctarray,i,1) THEN ispunct:=TRUE; GOTO endsearch; END IF; END LOOP; END LOOP; IF ispunct = FALSE THEN raise_application_error(-20003, 'Password should \ contain at least one digit, one character and one punctuation'); END IF; <<endsearch>> --Check if the password differs from the previous password by at least 3 letters IF old_password = '' THEN raise_application_error(-20004, 'Old password is null'); END IF; --Everything is fine; return TRUE ; differ := length(old_password) - length(password); IF abs(differ) < 3 THEN IF length(password) < length(old_password) THEN m := length(password); ELSE m:= length(old_password); END IF; differ := abs(differ); FOR i IN 1..m LOOP IF substr(password,i,1) != substr(old_password,i,1) THEN differ := differ + 1; END IF; END LOOP; IF differ < 3 THEN raise_application_error(-20004, 'Password should differ by at \ least 3 characters'); END IF; END IF; --Everything is fine; return TRUE ; RETURN(TRUE); END;
Security administrators should define a policy for the auditing procedures of each database. You may, for example, decide to have database auditing disabled unless questionable activities are suspected. When auditing is required, the security administrator must decide what level of detail to audit the database; usually, general system auditing is followed by more specific types of auditing after the origins of suspicious activity are determined. In addition to standard database auditing, Oracle Database supports fine-grained auditing using policies that can monitor multiple specific objects, columns, and statements, including INDEX.
See Also:Auditing is discussed in Chapter 8, "Database Auditing: Security Considerations" and Chapter 12, "Configuring and Administering Auditing".
Information security and privacy and protection of corporate assets and data are of pivotal importance in any business. Oracle Database comprehensively addresses the need for information security by offering cutting-edge security features such as deep data protection, auditing, scalable security, secure hosting and data exchange.
The Oracle Database server leads the industry in security. However, in order to fully maximize the security features offered by Oracle Database in any business environment, it is imperative that the database itself be well-protected. Furthermore, proper use of its security features and adherence to basic security practices will help protect against database-related threats and attacks. Such an approach provides a much more secure operating environment for Oracle Database.
This security checklist provides guidance on configuring Oracle Database in a secure manner by adhering to and recommending industry-standard and advisable "security practices" for operational database deployments.
Before looking at the more detailed checklist: consider all paths the data travels and assess the threats that impinge on each path and node. Then, take steps to lessen or eliminate both the threats and the consequences of a successful breach of security. Monitoring and auditing to detect either increased threat levels or successful penetration increases the likelihood of preventing and minimizing security losses.
Details on specific database-related tasks and actions can be found throughout the Oracle documentation set.
The following security checklist includes guidelines that help secure your database:
Install only what is required.
Options and Products
The Oracle Database CD pack contains a host of options and products in addition to the database server. Install additional products and options only as necessary. Use Custom Installation to avoid installing unnecessary products or, perform a typical installation, and then deinstall unrequired options and products. There is no need to maintain additional products and options if they are not being used. They can always be properly and easily reinstalled as required.
Sample Schemas
Oracle Corporation provides Sample Schemas to provide a common platform for examples. If your database will be used in a production environment, then do not install the Sample Schema. If you have installed the Sample Schema on a test database, then before going production, remove or relock the Sample Schema accounts.
Lock and expire default user accounts.
Oracle Database installs with a number of default (preset) database server user accounts. Upon successful installation of the database server, the Database Configuration Assistant automatically locks and expires most default database user accounts.
If a manual (without using Database Configuration Assistant) installation of Oracle Database is performed, then no default database users are locked upon successful installation of the database server. Left open in their default states, these user accounts can be exploited to gain unauthorized access to data or disrupt database operations.
Therefore, after performing any kind of initial installation that does not use the Database Configuration Assistant, you should lock and expire all default database user accounts. Oracle Database provides SQL statements to perform such operations.
Installing additional products and components later also results in creating more default database server accounts. Database Configuration Assistant automatically locks and expires all additionally created database server user accounts. Unlock only those accounts that need to be accessed on a regular basis and assign a strong, meaningful password to each of these unlocked accounts. Oracle provides SQL and password management to perform such operations.
Table 7-2 shows the database users after a typical Oracle Database installation using Database Configuration Assistant.
Table 7-2 Default Accounts and Their Status (Standard Installation)
|Account Status


text:
Saturday, August 18, 2007
Cramer Exposed
Free access courtesy of Barrons:
Shorting Cramer
When we asked Cramer and CNBC for their own records of Mad Money's stock-picking performance, they had more excuses than a Tour de France cyclist dodging a blood test.
Over two years, YourMoneyWatch has tracked 1,300 Mad Money picks. It's this tally that shows Cramer's stocks lagging behind the Dow and the S&P 500.
Then there's the day-after-pop phenomenon. Our analysis of Cramer's picks over the past two years, from YourMoneyWatch.com, showed that, on average, the stocks jumped 2% the day after he mentioned them. From there, they usually moved sideways or down for the following 30 trading days (see chart). This offered an opportunity to make money -- 5% to 30% a year -- by selling Cramer's selections short.
If Mad Money offers unconvincing proof of Cramer's long-term stock-picking prowess, so does his account of his hedge-fund activities. His memoir suggests that some of Cramer Berkowitz's profit came from clever trading. The $300 million fund might execute hundreds of trades a day, some of them a bit gimmicky. Cramer describes how they'd find a stock in which selling had petered out, then build a position. Next, they'd hunt up some bullish news on the company and feed it to sellside analysts and reporters. On the subsequent rise, Cramer could profit by selling out his position. "Buzz merchandising," his book calls it. Smart and effective, but definitely not in the fuddy-duddy style of Graham & Dodd.
Jim Cramer has defined himself as a financial journalist who gives you clear Buy and Sell recommendations to make you money. If he's serious about that mission, he or CNBC should publish a database that tracks all his picks from the show's launch date. Even cheerleaders need to be accountable.
6 comments:
Hi Allan,if his picks pop on average 2% the nexr day,is it possible to develop a trading system based on this? Now we know that most will gap up,but how about trading the stocks that gap up less than !% and then hold for a day?
- Allan said...
Ron, he can't be trusted, so a system based on anything he does is automatically at risk. There are more honest sharks out there to feed off of.
Here in Greece we have an ancient saying:
A good tree is a good tree and cannot bear bad fruit. A bad tree is a bad tree and cannot bear good fruit.
We also have a "sound mind=sound body" concept as well.
Given the state of Mr. Cramer's body, how strong of a mind could he possibly have?
Let us take these lessons from our Hellenic forerunners, shall we not?
I'm sure the forum moderator should concur.
Southern Greece
- Allan said...
What time are the US markets open your local time? I can trade my system anywhere there is a high speed internet connection and it sounds so romantic, "Daytrading from Southern Greece"
Any beaches, beautiful women, good food?
Two out of three works for me.
Mr Harris:
We are at GMT +1. The East Coast of the US is at GMT-5. Depending upon what time zone you are in and what markets you trade, you can do the math.
In my region, southern Greece, data must come from satellites. In Athens, I believe you have various choices for that.
I assume your comments about women and beaches constitues some sort of jocularity.
The islands and beaches are the best and most beautiful in the world (Scorpios, Lesbos, etc.) and as for our women, they are headstrong and superb fighters.
They too are taught from an early age to make sword and shield and spear as much a part of their bodies as their beating hearts.
To go into our cuisine- simple but nourishing to the body. Don't look for something like what is available in France- a small piece of meat smothered in 10 different rich sauces. That is not our style.
Greece is the forerunner of modern European society but in many ways is stuck in its pre-AD past.
The climate is usually warm (mildly so) and so is the "comradeship" if you follow my drift.
We welcome your triumphant arrival to or nation! We are happy to have you! Enjoy! Live for the moment for tomorrow you may die!
Southern Greece
Thanks for the quick and insightful introduction to Southern Greece. I do like the food part --simple and nourishing.
Interesting thing about the saying:A good tree is a good tree and cannot bear bad fruit...
We have a similar saying in India and goes something like: A bad karma(fruit)can not be born of a good dharma (root of the tree).
Allan: Agree. "Daytrading from Southern Greece" does sound exotic! I am just wondering if you are really serious.


text:
City Council member tries to change W.A. Foster site
By Matt Caulder
Published in News on November 5, 2013 1:46 PM
The location for the new W.A. Foster Recreation Center came up for a vote again Monday night, a year after the Goldsboro City Council unanimously approved Mina Weil Park as the proposed location for the center. Councilman William Goodman made...
Please log in to see full story.


text:
Found a similar product cheaper elsewhere?We promise to beat any price by 5% - Try our Price beater
Vitamin C is an essential water-soluble vitamin that has a wide range of functions in the human body, with its primary function being a excellent antioxidant . We also add bioflavonoids as they enhance the action of Vitamin C and for this reason they should be taken together. Our high strength (1000mg) tablets are ideal for anyone wanting to supplement with Vitamin C.
One of vitamin C's most important functions is acting as an antioxidant, protecting LDL cholesterol from oxidative damage. When LDL is damaged the cholesterol appears to lead to heart disease, but vitamin C acts as an important antioxidant protector of LDL. The antioxidant properties also protect smokers from the harmful effects of free radicals.
Vitamin C has lots of other additional functions. It is needed to make collagen, a substance that strengthens many parts of the body, such as muscles and blood vessels. It also plays an important role in healing and as an anti-histamine. Vitamin C also aids in the formation of liver bile which helps to detoxify alcohol and other substances. Evidence indicates that vitamin C levels in the eye decrease with age and that vitamin C supplements prevent this decrease, lowering the risk of developing cataracts.
Please note that the labelling on this product is provided in English as a minimum. French, Italian, German, Spanish, Danish, Swedish and Finnish may also be present on a product by product basis.
Consume 1 tablet daily. Best taken with food.
Do not exceed the stated recommended daily dose. This product should not be used as a substitute for a varied, balanced diet. Keep in a cool dry place out of direct sunlight. Suitable for vegetarians. Store out of the reach of young children.
Vitamin C, Bulking Agents (Microcrystalline Cellulose, Croscarmellose Sodium), Coating (Hypromellose), Rosehip Extract, Citrus Bioflavonoids, Anti Caking Agent (Magnesium Stearate, Silicon Dioxide).
Made in a facility that handles Milk, Soy, Egg, Gluten and products thereof.
Serving Size - 1 Tablet
Servings Per Container - 60 (60 Tablets), 180 (180 Tablets)
|Per Serving
|Vitamin C
|Per Serving
|20 mg
|20 mg
* Reference intake of an average adult (8400 kJ/2000 kcal)
Where reviews refer to foods or cosmetic products, results may vary from person to person. Customer reviews are independent and do not represent the views of The Hut Group.
(38 reviews)
Write a review to be in with a chance of winning a £100 voucher
These pills have become too physically large and a problem in swallowing them. Even if you cut them in half, which is a pain, they have no coating to help them go down. Come on MyProtein, lets have a better pill please.
The taste is good(I could say it's tasty). The pill is a little hard to swallow - big and feels like sand. I found it very effective, recommend it!
very good product for very good price!
Great Vitamin C. I take it especially with collagen after workout.
Too large and no coating. I won't be buying these again.
I have not been taking these long enough to really comment on the results yet but I'm not sure what people are on about, these are of a common size for vitamin supplements. Yes they are large but nothing out of the ordinary really. Plus the price is really decent.
I've always taken A-Z multivitamins & Minerals but still found that I was having colds, my sister recommended that I took these particular Vitamin C as they help towards your immune system more. It took a few weeks until I noticed a difference, but I noticed my nose was less sniffley,I felt much better in myself and I was getting comments on how much better looked. The tablet is quite large but the same size as my A-Z multivitamins so I'm completely fine however some people may find it difficult to swallow. Would definitely recommend!Goes Well With:First thing in the morning with multivitamins and a glass of water.
I use these for post workout which I take after I've drunk 300ml-350ml of mixed BCAA 4:1:1 powder. Beneficial to use after training due to immune system and oxidation stress of training. Highly recommended as you could be comprising your body and goals due to not supplementing properly and timing.Goes Well With:Glass of water
this past few years I have noticed that my immune system has been low and I have constantly been getting colds and feeling run down in general. I have a stressful job and I try to train 6 days per week. My training is important to me so getting colds and flu like symptoms increased my stress levels as I cant train. I got this to help strengthen my immune system as I heard vitamin c is effective post training. I've been taking it for about 6 weeks now and I haven't (touch wood) been sick once. Goes Well With:Water after training.
I'm not sure about the effectiveness because I haven't really tried not taking it ;) But I believe it's good and the amount is good compared to other C vits with maybe only 500 MG Goes Well With:Water
Difficult to review vitamins. They're not too large and fairly easy to swallow and taste ok.Goes Well With:Water
I've been following the body coach's regime, currently on C3 and take one of these after every workout. I haven't been ill once in the last six months! Vitamin C is a great post workout boost, I didn't know that your immune system was depleted most after a workout!Goes Well With:I take with BCAA Tropical powder
I'm happy with this vitamin C. It's a bit big to swallow but not hard. Yet, it is a good medicinice. Much cheaper than the products out there and it does the job! I'll buy it again!
Pleasant to take & small enough to easily swallow
Easy to swallow and zingy taste, would definitely buy again
Found these good value and not loaded down with additives. Loving their work :-)
The taste is good(i could say its even tasty). The pill is a little hard to swallow - big and feels like sand. I found it very effective, recommend it!Goes Well With:Water, basicly every supplement
been taking this supplement for a while now, I've been taking this with my proteins zinc and magnesium and my immune system has gone through the roof, I'm a student living in a 5 bedroom house, and all my house mates have come down with colds and such and I've been absolutely fine. i take them in the morning on an empty stomach, those not used to vitamin c might find they end up on the toilet the first few times but your body will get used to it.Goes Well With:zinc and magnesium, may also want copper if supplementing zinc.
good size tablet easy to swallow and helps fight colds and flu at this time of year well pleased thanks.Goes Well With:zinc
Great product. Only problem is they are shorter and fatter than most vitamin pills, and they are not coated so the rough texture can cause difficulty when swallowing.Goes Well With:Alpha men
I bought this Vitamin C with Bioflavonoids & Rosehip for the winter because I catch colds easily. After taking these, this is the first winter for as long as I can remember where I haven't had the flu! Also the pills are a very manageable size, so you shouldn't have any problems taking them.Goes Well With:Alpha Men, Glucosamine Sulphate
Effective as a vit C supplement, tablet easy to take and tastes fine even without have water to take with.
The Vitamin C with Bioflavonoids & Rosehip is good value for money.
Unfortunately these pills are so large and have no coating that I am unable to take them. I ended up having to buy mortar and pestle and crush them into powder, which, fortunately tastes quite ok in my tea. But this is of course not ideal! I don't see what the problem would be with making them a bit smaller...
Great supplement. The Vitamin C with Bioflavonoids & Rosehip is great value too.
Vitamin C with Bioflavonoids & Rosehip is an excellent product! I hope my cortisol is aware that I am taking this excellent product.Goes Well With:Water
The Vitamin C with Bioflavonoids & Rosehip is more than a necessary supplement in my opinion. This product contains not just ascorbic acid, but bioflavonoids, which makes the absorption much more effective, and also good for strengthen the capillaries. The added rosehip also good for antioxidant. I do not regret buying this product, and probably will buy it again.
It is what it is. A good product all round I take this once 3 times daily with meals for extra vitamin c intake. Goes Well With:all the other good stuff !!
Went well with other supplements hard exercise and high protein diet.
This Vitamin C with Bioflavonoids & Rosehip is a very good product, easy to take!
The Vitamin C with Bioflavonoids & Rosehip pills might be a bit big for some people. But you can always take in two half's. These are a good product and were delivered on time as usual.
Perfect dosage per tab and I love the added extras. Not only that but incredible value for money. MP does it again. ThanksGoes Well With:Anything
Only been on these tabs for about 2 weeks now. They ain't the best tasting tab but that doesn't matter (Its not like you have to chew them). Since taking these along with Alpha men multi vitamins n minerals and omega 3,6,9 I seem to have a lot more energy. I feel healthier (sounds daft but true). It's good to know that my body is getting the right things it needs.Goes Well With:alpha men multi vits and mins, omega 3 6 9
My doctor recommended I took a vitamin C supplement to help the recovery for a large wound I have. So far, this Vitamin C with Bioflavonoids & Rosehip has aided the recovery of my large wound. I've tried many Vitamin C supplements from high street health stores and they don't compare to this. The quality of the supplement exceeds all others I have used. I purchased the large 180 tabs, which will last me almost half a year, so is excellent value. I have been pleased with the product in terms of effectiveness. My wound was expected to heal within 4 months. 3 weeks into this supplement and I'm already seeing results.
Vitamin C with Bioflavonoids & Rosehip is a great supplement for people who are not able to take in much Vitamin C from fruits etc. This is a quick and easy supplement to take to the gym. I put some tablets I need in a box or a small bag to take to the gym or work and they go down my throat easily. I have noticed that I am less prone to colds too as recently, most of the time, I have a runny nose or worse. This supplement has reduced these problems dramatically.
I can say that this product is ok
I can say that this is best product money can buy!!!
Only had them a week so we shall see


text:
Rent Teacher Support Teams in Primary and Secondary Schools 1st edition today, or search our site for other textbooks by Creese. Every textbook comes with a 21-day "Any Reason" guarantee. Published by Routledge.
Need help ASAP? We have you covered with 24/7 instant online tutoring. Connect with one of our tutors now.