Looking for a portable VPN? Don’t pick these products.

I have been testing some interesting devices to help you set up VPNs when you travel. By now most of you know not to connect to open WiFi access points, because your Internet traffic can be monitored, recorded, invaded, and used against you. The way to avoid these issues is to use a VPN. Until recently, you had a few different choices to install some software or bring your own VPN device. Both are more suitable for corporate networks, and aren’t all that easy to install and configure. These three devices attempt to make things easier for consumers. Sadly, they all aren’t quite up to the task.

Both the Butterfly and eBlocker are small hardware devices. The Butterfly has a USB end that fits in any USB AC power adapter. The eBlocker is a cube two inches on a side with its own Ethernet and power cables to connect it up. The Webroot product is only software. You see I listed their prices above, and that is my first complaint: a consumer VPN should be priced transparently. Figuring out their prices shouldn’t take a combination of a CPA and a PI.

The appeal of the three products are their supposed ease of installation. However, I ran into problems on all of them. For example, the eBlocker is made in Germany, and the default menus are shown in German. If you want to change this to English menus, you have to learn enough German to navigate through the menu tree to find the switch to make this happen. The Butterfly (setup menu at left) is designed to operate with a simple open WiFi router. As you move about the world, you have to find and connect to one before you can establish your VPN connection. That is great, but you will have problems on other routers that aren’t completely open. For example, you’ll have issues if you connect to hotel or airport routers with captive wireless portals that require you to bring up a web form to acknowledge something. Also, there was no way to change the default password in any of its  configuration menus, which seems like a major security shortcoming. The Webroot VPN was the easiest to install, since it was just software that runs in the background, but it had issues that I will get to below.

On all three, you can select various VPN endpoints for your traffic to appear to come from. At right, you can see how you can do this with Webroot, by clicking on the locations shown in the list. That has a lot of appeal — if it really worked as advertised. With eBlocker, you can also set up your Internet traffic thru the TOR network for even more privacy. I had issues with all of them when verifying the IP addresses with a public service, such as WhatisMyIP.com. They didn’t always consistently work, and despite conversations with each vendor, I couldn’t exactly tell you why.

Webroot also allows you to select a particular VPN protocol (like IPsec or PPTP) if you need to connect to a corporate VPN. That is a nice touch.

All three also do more than just setup a VPN. Webroot does rudimentary content filtering. eBlocker can anonymize your originating IP address and block ads in your browsing sessions. It has this privacy discovery page where you can see what kind of information is being collected from your browser session, if you need reminding. Here is what its dashboard looks like:

Blocking ads seems like a great idea, until you run into lots of websites that won’t deliver any content to you until you unblock them. As an example, my hometown newspaper doesn’t allow any visitors from EU countries because of potential GDPR liabilities. (That is probably a canard, but still.) There is a whitelist to add sites to try to get around this, but it didn’t seem to always function as intended.

Using a VPN can also come in handy when you travel overseas and want to access content from the streaming video services. This is because the shows that we take for granted here in the US aren’t necessarily licensed for overseas viewing. For example, I was recently in Israel, where I was pleased to see that Amazon was streaming “The Man in the High Castle” but blocked just about every other one of their other original shows. However, none of the VPN services of the three devices would work reliably in this situation. And with Webroot’s VPN engaged, I couldn’t access any Netflix content whatsoever. It could be because of cookies set on my computer, or because of how I registered for the service, or it could be something else. The bottom line: if you want to securely access your content when you travel, you can’t depend on any of these devices.

And that is why I recommend you don’t buy any of these three items, at least until each vendor does a better job with fixing the issues I mentioned above. Consumer-grade VPNs are a great idea, especially if you travel frequently. But they are still a challenge, unless you have an IT department standing by to assist you when you run into snags on the road.

So you want to rent a coworking space?

NB: I updated the information for locations in my St. Louis neighborhood in this 9/2021 post for Nicki’s blog here, including current costs and internet speeds.

There are more than 20 different coworking places in the St. Louis metro area where I live. I have been to many of them, even though I have my own dedicated office. Why? Because I want to be a part of the startup community and that is where many of them work. The spaces also are great meeting places.

Coworking spaces are useful for several reasons. When you travel, you have a place to set your laptop down and a nearby bathroom. If you just need a space for a few days or a week, you don’t have to go through the hassle of a monthly office rental. And if you have outgrown your dining room or spare bedroom in your home, and want something other than the local coffee shop, it might be time to investigate the local co-working scene.

There are a wide variety of operators, from the global, multi-city ones such as Spaces,  WeWork and Industrious to smaller, one-off locations that are quirky and anything but corporate. Finding the right one can be a chore, but you should take the time to make sure it matches your needs.

Why a chore? When you begin your research, you will find out that it is hard to track down exactly what you will be paying for renting an office. This is a combination of factors: First, occupancy varies widely, and many places charge for different sized offices. Rates can also vary depending on how many people will be housed in any given office, although some places don’t care (within reason). Many of the operators want you to come in person to check things out, so they can give you the hard sell. So my first suggestion is you should make sure you know the costs and contracts up front. Here are some other tips:

  • Understand whom you will be working next to. Are you interested in meeting people like you or unlike you? The choice is up to you. Some have private offices, some have shared private offices, and most have bullpen-style tables where several people work at close quarters. Make sure you understand what your actual space will entail.
  • Check out their vibe and décor. The spots also vary on their vibe, and that will be the hardest thing to pin down if you are looking to plant yourself in one of them. Some are more intimate, which could work or not depending where on the introvert/extrovert scale you are. Lots of them have a Scandinavian design, and some could range to the very artsy funk, which could appeal to some. Some are enormous, such as Chicago’s 1871 that is located on the top floor of the Merchandise Mart. Some are small enough to just house a few people.
  • What are the amenities besides a desk and Wifi? With some places, you pay extra for printers, coffee, a gym membership, using conference rooms, having a live human secretary to answer your phone, having a dedicated postal mailbox and a dedicated office phone number. You may not care or need any of these things. Take the time to figure out what is important to you and what that will do to the ultimate rental price.
  • Where are you going to get lunch? This isn’t so silly a question. Some places are located in suburban office parks and you have to travel some distance to find food. Others are in downtown areas or in walkable neighborhoods.
  • Can you try before you rent? One of the places near me offers a free day pass to check them out. But they also offer the most flexible pricing and usage plans: you can rent an office for a single day or a year, and there are a wide variety of floor plans and even an interesting hybrid shared but private office that has a locked door but can house a dozen people sitting at study carrels. Other places may not be as flexible or offer a complete array of rental terms. Some can be useful just for temporary team conference meetings too.
  • How quiet or noisy are the spaces? In my travels around to these places, many people worked with headphones on to isolate themselves and concentrate. You may want to check this out if the ambient sound level is important to you. Of course, the noise level varies depending on how many people are there on any given day.
  • Do you need 24×7 access to your office? Some of the properties offer this, some don’t, some charge extra if you want to enter after normal work hours. If this is critical, make sure you ask for the details.
  • Are you a party person? Some try to foster more of a sense of community with after-hours events and lectures. Others are strictly utilitarian.
  • Do you really need your own office? Many of us can work with a laptop and a cellphone and not much more. If you need a lot of stuff as part of your job, you need a private office to house it all .Some places have lockers that you can store your stuff in as part of their rental fee.
  • Will you be going to your office more often than not? If you are going to be out and about, or only in town occasionally, then having one of these spaces could be economical.
  • Is parking a hassle? Some places have free parking or include in their rental fees, others you are on your own or pay extra.
  • Does the place have arrangements for co-working in other cities? Some of the larger operators, such as WeWork and Spaces, offer complementary rentals in other cities in their networks.

A guide to the Central West End St. Louis coworking spaces

We have a new co-working space in St. Louis that brings the total to six choices in my immediate neighborhood of the Central West End to locate your office. These are alternatives to renting your own office, or when your business has grown beyond your dining room and requires something more professional. Or when you need temporary conference space, or want to conduct a training session. They combine flexibility with the gig economy, and provide benefits and camaraderie too. I am a big fan of these places, even though I inhabit my own permanent office.

The new kid in the ‘hood is called Spaces and is part of a network of hundreds of sites located across the country and around the world. I wrote this review for Nicki’s Central West End Guide about them and its competitors. Surprisingly, it was hard to pin down prices on office rental. I also suggest a few things to think about when you are trying to choose your space that can apply no matter where you are located.

My first hearing aid

Normally, these essays are a lot less personal, where I write about something tech-related. Today I want to talk about myself. Actually, my hearing.

You see, I was born deaf in my left ear. I didn’t realize it for several years, until one day I happened to pick up a ringing phone in my left hand while I was eating something in my right hand. I didn’t hear anyone. Back in those days, they didn’t test kids for hearing until later on.

Being monaural meant I have never heard stereo, have difficulty locating the direction of sounds, and it is tough when I am in noisy places. My wife has so gotten used to being on my right side that when she is with her friends she tends to migrate to that position too.

But my deafness isn’t all that debilitating. At least not until 20 years ago, when I started getting these random dizzy spells. They would happen seemingly at random: sometimes when I was just sitting in my kitchen in the early morning, reading the paper. Once I got one when I on a flight – that wasn’t fun, but fortunately I could lie down across a row of seats and just hope it would be over quickly.

Eventually, I was diagnosed with Meniere’s Disease, which has no known cure and no simple cause. As you can see from the above diagram, your ear is a very complex organ, with a lot of moving parts. Some folks have it worse, with daily dizzy spells that severely limit what they can do. Mine were relatively minor. To try to fix things, I went through dietary changes, saw a lot of different doctors, gave up driving for a while. And then the dizziness went away.

However, it was replaced by something less onerous but equally vexing: Tinnitus. A constant ringing in my one working ear. Sometimes the ringing would be more noticeable at certain times than others. Lack of sleep, added stress, too much alcohol or caffeine: all of these would make the ringing noise worse. I can hear the ringing right now as I write this.

One of the interesting aspects of Tinnitus is that it comes in various shapes and sizes. People hear different sounds and at different modulations and frequencies. For some patients, it can be just as debilitating as my original Meniere’s. For others, like me, it is just mild enough to be annoying.

Over the years, I have learned to deal with it. Sometimes I would hold a pity party for myself, sometimes the ringing was more than annoying, especially when I was in crowded noisy rooms or restaurants. I remember one time I was at a professional conference of about 300 people. For dinner, we were seated at very long tables in a cavernous room and the noise was literally deafening. I quickly ate my meal and literally ran back to my room, in pain from the noise. I know it looked odd to my dinner companions.

For the most part I accepted the ringing and figured it was better that being dizzy and having the whole world spin around me. But it wasn’t until this summer when I went to a medical conference on Tinnitus that I realized what I hadn’t yet accomplished was actually owning my disease, and facing it head-on. Or ear-on, as it were.

What does owning mean? It means that you control it, rather than it controlling you. You aren’t defined by your Tinnitus, you aren’t at its mercy, and you manage your own treatment and your own response to the disease. The noise you and I hear may be all in our heads, but we have to use our brains to figure out a way to cope and live our lives. For some reason I didn’t really understand what owning my Tinnitus meant until I was sitting in that medical conference, listening to the various presentations. Then it all clicked, so to speak.

As patients, we tend to interact with the medical/industrial complex at the moment when we have a problem: we break a bone, we want it fixed. We have an infection, we want to get rid of it by taking medicine or getting surgery. But the single point of contact with our doctors method doesn’t work with a chronic condition such as Tinnitus (or Meniere’s or whatever). That is because research is ongoing: new drugs, new procedures, new devices, and so forth. We aren’t watching the medical literature like our doctors are doing, because we are busy living our lives. And even if we are willing to put the time into doing Internet research, we aren’t going to medical conferences and learning about many of the latest technologies and techniques that don’t reach the general public for several years.

So I came away from the Tinnitus conference with newfound conviction, and one of the first things that I wanted to do is to get fitted for a hearing aid. The process is relatively simple to explain: you sit in a sound proof booth and listen carefully as the audiologist plays various sounds to test your hearing. But like many medical solutions, the devil is in the implementation details. And as patients, we have to learn a lot before we can figure out the best course of treatment. I found I had some slight high-frequency hearing loss, which is pretty typical for someone my age. So while my hearing is “fine” I could benefit from an aid.

Here’s the thing. When you don’t hear across all the frequencies you are supposed to, your brain doesn’t get to process those sounds, and it is likely that your hearing will only deteriorate as you get older. You go to the gym to maintain and build muscle tone. You need the sonic equivalent of that to maintain your hearing “muscles.”

Before I got an aid I also had to conquer the “old man” stereotype about wearing one. My dad resisted getting an aid for a long time, and by the time he got one it was too late to do much help. But the modern aids aren’t that noticeable, and if I had long hair they would be almost invisible. This is because they separate the battery compartment and the sound processor (which sits behind your ear) from the speaker, which goes inside your ear canal. The two are connected by a very thin wire.

Then I had to decide which problem I wanted to fix more: Did I want a hearing aid that would simulate stereo by placing a microphone in my deaf ear and transmitting the sound to my hearing ear? Did I want an aid to give me more high frequency amplification? Did I want an aid to try to counteract my Tinnitus? Turns out I couldn’t have all three in a single aid.

To fix the deaf ear, there are specialized aids called CROS and BAHA that are available. Years ago I tried the BAHA and I could hear stereo and place the direction of sounds behind me, and it was amazing. But these aids require surgery, and I passed on that opportunity. I tried the CROS aid this time around and didn’t get much benefit from it. So forget that issue: I have lived up until now with a single ear. I decided to look elsewhere, and focus on the latter two issues (Tinnitus and high frequency boost).

At the Tinnitus conference, I got to see what the latest aid technologies were – and being a techy kinda guy, I was somewhat excited. The aids can be used as a Bluetooth headset for your phone. They have all sorts of programmable modes that work with your smartphone. They even come with GPS chips so you can try to track them down if you misplace them. They can help you cook your dinner. Well, not that last item, but almost.

Now, I should know better than to trust the wonderful claims of tech vendors. I found the software lacking: unless I set it up in a certain sequence, the smartphone app (as nifty as it possibly could be) would crash. Hearing the word “Bluetooth,” I immediately thought that the sonic quality of the aid would be close to what an Airpod would be, and it wasn’t even close. Outdoors in a high wind, the aid wasn’t very usable as a phone headset. I am still getting used to having something sitting in my ear canal during most of the day. And the various programmable modes that I can dial into on my phone really don’t have much difference (at least that I can distinguish) on what I can hear from the aid. My audiologist says that my results are typical for many of his patients. Some of the aids have even more buggy smartphone software controls.

However, if I leave these issues aside, I can hear better with my aid, especially those higher-frequency sounds. And the aid does help reduce the ringing tone of my Tinnitus, which was one of the original goals.

I am still learning how to own my Tinnitus, but the hearing aid is a great first step. And here are links to the American Tinnitus Association and the Vestibular Disorders Association, both of which have helped me find other sufferers and great helpful resources to cope.

Getting rid of Facebook

One of my readers asked me how to go about removing Facebook completely from their online lives. After I pulled together the various links that you’ll see below, I thought I would share with you all. Now, I am not saying that I am contemplating doing this: sadly, my online professional life requires that I continue to be a part of Facebook, whether I like it or not. But that doesn’t mean I have to agree with its corporate policies, as I have made clear in several posts earlier this summer. But read on or save this column somewhere, just in case you are thinking about de-Facing your life.  And be prepared to spend a few hours going through the numerous steps.

Your first to-do is to download all of your data that Facebook has on you. I wrote about this process earlier (and covered the other social networks too) in this post. But if you just want the Facebook archive download, go to this page.  You might have to wait a few days until your archive is ready: don’t worry, you will be notified.

Next, decide whether you want a trial separation or a total divorce. Facebook refers to the former as deactivating your account. This keeps your data in their grubby digital hands, but at least you will disappear from your friends’ social networks. You can change your mind in the future and re-activate your account just by logging back into your account, so if you are somewhat serious about this but don’t want to inadvertently login, make sure you delete the login details from your password manager or any saved websites on your various browsers and computers.

If you still want to stick with Facebook, you might just want to cleanse your privacy settings. This post goes into detail about how to do this. You can see how complex setting up your privacy has gotten, when you need a full page of instructions to naviagate the various options.

Before you opt for the total divorce, take a look at the connected apps that you once allowed access to your Facebook account. You might not have remembered doing this, and in another column I spoke about what you should do for a social media “spring cleaning” for the other networks and for your various privacy settings. You should spend some time doing this app audit for the other networks as well.

Why do you want to deal with your connected apps before total account deletion? Because you might want to still access one or more of these apps, and if you delete your Facebook presence, your access goes away if that particular app depends on that. For example, a web portal that my doctors use to communicate with me could depend on my Facebook login. (It doesn’t, but that is because I decided to use another login mechanism other than Facebook.) By going to the connected apps page, you can see the complete list of whom you have authorized.

Still with me? I realize that it seems as if the scope of this project continues to widen, but that is to be expected. Let’s continue.

Mashable has this nice article that will walk you through the steps of both deactivation and a complete deletion process. I won’t repeat the numerous steps here, but you should take the time to review their post.

If you opt for deletion, remember you have to cleanse your entire computing portfolio of everything Facebook: this means all your browsers, your mobile devices, and your mobile messenger apps too. I don’t particularly like the mobile messenger app, as one friend described it accurately as a “rabid dog” that just grabs your contacts and other data. Indeed, if you have examined your downloaded archive you can see that for yourself.

Now for the final step, the actual deletion. The Mashable piece has a long list of what you have to do, aside from hitting the delete button in the Facebook interface. If you want a more visual aid, check out this screencast that shows you these first steps.

I realize this is a lot of effort, and Facebook has very nicely put in a number of “Are you sure” checks along the path, just in case you aren’t completely ready for the divorce. I would be interested in hearing from you if you do go through the entire process and what your reasons are for doing it.

Watch that browser add-on

This is a story about how hard it is for normal folks to keep their computers secure. It is a depressing but instructive one. Most of us take for granted that when we bring up our web browser and go to a particular site, we are safe and we know what we see is malware-free. However, that isn’t always the case, and is getting harder.

Many of you make use of browser add-ons for various things: Right now I am running a bunch of them from Google, to view online documents and launch apps. One extension that I rely on is my password manager. I used to have a lot of other ones but found that after the initial excitement (or whatever you want to call it, I know I live a sheltered life) wears off, I don’t really take advantage of them.

So my story today is about an add-on called Web Security. It is oddly named, because it does anything but what it says. And this is the challenge for all of us: many add-ons or smartphone apps have misleading names, because their authors want you to think they are benign. Initially, Mozilla wrote a recommendation for this add-on earlier this month. Then they started getting complaints from users and security researchers. Turns out that they made a big mistake. Web Security tries to track what you are doing in your browsing around the Internet, and could compromise your computer. When Mozilla add-on analyst (that is his real job) Rob Wu looked into this further, he found some very nasty behavior that made it finally clear to him that the add-on was hiding malicious code. Mozilla basically turned off the extension for the hundreds of thousands of users that had installed it and would have been vulnerable. This story on Bleeping Computer provides more details.

In the process of researching this one add-on’s behavior, Wu found 22 other add-ons that did something similar, and they were also disabled and removed from the add-on store. More than half a million Firefox users had at least one of them add-ons installed.

So what can we learn from this tale of woe? One thing is the sobering thought when security experts have trouble identifying badly behaving programs. Granted, this one was found and fixed quickly. But it does give me (and probably you too) pause.

Here are some suggestions. First off, take a look at your extensions. Each browser does this slightly differently. Cisco has a great post here to help you track them down in Chrome and IEv11. Make sure you don’t have anything more than you really need to get your work done. Second, keep your browser version updated. Most of the modern browsers will warn you when it time for an update, and don’t tarry when you see that warning. Finally, be aware of anything odd when you bring up a web page: look closely at the URL and any popups that are displayed. Granted, this can get tedious, but you are ultimately safer.

Not yet ready to cut the cable cord

If you want to completely cut the cable cord, it isn’t easy. I have been waiting for technology to become spousal-ready, and we are still about a year or two away. Today you have a lot of choices in the $40/month range that rival what the cable companies offer you for TV programming. The trouble is you have to make a choice between user interface and great TV resolution: you can’t yet have something that delivers both, other than your cable company.

I pay AT&T Uverse $125/mo. for my TV programming. That includes two receivers, one of which is a DVR and a boatload of various taxes and fees. Is it worth it to move to one of the online TV providers and save $85 a month? Eventually, I decided no, after trying two services, You Tube TV and Hulu Live TV. You can follow along with this column if you are brave enough: both offer a free trial of their services for a week, after which the monthly subscription starts. There are other services; my patience wore thin after experimenting with these two however.

Let’s first look at the user interface and mindset of the two online providers. You can obtain your TV programming in one of two ways: either by selecting your shows using a channel via your web browser or via an app that runs on your TV equipment. The web browser has the better UI because the developers working at the providers have more to work with and are more used to building web apps these days. And, you have a real keyboard for input, unlike your TV where you have to navigate around an on-screen one that can be infuriating.

So how do you get the audio and video signals from your computer to your living room TV? Two ways: either by connecting your computer directly to your TV with an HDMI cable or using one of several devices like Google’s Chromecast that does this for you wirelessly. If you use the direct cable connection from your computer, you will have to figure out a wireless keyboard and mouse to control it. If you use Chromecast, you will have to figure out the sequence of controls using the three apps that Google has (Google’s Chrome browser, Google Home and the Chromecast app itself) to get it setup. The workflow isn’t immediately obvious, and I suggest you learn the process before bringing your spouse into the room for the demo.

The nice thing about Chromecast is that any content that is displayed in a browser tab can be quickly transmitted to your TV by clicking a few buttons. I say a few: my wife got immediately weary of the process when I showed her what was involved. Your own experience may be similar. The bad thing about Chromecast is that the resolution is poor: nowhere near HD quality and even below SD video quality. Even if you have an old living room TV (and mine is more than five years old), you will be disappointed with the Chromecast video quality. And by the way, Google sells two different versions of Chromecast: one is for audio only; the other is for video and comes with the HDMI connector.  Make sure you buy the right one.

Another difference is how you access TV shows that have previously aired. Hulu’s web UI is very akin to the Amazon and Netflix web UI. In order to get the entire season’s worth of episodes, you have to click on the name of the show in the “My Stuff” guide. You can’t reorder the shows listed. If you click on the video itself, you are taken to the current episode. You Tube TV lists each episode as separate videos, much like the way ordinary You Tube does for its videos. (You can see the web version of the live TV guide above.)

So far I have only talked about using the web clients of You Tube and Hulu. There is a second method, which uses the native apps that run on your TV equipment. If you have a new TV, chances are it comes with apps for a variety of video providers, including Amazon, Netflix, You Tube and Hulu. I tried the apps that ran on my Samsung Blu-ray player: it didn’t have a You Tube app, again because it was more than five years old.

Sadly, there are UI differences between what you see with your web browser and the TV-based app clients, with the TV apps being far less capable than their web cousins. One big difference is how the onscreen channel or movie guide is shown. Netflix has the longest experience with developing its apps, and there are major interface and stability differences between its Android, iOS, web and embedded TV apps. On my Samsung device, the Netflix app frequently can’t find the Internet, or just quits working entirely. On the web client, that rarely happens.

Like Netflix, You Tube TV and Hulu both allow you to segregate your family’s preferences, so you can keep track of your individual tastes and what you have already watched. You Tube allows up to six different family members. Hulu is more restrictive and confusing, and there is also an unlimited extra-cost option.

Speaking of extra cost options, this is where the two providers are showing their relative youth. If you don’t want to watch live TV programming, Hulu has plans that start at $8/mo., or $12/mo. if you want to skip most commercials. If you want everyone to watch different streams concurrently, that will cost another $15/mo. There are also premium channel fees for HBO, Showtime and Cinemax.  You Tube TV has Fox Sports, Starz, AMC, Sundance and Showtime premium add-on channels.

Finally, Hulu with Live TV doesn’t support viewing live TV streams on all of its devices, according to this very confusing webpage. I read over the caveat several times and didn’t really understand what they were saying.

Alright, let’s move on to discussing the real benefit with using the TV apps from the online providers (or Blu-ray player, in my case).  Your video quality will be as good as anything else you run on the TV, full HD. But you have to put  up with a sub-par UI to get it.

So, what should you do? First, if you are in the market for a new TV, sign up for at least one of the online TV providers before you go shopping, and set up a simple temporary login password too. Go to your store and login to your provider, using the embedded app on the TV, and see for yourself if the UI is going to give you fits in selecting your programming with a couple of sets that you are interested in. If you really want a true A/B test, buy a Chromecast and bring that along with your laptop and see what the resolution will be if you don’t believe me.

If you just bought a TV within the last couple of years, try my experiment at home and see if you get better results that I did with my tests. The apps could be better than I experienced. If you have a large family and many different TV sets scattered throughout your home, you will probably end up sticking with your cable provider.

Watch that keyboard!

We are using our mobile phones for more and more work-related tasks, and the bad guys know this and are getting sneakier about ways to compromise them. One way is to use a third-party keyboard that can be used to capture your keystrokes and send your login info to a criminal that then steals your accounts, your money, and your identity.

What are these third-party keyboards? You can get them for nearly everything – sending cute GIFs and emojis, AI-based text predictors, personalized suggestions, drawing and swiping instead of tapping and even to type in a variety of colored fonts. One of the most popular iOS apps from last year was Bitmoji, which allows you to create an avatar and adds an emoji-laden keyboard. Another popular Android app is Swiftkey. These apps have been downloaded by millions of users, and there are probably hundreds more that are available on the Play and iTunes stores.

Here is the thing. In order to install one of these keyboard apps, you have to grant it access to your phone. This seems like common sense, but sadly, this also grants the app access to pretty much everything you type, every piece of data on your phone, and every contact of yours too. Apple calls this full access, and they require these keyboards to ask explicitly for this permission after they are installed and before you use them for the first time. Many of us don’t read the fine print and just click yes and go about our merry way.

On Android phones, the permissions are a bit more granular, as you can see in this screenshot. This is actually just half of the overall permissions that are required.

An analysis of Bitmoji in particular can be found here, and it is illuminating.

Security analysts have known about this problem for quite some time. Back in July 2016, there was an accidental leak of data from millions of users of the ai.type third-party keyboard app. Analyst Lenny Zeltser looked at this leak and examined the privacy disclosures and configurations of several keyboard apps.

So what can you do? First, you probably shouldn’t use these apps, but trying telling that to your average millennial or teen. You can try banning the keyboards across your enterprise, which is what this 2015 post from Synopsys recommends. But many enterprises today no longer control what phones their users purchase or how they are configured.

You could try to educate your users and have them pay more attention to what permissions these apps require. We could try to get keyboard app developers to be more forthcoming about their requirements, and have some sort of trust or seal of approval for those that actually play by the rules and aren’t developing malware, which is what Zeltser suggests. But good luck with either strategy.

We could place our trust in Apple and Google to develop more protective mobile OSs. This is somewhat happening: Apple’s iOS will automatically switch back to the regular keyboard when it senses that you are typing in your user name or password or credit card data.

In the end though, users need to understand the implications of their actions, and particularly the security consequences of installing these keyboard replacement apps. The more paranoid and careful ones among you might want to forgo these apps entirely.

Practical ways towards more secure logins

Lately, numerous websites have adopted better security practices, supporting a wider variety of multiple factor authentication or MFA. I have been trying these out and for the most part they install relatively easily, although your mileage will vary. The idea is that you want something more than your username (often just your email address) and a password. No matter how complex your password, it can be circumvented by a determined hacker. And many of us (you know who you are) don’t use very complex passwords, or reuse them across various sites.

Let’s start first with the MFA tools that I want to use. First up is Google Authenticator. This is a smartphone app that generates a one-time PIN. You get to the dialog box on your website and enter the PIN and you can complete your login. Google Authenticator is dirt simple to setup: you scan a QR code that is displayed on your screen and it then shows you an entry for your website. The PIN changes every minute, so it is a lot harder to spoof than a code that is sent to your phone via text messaging.

The other tool is the Yubikey, a USB device that supports the FIDO standards from Yubico. There is a small button on the device that you press, and that sends the appropriate code to your website at the appropriate time to complete your login. They are inexpensive and now support a wide variety of website logins. Again, setup is fairly straightforward, and I just leave my key in my desktop’s USB port so I don’t have to worry about losing it.

If you use both methods (and you should, why not), this will prevent someone else from trying to login to your account, even if they know your password. Once you have completed a successful login on one device, you aren’t prompted again for the extra security.

Twitter announced this past week that they support the Yubikey, which adds to their existing support of Google Authenticator and other authenticator apps. Here are the instructions for setting it up. The interface for doing this can be found starting with this menu, under the Security heading. It isn’t all that verbose an interface, but you can choose which of the three methods (text, Yubico key, and mobile app) or all of them to use for the additional security.

Next up is my WordPress blog. If you host your blog on WordPress.org, they have long supported various MFA methods, including Google Authenticator, Authy, Duo and others. If you use WordFence Premium, you can also get the MFA protection. Speaking of WordFence, you really should use it (at least the basic version): it will tell you who is trying to break into your blog and last week I got several thousand attempts, which I think was a new record for me.

So I was more motivated to start having better protection for my login there. Since I use the basic WordFence, I looked around and found miniOrange, another plug-in that supports WordPress as well as Magento, Drupal and Joomla CMS. It works with Google Authenticator as well as its own QR code reader and soft token apps. I used the free version, but if you pay extra for a miniOrange account, you can support more than a single user as well as get additional MFA methods, including Yubikey. There are several other MFA plug-ins for WordPress, but I didn’t try them.

While I was doing these installations, my bitcoin wallet app notified me that they were requiring everyone to add MFA to their logins soon, otherwise I wouldn’t be able to transfer any funds in or out of my account. That is a smart decision, especially given the number of recent exploits in this market space. So I got Google Authenticator working on that as well.

Finally, a few weeks ago I was getting all sorts of notifications that someone was trying to login to my Facebook account, so I wanted to add both Google Authenticator and Yubikey to that login. I ran into problems: when I wanted to add the Authenticator app, Facebook turns on “Allow logins without a code for one week.” You can’t then turn this off without disabling my Authenticator app.  I am not sure this is a good idea, but when I went back to check on it for this post I couldn’t find the setting. Your dialog box when done will look like this.

As you can see, this is still not completely ready for your mom’s logins. (At least, it isn’t ready unless you want to support her when she has problems.) But you should take the time and add these tools to protect your own logins.

Fixing Facebook’s flaws

Facebook has been under fire for the past several months as Zuck does his World Apology Tour, both in DC and in Belgium giving testimony to the EU Parliament. That link takes you to a YouTube video from The Verge which shows him not answering very pointed questions from the body’s members. The EU format was very different from his US Congressional testimony in April: In Europe, the session was just an hour and a half, with much of that time taken up by Members’ speeches. In the States, he was there for a total of ten hours.  Business Insider called the EU appearance “a wash out.” That difference between the two geographies was noted by lawmakers quoted in Vox. “We are here in terms of regulation,” said Claude Moraes of the British Labour Party, gesturing upward with one hand, “And the United States is here,” gesturing downward with the other.

Sadly, the social media giant has paid lip service in protecting users’ privacy. There is this story in the NY Times about how it cooperated with the major cellphone vendors to give them access to vast amounts of private user data.

And the company hasn’t done very well towards policing its content for terrorist and hate speech. This recent post in the UK’s Independent talks about the effort that the vendor is going to try to block hate speech in Germany. The reporter takes us inside a 1200-person cubicle farm where analysts try to screen content in real time.

But to get a more complete picture, you should read this report last month from the Counter Extremism Project called Spiders of the Caliphate. It lays out a chilling analysis of how poorly Facebook has been in policing pro-ISIS propaganda. It documents how their supporters operate on that network and even leverage its features. ISIS’ online networks are growing and are used to plan and direct various terror attacks as well as to mobilize foreign supporters to fight in various places around the world. ISIS’ Facebook presence is pervasive and well organized. According to the authors, ISIS “has developed a structured and deliberate strategy of using Facebook to radicalize, recruit, support, and terrorize individuals around the world.” They found from careful path analysis that ISIS’ “Facebook networks are strong, extensive, and growing.”

The authors selected a thousand Facebook accounts that they claim are ISIS supporters, using positive language and geolocation to specific areas, usernames with pro-ISIS meaning, accounts from people that claimed they worked at ISIS or are from place names that are under ISIS control. You would expect many of these accounts to originate from the Middle East, but there also were accounts from Nepal, South Korea and South America too: ISIS has truly gone global. There were even American accounts.

They examined each account’s timeline and pattern of liking and sharing posts and then recorded the number of their friends or followers and other data. They then visualized this data using the open source network path analysis tool Gephi. While I am not an expert here, it seems their methodology is sound.

They found many disturbing things. There were 28 accounts that were used exclusively to post pro-ISIS propaganda, with some posts that have remained online for more than a year and racked up thousands of views. Also, “a group of American ISIS supporters holds weekly meetings on Facebook Live to discuss topics ranging from ISIS ideology to how to avoid detection from the FBI.” ISIS supporters live in more than 80 different countries. Most supporters had publicly visible posts, too.

Facebook’s misleading efforts to counteract terrorism

Facebook says they have worked hard to try to stem this pro-ISIS tide, but the CEP report documents how they have mislead the public and been largely ineffective. The report says that Facebook has been unable to do anything “in a manner that is comprehensive, consistent, and transparent.” Rather, it has enabled ISIS supporters to flourish and grow their social networks. Of the 1,000 accounts analyzed, less than half of them had been removed by Facebook by March 2018, and many accounts were reinstated multiple times after removal. “Perhaps most concerning is that Facebook’s suggested friends algorithm reveals how the company’s tools have aided in connecting extremist profiles and help expand ISIS networks.” The report goes further and says that Facebook executives have purposely misled policymakers and the public in terms of their cleansing of their network from pro-ISIS activities.

The post in New Europe was quite disparaging and called Zuck’s non-answers before the EU evasive and a disaster. It mentions his claim that Facebook “can flag 99 percent of the ISIS and al-Qaeda related content that we end up taking down before any person in our community flags that for us.” Clearly, that number (apart from being meaningless) is at odds with the CEP report.

One final personal note about Facebook’s inadequacies.  Two months ago, I tried to download information from Facebook and other Internet sites that they have collected about my usage, and documented the experience in my blog here. It wasn’t an easy exercise, but it was sobering to see how many advertisers had my name in their sights, and in their sites as well. None of the Internet properties make this easy for you to do, but the effort is worthwhile and another eye-opener.

The New Europe post says, “It’s not like Facebook doesn’t have the resources to do better. Facebook’s market capitalization is more than the GDP of Belgium. Until Facebook finally tells the truth, it will be difficult for lawmakers and the public to hold it, and other tech companies, accountable for the level of disturbing and harmful content that proliferates online today.” Finally, I speak to this issue of corporate and leadership integrity on Shel Holtz’ For Immediate Release podcast this week. (Skip to 12:15 if you don’t want to listen to the entire hour.)