It’s fascinating to watch mobile web traffic move toward the inevitable 2014 tipping point of it bypassing non-mobile web traffic. During non-work hours mobile browsing of my site shoots up pretty significantly. Above you can see it’s near 40%. More on this later, but many are saying Apple is making a major play here–hoping to replace the desktop…
Archives for September 2013
Replace To-do Lists With Calendar Placeholders
image from innovativelyorganized.com The alternative to the feckless to-do list is what I call “living in your calendar.” That means taking your tasks off the to-do list, estimating how much time each of them will consume, and transferring them to your calendar. (Don’t forget to leave time to process your email. And leave some empty space — one…
California is the iPhone, Android is the Tea Party
Here’s an interesting analogy: California is the iPhone. I’m not sure where Android would be, but maybe you can help me pick a place after you hear the idea. Basically, California is the beacon of liberalism, which in this context means promoting a lifestyle that it feels is best for everyone. This means things like: Healthier foods Healthcare…
Unification of Product Lines: Apple and BMW
I’ve noticed an interesting similarity between what BMW and Apple are doing with their product lines. In short, they’re unifying their product lines so that from the cheapest to the most expensive you still get the same look and feel. BMW Unification Over the last few years BMW has been working to do something extraordinary: they’re making all…
Skills of the Future
I enjoy thinking about what the future will require from humans in terms of skills. With computers taking more and more from us, and humans having fewer and fewer jobs (just because so much will be automated), the question is simple: What jobs will still be dominated by humans vs. computers? It really does put some focus on…
Changing Your Server Headers Using Varnish
Changing one’s server headers is both practical and fun. It’s a good idea to remove information that could help an attacker, and it’s also enjoyable to put interesting values in there and see who notices. There are tons of ways of doing this, based on the server you use, but here’s a way to do it with Varnish.…
TouchID is a Breakthrough, Even Though It’s Breakable
What I, and many of my colleagues are waiting for (with baited breath), is TouchID enabled two-factor authentication. By combining two low to medium security tokens, such as a fingerprint and a 4 digit pin, you create something much stronger. Each of these tokens has its flaws and each has its strengths. Two-factor authentication allows you to benefit…
Threat Modeling Against Apple’s TouchID
InfoSec is usually a sliding bar between usability and security. When you gain one, you lose the other. 4-digit pins are more secure than having no passcode, but they’re more annoying to use. And having no passcode at all is maximally simple, but offers no security. TouchID Apple’s TouchID, which just launched on the iPhone 5s looked to…
Moving to a Magic Mouse and Natural Scrolling
I’ve tried several times to use an Apple Magic Mouse, with little success. Recently, though, while hanging in an Apple store waiting to camp for the iPhone, I was browsing on the machines within the store using their setups. They of course use magic mice, and they have natural scrolling enabled. After just an hour or so I…
Apple’s Touchscreens Dramatically Faster Than on Google Devices
When I explain to people why I feel Apple’s mobile experience is superior I often refer to the intangibles that just make it “feel” better somehow. This is one of those “somehows” that just became tangible. The touch screens on Apple devices are just brilliantly responsive. I’ve always felt that Android devices were sluggish, but couldn’t imaging this…
Real-world Testing of the iPhone 5s Fingerprint Sensor
image from digital trends.com Apple just released its iPhone 5s and one of the main features is the fingerprint reader. Being a security guy I was curious about the tolerance this system has for unexpected finger states, so I decided to test out the fingerprint reader in the following scenarios: A moist finger A wet finger A dirty…
Account Harvesting: The Fail Trifecta of Web Application Security
At our testing practice here at Fortify on Demand we test a lot of web applications. We get them both as standalone web apps, and we get them as backends to mobile applications. During the course of this work we (too) often come across a serious issue that we refer to as Account Harvesting.via Account Harvesting: The Fail…
Thoughts on Technology to Avoid Texting and Driving
As I was passing a couple of wrecks on the 101 yesterday I had an idea about how to prevent texting and driving. In sum, the sender of a text should be notified that the recipient is driving, and various options should come into effect as a result. Mobile device operating systems should have some good defaults here,…
How to Fix Intermittent Airplay Cutout Issues
If you’re having issues with your Airplay where it intermittently cuts out in the middle of songs and then turns back on, here’s a fix that will probably take care of it: Configure your wireless networks to use the the 5Ghz band, and have all your Airplay systems connect to the 5Ghz version of the network Ensure all…
Step Zero in the Evolution of Humanity
I strongly believe that the maturity of humans starts with understanding three main things: We are floating around in a galaxy of 100 billion suns, which is in a universe of 100 billion galaxies We are a product of evolution, and we are animals sharing much in common with the others here We do not have (absolute) free…
Creating Mobile Clickable Conference Call Information
For those who spend a lot of time dialing into conference calls you know how annoying it can be to have to dial the conference number and then the conference code–especially when the conference code is in the invite and in a format you can’t click on. One thing I’m rolling out with my team is the standardized…
Bypassing WAF Anti-automation Using Burp’s Cookie Jar
I’m testing a number of cloud WAFs right now for how they handle various injection attacks. Pretty fun project. One layer of their defense is anti-automation, so if you start hitting it hard with a scanner it’ll label you as malicious and ban you. Sounds pretty cool. Unfortunately it’s often trivial to bypass. The way many WAFs block…
A Collection of Less Commonly Used Commands
Over at Hacker News there are often threads about less-traveled UNIX and Linux commands. One particular comment collected a few of the posts, and I decided to parse all of those threads’ commands, plus my own favorite list of obscure entries, and put them in one place. Somewhat obscure UNIX commands column: create columns from text input tr:…
How I Collect and Display Interesting Content I Find Online
[ NOTE: Yahoo Pipes has been murdered, so a lot of this post is now stale. ] Like many others in technology I spend a good amount of time reading news and marking content that I may want to come back to later or share with others. Given the number of sources I consume it’s difficult to do…
Your Relationship With Failure Determines Your Potential
Image by Claire May Few things are more defining in life than one’s relationship with failure, and up until a few years ago I had it all wrong. Being somewhat obsessed with perfect execution, failure has always acted like a poison that seeped into the food and air supply where I failed. Failure revealed to me, and to…
The School Problem is a Parenting Problem
On a major project, that was something like 5-10% of their grade, they could get every question wrong, but if they hit all the right bullet points they could still get a 80%. They could get a B without knowing any of the content….and many still failed. While it can be hard to tell socioeconomic status by looking…