Posted on
by

evernoteYesterday, Evernote, the popular note taking and scrapbook app, was hacked and an unknown number of user credentials were stolen. Evernote carried out a precautionary password reset for all of their users, which, it has been remarked on elsewhere, looked a lot like a phishing scam in its own right.

Thankfully, since the last time this happened with twitter, I have had unique passwords for every service I use, so all I had to do was reset the one password (and re-link all my devices – damn I wish they’d use token based auth for their devices, but never mind). For all the faff of having to remember (or have written down) hundreds of different passwords, it is now far less faff than having to change each and every one of them when yet another web service gets breached.

As someone who builds web platforms and applications for a living, I do feel a certain sense of “there but for the grace of god”, so perhaps we shouldn’t be too hard on Evernote. They acted promptly once the security breach was discovered, and for me at least, the disruption was minimal.

However, once again, we have a service where many store important personal information (Evernote even encourage you to store tax information using their service) that doesn’t provide extra security. This is despite the fact that they have promised two factor authentication some time ago.

I really hope that this breach will prompt cloud services like Evernote, that store sensitive information on behalf of their users (or act as an authentication mechanism in their own right, as with twitter), to implement extra security (such as the aforementioned 2 factor auth) in their services.

Posted on
by

It’s a brand new year!

Well, it’s been a new year for a little while actually, but 2013 has been a busy one so far. I’ve been working hard on some interesting things, but I still managed a sneaky skiing trip.

2012 was an awesome year; I welcomed it in rawkus style with my former housemates, and then a few days later, after the hangover had cleared of course, flew my first passengers as a newly qualified pilot!

I went to birthday parties, ate some great food, climbed, and enjoyed the company of some great people. I played Capoeira with my group at the Oxford Olympic Torch event, but otherwise managed to miss the worst of the Olympics by camping in the Czech wilderness followed by some epic climbing in Italy.

I have some big plans in motion for 2013, hopefully I’ll be able to dial up the awesome a few more notches! I want to finally get to grips with a foreign language, and ideally live abroad for a while in the native country. I want to progress my flying career in some way, advance to more complicated aircraft or perhaps do an aerobatic qualification. I intend to see more of the world, and climb more mountains (both figuratively and literally!).

Work wise, I’m working on a few exciting things (some of which will see the light of day really soon). As an FYI, I’m always interested to hear about your projects, especially if you need some technical and strategic muscle to help you!

Lets go!

Posted on
by

failwhaleIt seems like just the other day when I had to change a whole bunch of my passwords thanks to LinkedIn having it’s password database stolen by crackers, and now I’m having to do it again. This time it was Twitter that dropped the ball, but I am at least grateful that they’ve publicised the incident so widely.

Username/Password systems suck, I’ve written about this before. We should, as an industry, aim to move past them as quickly as possible, and it’s nice to see some attempts at this (although, a lot of those attempts are attempts to centralise identity in one form or another).

Like most people, I did recycle passwords on a number of services, and yes I know this was bad, but I only have a limited space in my head and I don’t enjoy having to remember long strings of alphanumeric characters. The main issue I’m having with this latest breach, other than the hassle of having to go around and change a bunch of passwords again (which is largely my fault I admit), is that Twitter, like Facebook and Google, can be used as a way to log into other services via OAuth.

This is very handy, and means that you can quickly sign on to a 3rd party service without having to create yet another password to remember. However, the downside, is that this central identity MUST be secure. Facebook and Google both add extra security to their accounts by having 2-factor authentication systems in place, so, when you access your account via a new device, you have to go through an extra security challenge – typically, entering a code sent to your phone or from a key generator app.

Twitter, on the other hand, doesn’t have this extra level of security. This means that the crackers could have access to not only your twitter account, but also any 3rd party service you’ve used twitter to log in with.

This is a big deal.

Personally, I think that any service that provides OAuth logins to other services, but doesn’t provide 2-factor authentication, is being somewhat irresponsible, and I really hope that Twitter fixes this with the utmost urgency. I for one will be using my Google account more…