Security makes money

Here is a new (well it has been around since early 2000) device that can detect ANYTHING!!! Drugs, explosives, " mushrooms :-)".

This guy conned a large number of governments around the world by selling a peace of plastic with an antenna which, allegedly, detect any type of chemical in the air. It is used in Iraq, Taiwan, Mexico on airports, road check points etc. And the device only sells at £30,000 each.

So how to make money

1. Find out what are people (governments) scared of / how they can improve the SECURITY;

2. Think of an ideal solution that everyone would want (it doesn't have to work);

3. Package it nicely (after all it is the packaging that sells).

4. And do not forget, cheap stuff never sells. Set some crazy price.

5. Additionally make sure that only you can supply spare parts and do maintenance.

6. Offer Old for New discounts. That way no one will ever see what is inside your fab device. Who's going to dismantle a £30,000 gadget just to peak inside.

Read the original article on BBC.

Live Mesh

After reading a BBC Technology article (here) on smart ways to backup files I decided to try Microsoft's Live Mesh.

Live Mesh isn't only another file storage service. It provides several features such as:
1. Cloud Storage
2. File & Folder share with other users
3. Remote desktop
4. Multiple PCs can be connected to the same account and files/folders synchronised between them.
5. Event feed via RSS which tells you (and people you share folders with) of any changes made by anyone member.

To analyse
1.1 It gives each user 5GB free storage space with an option to upgrade.
1.2 Once a virtual folder is created in the cloud identical folder is created on user's desktop too. Now any files dumped into the folder will be uploaded to the cloud folder. This is very convenient although the upload is not very fast.

2.1 Files and folders can be shared with others and there is a good access control facility (i.e. forbid your friends to share this folder with someone else etc).

3.1 Remote desktop allows you to login into multiple PCs and use/run local applications. For this to work a PC to which you are connecting needs to be connected to the same Live Mesh account. I tried this at work but had no success!! I guess the problem was my network firewall.

4.1 Very useful if you use multiple PCs or work on a joint project with someone and you wish to share files.

5.1 This is useful as it can alert you to new files being added or removed from you account.

Existing services
1. Drop.io , Google Docs (has similar access control), 4shared.com etc.
NOTE: None of these create a local folder on your desktop and some might be less secure.
2. Google Docs (has similar authorisation features),
3. LogMeIn allows remote desktop connection, moving of files between PCs and no hassle with firewalls.

Security
The whole Live Mesh service is protected using your Live ID (i.e. hotmail account) and SSL. I'm not sure that this is very secure. I think they need to introduce two-factor-authentication. Also some form of file encryption in case someone does gain access to you Live Mesh account, although you could encrypt files on your PC before uploading.

Viewing decrypted files - vulnerability

I use Cyptainer LE to encrypt some of my sensitive files. Since they are .doc or .xls files once decrypted I use Open Office to read them. Recently my PC crashed while viewing one of those files. After a quick restart I loaded Open Office to write a document. Open Office alerted me to an unsaved file and asked if I wanted to recover it to which I said Yes. And guess what, my so called encrypted file popped up. With auto save feature on Open Office saved the file in cache.

Wander how big of an issue this is? I wander if this makes my secure data completely unsecured? How long is the data held in cache?

I found this in a Open Office forum http://www.oooforum.org/forum/viewtopic.phtml?t=65016"... Delete the file Documents and settings/userName/Application data/Openoffice.org2/user/registry/data/org/openoffice/Office/Recovery.xcu

Beware, it resets the settings for Autosave in the Tools>Options>Load/Save>General dialog. ..."

Google security

I've used Google Docs on a number of occasions for collaborative working. It might not be a perfect tool for collaborative work but it is free and does the job. In the past I did not pay much attention to the security aspect of those documents since they were never of contained highly sensitive information.

But what if they did?!

Sharing documents online has its advantages namely only one master copy exists and can be viewed and edited by multiple users simultaneously. Such documents are accessible (if not set as public) only to specific users (specified by the document owner) who must have a Google account too.

If those documents are protected by simple username/password combination, how secure are they? In fact such documents are as secure as the weakest authentication credentials (username/password) of users who share those documents.

Therefore I would like to be able to specify a certain criteria which users must fulfil before they can access my shared documents. To add an additional layer of security I should be able to specify:

1. "To view my documents the invited user must use a strong password", meaning Google “password strength” tool must indicate "Strong".

2. "To view my documents the invited user must use captcher when login-in".

3. “To view my documents the invited user will need a secret key to decrypt them.” Google docs (end emails in Gmail) should have offer encryption which would add additional layer of protection for sensitive documents.

All of the above should be optional so that those who see it as "just another obstacle" do not have to use it.

How much additional security would such options provide???

What about backup?? How secure should the backup be?

Social Networking

As part of my research into Social Networking (SN) I was given a task of finding an Open Source (OS) SN which can be run locally (ie. not web based service like Facebook/Orkut/Ning etc). Having read about Apache Shindig my hopes of finding a suitable application were very high.

For those who are not familiar with Apache Shindig, "Apache Shindig is an OpenSocial container and helps you to start hosting OpenSocial apps quickly by providing the code to render gadgets, proxy requests, and handle REST and RPC requests." (taken from the site). There is a Java version and a PHP one.

Shindig is a container allowing us to run OpenSocial gadgets across (in theory) SNs that support OpenSocial. Looking at gadgets used in popular SN services (like Orkut, Ning and others) they can generally be classed as entertainment and sales gadgets rather than real world apps, although there might be some exceptions (like to-do or chat gadgets). Shindig does not provide features like messaging, groups, photo gallery etc.

So apart from Shindig we need an application to sit on top or along side Shindig and provide us with the UI features we want (I call these, "component apps"), like: friends list, messaging, wall posts, photo albums, groups, creating networks etc).

The only application that I could find is Partuza which was surprising. Looking at it issue tracker it is clear that this application is in its infancy and not ready for full production use (lacks features and there are a few bugs). Not surprising since such full blown application probably requires substantial resources which, by the looks of it, Partuza is lacking.

Having this in mind it be better if the Open Source community started developing features (component apps) as components, independent from each other yet supporting interoperability. Not sure if OpenSocial as standard would be enough to support such a project but it could be extended if not.

This way there would be a range of component applications to choose from and relatively easy to build own Social Network(s). These components could include forum, wiki, blog etc to enrich SN environment as we know it today. There would be no reliance on one project (like Partuza) and costs would be spread across the community.

I've looked at Joomla and its ability to support third party extensions (component apps) and a similar approach should be taken up for OS-SN development.

Soon I will be looking at Google Wave and how it can be used as Social Network. Since Google Wave extends OpenSocial any existing gadgets should be reusable.