Tag Archives: Security

Encrypted Storage with SecureDrive at CES 2018



Encrypted external hard drives and USB memory sticks have been around for at least a decade, but most of the time it’s either locked or unlocked: if you have the password, you’re in. Sergey from SecureDrive shows Scott their security solution to this common problem.

SecureDrive specialise in hardware encrypted data storage. They’ve three product ranges with varying capacity (1 – 5 TB) to address different security and storage requirements.
– SecureDrive BT, which uses Bluetooth and an app for authentication
– SecureDrive KP, which uses keypad authentication
– BackupDrive, which backs up files and encrypts them with built-in anti-malware
For the rapid transfer of large files, all the devices use USB 3.0, and for security, it’s pending FIPS 140-2 level 3. That’s pretty secure.

The unique part of the SecureDrive solution focuses on the BT model, which uses Bluetooth and an authentication app. Instead of the drive only being locked or unlocked, the solution allows additional controls for geo-fencing and time schedules. For example, the SecureDrive BT can be set to only unlock between 9-5 M-F or only if the unit is within company premises. In addition, there’s remote management so authorisations can be revoked and the drive remotely wiped.

The drives are assembled in Ohio, USA, and they’re available for purchase priced at  US$299-$499. The remote management feature is a subscription service.

Scott Ertz is a software developer and video producer at F5 Live: Refreshing Technology.

Become a GNC Insider today!

Support my CES 2018 Sponsor:
30% off on New GoDaddy Orders cjcgeek30
$.99 for a New or Transferred .com cjcgeek99 @ GoDaddy.com
$1.00 / mo Economy Hosting with a free domain. Promo Code: cjcgeek1h
$1.00 / mo Managed WordPress Hosting with free Domain. Promo Code: cjcgeek1w
Donate to the Show: Support this podcast

Need a Housesitter? Ask Kevin at CES 2018



It’s a sad statistic that around half of us in the Europe and US will experience a break-in or burglary during our lifetime and unfortunately, I’m one of those. Most burglaries are over in less than five minutes and by the time the police turn up, the criminals are long gone. Smart homes and security alarms only go so far and what you really want is to deter the burglars from breaking in at all. You need a housesitter and Mitipi have one called Kevin. Todd thought Kevin was a minion

Kevin is the first IoT device to simulate the presence of people in a room by emitting light, shadow effects, and sound, meaning burglars will think someone’s home, and won’t want to break in for fear of being confronted or even caught.

Kevin is extremely easy to use. Place the device in a main room with a window, say, the living room. Once set up, Kevin can be controlled via the buttons on the box, or through the companion app. To pretend someone is home, Kevin uses a smart logic that considers multiple factors such as location, language, weather and home type to produce a realistic simulation with light, sound and shadows.

Kevin is currently on Kickstarter and the best pledge is SFr249, which is around GB£190 or US$270. Delivery is expected in December 2018.

Todd Cochrane is the host of the twice-weekly Geek News Central Podcast at GeekNewsCentral.com.

Become a GNC Insider today!

Support my CES 2018 Sponsor:
30% off on New GoDaddy Orders cjcgeek30
$.99 for a New or Transferred .com cjcgeek99 @ GoDaddy.com
$1.00 / mo Economy Hosting with a free domain. Promo Code: cjcgeek1h
$1.00 / mo Managed WordPress Hosting with free Domain. Promo Code: cjcgeek1w
Donate to the Show: Support this podcast

Keep Porch Pirates at Bay with BoxLock at CES 2018



From a consumer’s point of view, internet shopping is great: huge choice and prices to fit every pocket. Sure it takes a day or two to come but that only increases the rush while you wait for the delivery…..only that’s the snag. Many of us are in work when the delivery comes to our empty homes and either the delivery service takes it back to their depot or you parcel lies at risk of theft until you get home. BoxLock have an ingenious solution and Todd unlocks its potential with Brad.

BoxLock is an internet-connected smart padlock with a built-in barcode scanner. To use BoxLock, you first get a secure container or bin which can be locked using a traditional padlock – it’s usually called a hasp – and put it out front. The BoxLock then goes on the bin instead of the padlock.

When the delivery driver arrives, he (or she) simply grabs the BoxLock and presses the button on the top to scan the tracking number on the package. The BoxLock checks online via wifi and only packages addressed to you and that are actually out for delivery that day will unlock the BoxLock. The driver opens the container, places your package safely inside and then closes it all up.

Your BoxLock smartphone app then notifies you which package was scanned and that your BoxLock is safely locked with your packages inside.

Several of the big delivery companies are on board including FedEx, UPS, USPS and Amazon, so it’s perfect for keeping those porch pirates and packet thieves at bay.

BoxLock is current InDemand on Indiegogo for pre-ordering at US$109 (the video says $129 retail) with deliveries expected in June 2018.

Todd Cochrane is the host of the twice-weekly Geek News Central Podcast at GeekNewsCentral.com.

Become a GNC Insider today!

Support my CES 2018 Sponsor:
30% off on New GoDaddy Orders cjcgeek30
$.99 for a New or Transferred .com cjcgeek99 @ GoDaddy.com
$1.00 / mo Economy Hosting with a free domain. Promo Code: cjcgeek1h
$1.00 / mo Managed WordPress Hosting with free Domain. Promo Code: cjcgeek1w
Donate to the Show: Support this podcast

BIO-Key Uses The Power of Touch at CES 2018



Fingerprint readers are well established in all but the lowest cost smartphones – look at the Moto G-series for phones priced around US$200 – and it’s a trusted solution. So it’s not surprising that fingerprint readers are now appearing in other devices such as padlocks and bike locks. BIO-key are fingerprint specialists and have a range of locks and readers that do away with keys and passwords. Todd unlocks the potential of his finger with Scott.

BIO-key’s locks can be opened by a range of technologies depending on the model. Most use fingerprints, but others also have Bluetooth capabilities and some use PIN codes. There are some real benefits in using a fingerprint for unlocking – no key to lose, no combination to remember.
Prices start at US$39.99 for the TouchLock Designer, and a TSA approved lock is $54.95.

BIO-key produce fingerprint readers for PCs too, so if you don’t want to type in your password, check out these USB devices.

Todd Cochrane is the host of the twice-weekly Geek News Central Podcast at GeekNewsCentral.com.

Become a GNC Insider today!

Support my CES 2018 Sponsor:
30% off on New GoDaddy Orders cjcgeek30
$.99 for a New or Transferred .com cjcgeek99 @ GoDaddy.com
$1.00 / mo Economy Hosting with a free domain. Promo Code: cjcgeek1h
$1.00 / mo Managed WordPress Hosting with free Domain. Promo Code: cjcgeek1w
Donate to the Show: Support this podcast

WhatsApp Supermarket Phishing Scam



There’s a WhatsApp phishing scam doing the rounds here in the UK based on free gift vouchers from big supermarket retailers. It’s doing well because (a) people are receiving the links from friends and (b) they’re disguising the false links with foreign letters.

Here’s two that I received in the last few days.

 

Check the subtle dot over the c of Tesco and the line on the d of Asda. They got my scam senses tingling but many people seem to have fallen for it based on the couple of messages I received. Apparently there’s a variant for Aldi too.

If you do follow the links (and I recommend you don’t), the first part asks for more friends to pass on the message to, and the next bit starts collecting personal info so they can send out the vouchers. Yeah, right. Fortunately, friends I’ve spoken to became more suspicious on the second section and dropped out.

This scam can easily be moved to other retailers in other countries so watch out for it, though the basic scam has been around for awhile. It’s the use of special characters that seems to be new. I imagine that they can be creative with other letters in addition to c and d. More at the BBC.


Stay Safer with 2FA and a YubiKey



In the past couple of weeks I’ve received three notifications from haveibeenpwnd informing me that a couple of organisations didn’t do a good enough job keeping my info secure. While it’s always going to be a good idea to change your login and password, any sites that use 2FA significantly reduce the value of stolen credentials (as long as you’ve signed up for the 2FA option!)

What’s 2FA? Two Factor Authentication. Still not clear? Maybe you’ve used a web site that’s texted your phone with an extra number or code that needs typed in before you are let in to your account. That number is a “second factor” and you’re using 2FA to get into the web site. Excellent choice. 2FA is good because it means that even if ne’er-do-wells steal your details from a sloppy site, they don’t have access to your phone, so they can’t get any further. However, SMS authentication is not perfect – there are some vulnerabilities typically using “man in the middle” attacks.

If you want to take your online authentication to the next level, you might want to consider a physical security key for your second factor. This isn’t a key like you’d use in a lock, but a USB key that doesn’t look too dissimilar to a memory stick. A good example is Yubico‘s YubiKey 4 series range, which supports a wide range of protocols including “FIDO U2F, smart card (PIV), Yubico OTP, Code Signing, OpenPGP, OATH-TOTP, OATH-HOTP, and Challenge-Response” and can be used with many of the big names like Google, Facebook and Dropbox. The keys can be used for authentication when logging onto PCs too (depending on OS, version etc.)

As an end user, you don’t need to know all the technical stuff, only that it’s a very safe way of authentication and it’s simple to use. To get started, you first associate the security key with your account, and the next time you try to logon to the service, you’ll be prompted to insert the security key into a USB slot (or swipe for NFC keys). You can use one key for multiple sites.

Yubico provides YubiKeys for different use cases. There’s the standard YubiKey 4 which is designed to go on a keyring (keychain) and works with USB A. The YubiKey 4C  also goes on a keyring but works with USB C. The 4 Nano and 4C Nano are smaller and are intended for semi-permanent installation in USB A and C sockets respectively. For NFC applications, such as suitably-equipped smartphones, there’s the YubiKey NEO. Physically, the keys are tough. Allegedly, they can go through the washing machine and get run over by a car, though I didn’t try any of these.

Here I have a YubiKey 4 and 4 Nano (shown left) and they both work in the same way – the only difference is the size and what you touch to activate the key. Let’s take a look at getting Google setup with a YubiKey.

Login to your Google account, say via Gmail. Click up on the top right where your “headshot” is and then click again on “My Account”.

Head on into “Signing in to Google”. I’ve blanked out a few sensitive items.

2-Step Verification is what you want. Hopefully, you’ve already got this turned on but if not, go ahead and get this sorted out. This page shows the factors you can use for 2FA. Security keys are topmost with text messages and backup codes below (not shown).

Click on “Add Security Key”.

Get the YubiKey ready and insert when instructed. Hit Next.

On the YubiKey 4, the “Y” logo on the key will flash – tap with your finger to confirm. On the Nano, tap inwards on the end of the key. Once the YubiKey has registered, you can give it a name.

And that’s it – all set and ready to go. The next time you login to Google on a computer that you haven’t used before you’ll be prompted to insert your YubiKey to prove who you are. Super secure!

Other services are similar. Here’s part of the Dropbox procedure.

And Facebook…

Supported sites are listed here and you’ll recognise a good few of the names.

If you can see the benefits of secure 2FA, the YubiKeys can be purchased from the Yubico online store. The YubiKey 4 is US$40 and the 4 Nano is US$50, with similar prices in GB£ from amazon.co.uk.

The 4 series can do a whole lot more, and if you just want the basics, then a YubiKey 3 at only US$18 is a good start. I personally bought one of these awhile ago to secure my Google account.

Thanks to Yubico for providing the YubiKeys for review.


Keep Prying Eyes Away with the InvizBox 2



Perhaps I’m just old and suspicious, but I’m increasingly concerned about the personal information that I give away to companies like Google and Facebook for their services. I’ve had enough of being the product. As for the information gathered surreptitiously by third parties, such as ISPs and government agencies, I’ve had enough of snooping and I don’t accept that if I’ve nothing to fear, I’ve nothing to hide. It’s simply none of their business.

Consequently, I’m working on a couple of strategies to mitigate my exposure, including some fake personas for simple things like compulsory registrations. While I’m not a social media superstar, I’m present on most social media platforms and it’ll take time to balance out the public and private. Fortunately in the UK, it’s not illegal to take a new identity unless the intention is criminal (so I’m told).

On a more practical side, I’ve already signed up for protonmail.com to secure my email correspondence and I’m going to move away from the big name providers in a gradual process. The other area of interest is VPNs and for those who aren’t in the know, a VPN is a Virtual Private Network. It hides your activity from the owner or maintainer of any local network connection – think of it as an opaque pipe within a transparent tube – so it’s good for protecting against both nosy ISPs wanting to sell your browsing history, and defending against nefarious activity on public wifi hotspots.

I’ve been tinkering with some of the software-based VPNs both for both mobile and home use as my ISP provided-modem/router doesn’t have any VPN capability. Software solutions are fine if you have one or two devices, but when you’ve umpteen tablets and laptops in the house, it’s a pain.

An alternative is a dedicated VPN hardware solution and this Kickstarter campaign from InvizBox caught my eye. Simply, the InvizBox 2 is a wireless access point that connects to your home router, and then encrypts all the traffic over a VPN (or the Tor network). There’s no need for individual configuration as everything that connects to the access point benefits from the VPN. Your local ISP is then completely unable to track your activities and sell them on. Even better, the ISP can’t throttle your traffic based on type of use, or use of competing services.

Obviously these are benefits enjoyed by all VPNs, but as a neat hardware package, the InvizBox 2 looks attractive. Other features on the InvizBox 2 include ad blocking and parental controls. The latter is useful as the VPN will bypass any controls implemented on your router or by your ISP, so you might need to defend against inquisitive teens. You can get round geo-blocking too – that’s where you can’t see some content because you are visiting from the wrong country. As with most VPNs, a regular subscription is required (allow around US$5 / €5 per month) but there are some deals there too.

The standard InvizBox 2 is currently at €109 and the Pro is €149 if you get in quick, both with a year of VPN service. Other deals are available and delivery is expected in April next year. The team has already hit their goal of €50,000 and there’s still a week to go, so the project is going to be funded. As background, the InvizBox team are based in Dublin, Ireland and have a track record of delivery from previous Kickstarters, so there’s a good level of confidence. However, as with all Kickstarter campaigns, consider yourself a patron rather than a customer until the product is in your hands.

I might actually plonk down some cash for this….