There are plenty of reasons to love WIFI (over wireless). It's free, fast and usually reliable. Often times though, its not a WIFI network you control (think coffee shop, retail store, mall, fast food joint, etc). Sure WIFI is ubiquitous but most of it is controlled by someone else which means is could and should be considered a hostile environment.

Man In The Middle Attack

A Man In The Midle (MITM) attack is an oldie but goodie. It allows a third party to intercept your communication. If successfully performed, an attacker can present a fake "hacker version" of a site you are trying to visit in the hopes of infecting your machine or harvesting your credentials.

An innocent use of this technology is when a WIFI provider intercepts your web browsing request (when you first connect to their network) and injects a logon or terms acceptance page (captive portal). This is a benign use of the technology but bad actors can use this to inject malicious code to infect your computer or trick you.

What you should do: Ensure any site you visit requiring a login or requesting private information is using an encrypted SSL/TLS connection (aka the green lock icon in Chrome). Look for a URL that starts with https instead of just http. Make sure the lock icon is green. 

We are seeing more and more sites switch to encrypted https but many have not made the jump yet. You should also add a free browser plug-in called HTTPS Everywhere. It is a free plug-in developed by the Electronic Frontier foundation and the TOR project which automatically rewrites requests to the secure https protocol when supported by the site. 

Fake WIFI networks

This is a very easy to use trick that is successful any time I have tested it. I basically setup a very strong signal WIFI network with carefully chosen (trustworthy sounding names) that get users connecting to it and then I simply do what I want to do and resend the traffic to the local establishment's free WIFI network thus performing a Man In The Middle attack. 

I can even use the same WIFI name as the local establishment's and your device will automatically connect to my rogue network if my signal is stronger (that's why automatic connections to untrusted WIFI networks can be a very bad thing unless you are always on VPN). I can create one of these network with cheap devices but my preferred tool is the WIFI pineapple. 

What you should do: Be weary if you see multiple networks with the same name at your local coffee shop. It doesn't always mean there is an attack happening but it should give you pause. The real solution is to always use a VPN network when connecting to a WIFI network you don't directly control.

Collecting your wireless information

Sniffing network traffic is a technique used by corporate network administrators to collect information to perform debugging and to try and identify system issues. Sniffing is basically collecting all (some or most) traffic flowing over a network. In the wireless world, this is made incredibly easy and can be done by hackers without anyone's authorization. All it requires is a special (cheap) wireless network card configured to startup in a special mode and then they can capture all the traffic flowing over the wireless network. Once you had the hardware, you simply need a free software like Wireshark to start capturing all wireless traffic. 

Anyone interested in WIFI testing should buy a WIFI Pineapple. You can't call yourself a real security pro without one. I'll wait while you go and buy from from here. (no that is not an associate link and I do not get anything for recommending them. It is just an awesome product).

What you should do: Ensure any site you visit requiring a login or requesting private information is using an encrypted SSL/TLS connection (aka the green lock icon in Chrome). Look for a URL that starts with https instead of just http. Make sure the lock icon is green. Encrypted traffic can be captured but is all garbled up and useless to the attacker. Or you can use a VPN service (which I will talk more about later).

Stealing cookies

No.. not cookies from a coffeeshop but cookies used by websites to authenticate your session. Most websites drop a session cookie in your browser after you log in so you don't have to log-in every-time you visit the site operators page. Most major sites go to great lengths to protect this cookie but many don't and attackers will try to steal these when patrons use unencrypted websites. By stealing the cookie and using it from the same location, many sites will be tricked into thinking the user is logged in and will allow him/her to perform actions without additional checks.

What you should do: Ensure any site you visit requiring a login or requesting private information is using an encrypted SSL/TLS connection (aka the green lock icon in Chrome). Look for a URL that starts with https instead of just http. Make sure the lock icon is green. Encrypted traffic can be captured but is all garbled up and useless to the attacker. Or you can use a VPN service (which I will talk more about later).

Peekaboo I see you

When organizing a security test for a company, my preferred method of attack is attacking the bag of mostly water (aka the human). Humans are usually careless, clumsy and easy to trick. It is much easier to compromise a human than an IT system.

Shoulder surfing is the art of looking over someone's "shoulder" as they type protected information info a computer system. This could be a building entry code, the PIN for your ATM card or a site password. 

This is an especially easy attack when you are in a crowded area where it feels normal to have people close by (packed coffee shop with tight tables, a bus, etc).

What you should do: When I travel, I have a 3M privacy filter on my computer screen to make it more difficult for people around me from seeing my private on-screen information from onlookers. Additionally I always cover any keypad when entering my PIN and never enter passwords when in a crowded area. The important thing is to realize this could happen and pay attention to your surroundings. 

What about that VPN option

My next article will be about 1 or 2 VPN providers that I trust and use but for now, I'll write about what a VPN is. A Virtual Private Network is a special technology that creates a secure connection between your device and that of the VPN provider. That means anyone eavesdropping (digitally) on your WIFI or LTE connection will only see garbled 

Of course the VPN provider will see all of your traffic as they send it to the general internet from their servers but at least you protect yourself from local WIFI attacks. Additionally, anytime you use an https site, that traffic is protected and even your VPN provider cannot see the content of that traffic.

As an example: 

I am sitting in a coffee shop browsing facebook via their mobile website. Their mobile website is protected because it uses TLS (https). I distrust public WIFI, I also have a VPN active.

This means that my connection (all traffic to and from the internet to my device) is encrypted inside that protected VPN tunnel [from my device until the server of the VPN provider] thus no one in the local coffee shop sees where I am browsing and what I am sending/receiving. This protects you from all those local attacks.

Because I am using the facebook website on my device, it is also using protected https which means traffic for that site is encrypted a second time between me and Facebook. This means that the VPN provider knows I visited facebook but can't see anything else.

Obviously you have to trust the VPN provider not to profile you but this is much better than trusting a coffee shop WIFI or even your wireless LTE carrier.

The US Government is moving to kill a law preventing carriers from selling user data to the highest bidder. This means even your home internet provider or wireless carrier will probably start tracking your every move on the internet and selling it to marketing companies. Many people should start thinking about running a permanent VPN from their home router to the internet to protect themselves from this type of profiling.

For those that want a fast, easy and reliable VPN appliance, read my review of the InvizboxGO here. 

As we learn more about how much data the intelligence community collects and what their capabilities are (Vault7), it reinforces the mantra of having good security hygiene. If you weren't using VPN while on (untrusted) WIFI connections, then you should be. 

I consider untrusted any WIFI network I don't directly control. I even use VPN (normally) when on LTE because I don't trust my wireless carrier.

VPN hardware galore

Appliances properly designed and maintained should make most tasks easier and safer. VPNs and TOR are no exception. Kickstarter and IndieGogo are full of entrepreneurs promising easy security. Unfortunately most fall flat because they are simply re-badged Chinese products with a crappy interface. 

The worst of the bunch are un-maintained products with tones of exploitable vulnerabilities leaking your data with every transaction. Invizbox was a Kickstarter funded company and their first product, a small gumbox sized WIFI anonymization router worked as advertised. It's major drawback was the requirement to have a physical connection to the internet and it was slow. Oh so slow. 

The design team came back with a vengeance and released the InvizBoxGO late last year.  The invizboxGo is a small battery powered device that will secure your WIFI connections and work as a battery backup if you need it. 

The InvizboxGo is sold with an optional "white labelled" VPN service. When you buy the VPN service, you receive the "enhanced" TOR experience which basically means it uses VPN for the first hop to the TOR network thus protecting even that flow of traffic.

It also supports "pluggable transport" (description). Basically pluggable transport is a technology which allows you to change how the TOR traffic looks thus allowing you to bypass anonymity blocking tools (corporate or governmental).

A coming soon feature to force connections to htts when available (like a hardware implementation of https everywhere). 

You can also review the Invixbox firmware sourcecode on . The team hopes that this transparency will:

• prove there are no backdoors
• allow researchers to find and highlight vulerabilities
• give the team immediate trust

InvizBoxGo Easy Setup

The testing

I ran the InvizboxGo through a gauntlet of technical tests (while on VPN) and it passed every single one:

• does not leak DNS queries when in VPN mode (go here to test)
• does hide your actual IP address (go here to test)
• does not leak IP or DNS information via JAVA or Flash ( Go here to test)
• protecting P2P traffic. Although I do not condone or encourage the use of P2P tools to steal protected media, there are dozens of legitimate uses for P2P technology. It is important to ensure your VPN product protects you while using P2P and Invizbox did. You go to this site and the find the Torrent Address Detection. You download their magnet link into your P2P client of choice then activate the test. If it shows your real IP or DNS, you are not protected. You should only see your VPN address here.
• InvizboxGo is not subject to WebRTC leaks when in VPN mode (go here to test

I conducted my tests via VPN because that is what most users will likely use. If you are technical enough to use TOR, you can do your own testing.

Yes it did slow down my connection to the internet but that depends on a tone of factors. The amount of slowdown will be based on your ISP (potential throttling of VPN traffic), connectivity between you and your chosen VPN endpoint, number of hops, traffic on the net, encryption overhead, etc Overall there was a slowdown (which is normal) but not enough for me to panic.

The killer feature

The InvixboxGo was delivered with the promise of auto-update. The creators promised to keep the device updated to add functionality and patch vulnerabilities. This update should be automatic if you keep your device connected regularly. 

So far I have received one update (during my 2 months of testing) and think this is a big plus if they keep it up.

Issues with the InvizboxGo

My first complaint is that it works well for most captive portals (hotel and airport) but I have not been able to connect it to a corporate portal or WIFI requiring username/password to connect. I was told this issue is logged and that they will investigate.

The second issue is that the device doesn't have a physical ethernet port. Most of my connections are WIFI but recently I have stayed in top tier hotels that have only had Ethernet in the rooms which meant I had to use another Ethernet to WIFI device then use Invizbox to secure my connection. 

I would have liked some kind of additional add on that would allow me to use an Ethernet connection (for WAN) when required.

Conclusion

Overall this is a fantastic unit  that I enjoy using. It is fairly speedy, reliable and easy to use.

Automation can be help with simple tasks like converting a webpage to PDF or can become a complex monster saving you hundreds of hours a year. Until the Workflow app came to IOS, true automation was an Android only benefit.

The $5 app is now permanently free because Apple acquired them. 

The Workflow app has been around for a couple of years and is a distant cousin (functionally) to IFTTT. It allows users to string together a series of actions, tasks, conditions and inputs and perform all kinds of useful tasks.

It can:

• Encode media
• Record Audio
• Post on social media
• Automate app functionality where a URL scheme is exposed
• Send emails
• Pull RSS feeds
• much much more

What we don't know yet is what Apple will do with the team and the app. It was made free but there is always the risk Apple will kill the app and move some of the functionality to:

• a new Apple branded app
• into a new version of IOS
• into a new service running on iCloud

Yes Wikileaks released a very large chunk of CIA information dubbed Vault7 that explains some of the hacking capabilities of the US intelligence service vis-a-vis consumer electronics. Obviously this "isn't good" from a privacy perspective because if the US intelligence community has these capabilities, other nation-states may also have them. 

After going through some of the information, I want to dispel some of the FUD (Fear Uncertainty and Doubt).

Are Whatsapp or Signal hacked?

I have written about Whatsapp security and professed my love for Signal . Many readers messaged me in a panic asking if these apps had "weak" security and had been breached by the CIA. 

Signal and Whatsapp encryption was not broken. 

The CIA would compromise the smartphone (iphone or Android) and then would install malware that would record audio, text or video before the Whatsapp/Signal encryption. 

The Wikileaks statement reads like this:

So the short answer is no, these messaging apps were not compromised and their security is still good. Every security researcher know you must must must secure the endpoint because it is normally the weakest link in the chain. Here is proof. 

The security of Signal protocol was recently reviewed during a security audit and it passed with glowing colors. The EFF also rates Signal as an "all green" messaging app. 

Is the CIA hoarding 0 zero vulnerabilities?

We don't know what the CIA is really doing but based on the Vault7 Wikileak, I would say no. Very few 0 day attacks seem to be mentioned in the dump and any that were are being actively used. Nothing in the leak seems to indicate a hoarding of 0 zero vulnerabilities for emergency use.

The attacks mentioned in the leaks may be worrisome to John or Jane Doe but they are nothing new for anyone working in security. They seem to be leveraging "stuff" we already know about the Information Security circles. Yes they sometimes buy advanced attacks from brokers or researchers but most of what I read, I expected them to have.

Nothing I read would indicate that the CIA digital attack toolkit is better than that of the NSA. It is safe to assume the NSA has much stealthier and more powerful tools.

Do I break my Smart TV?

Don't throw away your Smart TV just yet. We learned that the CIA can hack your Smart TV and turn it into an espionage tool by running hacking software via USB port on the TV. Let me say that again, via USB port. 

Nothing in the document indicates that they can do this remotely via the internet. In security, we always assume that it is impossible to protect an asset if a bad actor can gain physical access to it. Nothing new here. 

Attribution

There are 2 pieces of malware in the wild that were thought to have come from China and Russia but can now likely be attributed to the CIA. These leaks provide enough information for security companies to now make educated assumptions about malware sources they know about and are trying to identify the source of. 

A colleagues working for a US security company said that they can now attribute 2 malware to the CIA previously thought to have come from China or Russia. He said his company will now use the info in these leaks to built signatures to detect and remediate some of the vulnerabilities mentioned here. 

Does this hurt the CIA. I would say no. There are enough vulnerability brokers in the dark market and the CIA has enough money to quickly rebuild a new toolkit.

Are these advanced hacking techniques?

No. They may seem advanced for the average Joe but there wasn't anything monumental or earth shattering for a security researcher. Funny enough, I've been chatting with one of my employees about a new tool from Hak5 called Bash Bunny. The Bash Bunny seems to be more advanced than many of the techniques revealed in this document. 

Is my tech safe?

The BBC published a good article documenting the reaction from major consumer tech manufacturers. 

As expected, Apple provided a lengthy response and committed to working with its security team to plug as many of the holes as quickly as possible.

Samsung provided this response

Notably absent (at least while I write this) is a response from Google about the vulnerabilities in Android that were actively exploited. As we know, not all Android phones receive timely updates and even those that do have some worrisome vulnerabilities. 

For the general consumer that is not being targeted by a nation-state intelligence agency, as long as you adhere to good security practices, an a Google branded Android phone will be just as safe as an Apple iPhone. I cannot recommend buying an Android phone from any other manufacturer as updates may be slow or non-existent. 

If you are in a job were security is critical, i would still contend that the iPhone is likely more secure because of the way Apple locks everything down.

Conclusion

I won't lose any sleep over the CIA leak. Yes it confirms that the US intelligence apparatus is actively targeting consumer hardware but we all assumed they were doing this anyway. Nothing in this leak revealed anything new and I would assume the NSA Signals Intelligence team is still the king of the hill. Sure the CIA seems to have a couple pocket knives but the NSA still has that 10" Rambo knife strapped to its belt.

 Also assume anything the US is doing can be easily replicated by other nation state actors. Do you really want foreign governments to have these abilities and your own (Canada, US, UK, Australia, etc) not to?

A question I receive regularly is about what makes up my EDC kit. The first article I wanted to publish was about my pen. This is no ordinary pen. It is a magical pen that accepts over 200 different types of ink refills (roller-ball, ballpoint or D1). It is a beautiful pen made from aircraft grade titanium, which makes it super durable, light and incredibly beautiful. 

I have used hundreds of pens from a cheap BIC all  the way to an exclusive Montblanc. After everything is said and done, the TI Arto from Big Idea Designs is the one I chose to carry everyday (at work, during travel or at play). 

Why? First this wonderfully designed and carefully crafted pen accepts over 200 different types of ink refills (without hacking or modification). This means I can buy ink refills anywhere in the world and know it works. It even accepts the Uni-ball Signo DX without any modification. This is a highly prized refill by pen lovers worldwide but it never fits into these pen bodies. It works wonderfully in the TI Arto. How? Because the creative team at Big Idea Designs created a cone head that tightens as you screw it and therefore can securely hold almost any type of pen head in place. This internal compression cone is what makes this pen stand apart and is the secret to how it can accept 200+ ink refills. It is easy to use but will require a little fidgeting as you adjust it (when replacing the ink).

It is built from titanium which means it is extremely light and durable. I carry it in my wallet pocket along with a lighter and aluminium plate wallet and it has held up well. 

Overall I highly recommend the TI Arto. It will be a useful and beautiful part of any EDC kit delivering a lifetime of use.

link

Example of Refills accepted by the pen without modification. This is grows every week.

Pen Name / Refill Name

Rollerball Style Refills

•Avant Pen Refills (0.5mm)
•Bic Velocity Gel Refill 0.7mm (Medium)
•Bic Velocity Gel Refill 1.6mm (Bold)
•Cross Gel Rolling Ball Refill 0.7mm
•Cross Porous Point Felt Tip Refills (Fine & Medium)
•Dong-A Fine Tech RT Pen Refill (GRC-43)
•Duke Rollerball Refill (Medium)
•Faber-Castell Ceramic Rollerball Refill 0.5mm
•Foray (Office Depot) Replacement Refills
•Foray (Office Depot) Replacement for Schmidt Rollerball Refills
•Foray (Office Depot) Replacement for Waterman Rollerball Refills
•Lamy M63 Refill
•Moleskine Gel Refills (0.5 and 0.7 mm)
•Mont Blanc Fineliner Refills
•Mont Blanc 163 Rollerball Pen Refills (F) & (M)
•Monteverde Rollerball Refill (Mont Blanc Style Replacements)
•Monteverde Mini Rollerball J22 Refill for Mini Jewelria Pens
•MUJI 0.5mm Refill
•Ohto C-304P Ceramic Rollerball Pen Refill – 0.4mm
•Ohto C-305P Ceramic Rollerball Pen Refill – 0.5mm
•Ohto C-307P Ceramic Rollerball Pen Refill – 0.7mm
•Ohto C-310P Ceramic Rollerball Pen Refill – 1.0mm
•Ohto F-300 Fude Pen Brush Refill
•Pentel EnerGel BLN105 Rollerball Pen Refill – 0.5mm
•Pentel EnerGel LR7 Gel Pen Refill – 0.7 mm
•Pentel EnerGel LR10 Gel Pen Refill – 1.0 mm
•Pentel EnerGel LRN5 Needle-Point Gel Pen Refill – 0.5 mm
•Pentel EnerGel LRN7 Needle-Point Gel Pen Refill – 0.7 mm
•Pentel HyperG Retractable KL257 Series (LR7 & KLR7)
•Pentel Sliccies Gel Multi Pen Refill (XBGRN3A) – 0.3 mm
•Pentel Sliccies Gel Multi Pen Refill (XBGRN4A) – 0.4 mm
•Pentel Sliccies Gel Multi Pen Refill (XBGRN5A) – 0.5 mm
•Pentel Slicci Techo Mini Gel Pen Refill (BG503) – 0.3 mm
•Pilot Ageless Future Gel Pen Refill (BLGS-7) – 0.7 mm (2 Colors)
•Pilot B2P Bottle to Pen Gel Ink Pen Refill – 0.7mm
•Pilot Frixion Ball Gel Multi Pen (LFBTRF refill) – 0.38mm
•Pilot Frixion Ball Gel Multi Pen (LFBTRF refill) – 0.5mm
•Pilot Frixion Ball Gel Multi Pen (LFTRF refill) – 0.38mm
•Pilot FriXion Ball 2 Biz Gel Pen Refill – 0.38 mm
•Pilot Frixion Erasable Gel Pen Refill (LFRF30P4) – 0.4mm
•Pilot Frixion BLS-FR5 (LFBK-23EF-B refill) – 0.5mm
•Pilot G2 Refills (America’s #1 selling ink gel pen, 0.38, 0.5, 0.7, &1.0mm)
•Pilot G2 Pro
•Pilot G6
•Pilot Hi-Tec-C Cavalier 0.4mm (Has more ink than the standard Hi-Tec-C refill)
•Pilot Hi-Tec-C Coleto 0.3mm (LHKRF-10C3) 15 different colors
•Pilot Hi-Tec-C Coleto 0.4mm (LHKRF-10C4) 15 different colors
•Pilot Hi-Tec-C Coleto 0.5mm (LHKRF-10C5) 15 different colors
•Pilot Hi-Tec-C Slim Knock Gel Pen Refill (LHSRF-8C3) – 0.3mm – 3 Colors
•Pilot Hi-Tec-C Slim Knock Gel Pen Refill (LHSRF-8C4) – 0.4mm – 3 Colors
•Pilot Hi-Tec-C “Standard” – 0.25mm (BLS-HC25)
•Pilot Hi-Tec-C “Standard”- 0.3mm (BLS-HC3)
•Pilot Hi-Tec-C “Standard”- 0.4mm (BLS-HC4)
•Pilot Hi-Tec-C “Standard”- 0.5mm (BLS-HC5)
•Pilot Juice Gel Ink Series Refill 0.38, 0.5, 0.7mm (LP2RF) – (3 Colors)
•Pilot Precise V5 RT/V7 RT, named Hi-tecpoint V5 RT/V7 RT in Europe
•Pilot Q7 Needle Point Refill 0.7mm (BLS-GCK-7 / LHKRF-8C7)
•Pilot V ball RT (BLS-VB5RT)
•Pelikan Roller Refill 338 Rollerball
•Platinum Gel Pen Refill (BSP-60S) 0.5mm
•Platinum Gel Ball Pen Refill (GSP-80N) – 0.5 mm
•Roting TIKKY Liner Refill – 0.5mm
•Sakura R-GBH Ballsign Gel Multi Pen Refill – 0.4 mm (4 Colors)
•Sakura R-GBP Ballsign Knock Gel Pen Refill – 0.4 mm (3 Colors)
•Schmidt Safety ceramic roller 888 Fine
•Schneider Topball 850
•Staples Classic Grip Pen 0.7mm Gel (#31581)
•TUL GL1 Gel Pen Retractable Needle Point Fine 0.5mm
•Uniball Signo DX 0.28mm Refill (UMR-1-28)
•Uniball Signo DX 0.38mm Refill (UM-151)
•Uniball Signo DX 0.5mm Refill (UMR-1-05)
•Uniball Fanthom Erasable Gel Pen Refill (UFR-122) – 0.5 mm (3 Colors)
•Uniball Impact RT 1.0mm Bold (Signo UMR-80)
•Uniball Style Fit Gel Multi Pen Refill (UMR-109) – 0.28, 0.38, 0.5mm (16 Colors)
•Uniball Signo RT Gel 0.38mm & 0.5mm (UMN-138)
•Uniball Signo (UMN-152)
•Uniball Signo 0.28mm (UMN-82)
•Uniball Signo 0.38mm (UMN-83)
•Uniball Signo 207 Gel Refill 0.7mm (UMR-87, UMR-85)
•Uniball Jetstream 0.38 (SXR-38)
•Uniball Jetstream 0.5mm (SXR-5)
•Uniball Jetstream 0.7mm (SXR-7)
•Uniball Jetstream 1.0mm (SXR-7)
•Uniball Jetstream 1mm (SXR-10)
•Uniball Mitsubishi Liquid Ink Rollerball Pen Refill(UBR-300)- 0.5 mm
•Visconti Rolling Ceramic 0.7mm (AA40)
•Waterman Rollerball Refill
•Zebra Sarasa Clip Pen Refill – 0.7mm (JF-Refills for Sarasa, Sarasa SE, Sarasa Clip)
•Zebra JF-0.4 Sarasa Gel Pen Refill – 0.4 mm (4 Colors)
•Zebra JF-0.5 Sarasa Gel Pen Refill – 0.5 mm (4 Colors)
•Zebra JJ2 Gel Ink Refill
•Zebra J15 Gel Ink Refill
•Zebra JJZ15 Gel Ink Refill
•Zebra JJ21 Gel Ink Refill
•Zebra Sarasa Dry Gel Ink Rollerball Refill (JLV-0.4) – 0.4 mm (3 Colors)
•Zebra Sarasa Dry Gel Ink Rollerball Refill (JLV-0.5) – 0.5 mm (3 Colors)
•Zebra Gel Ink Rollerball Refills (RBJF5) – 0.5mm (3 Colors)
•Zebra JT-0.4 Sarasa Gel Pen Refill (RJT4-BK)- 0.4 mm
•Zebra RJF3 Gel Ink Refill
•Zebra RJF4 Gel Ink Refill
•Zebra RJF5 Gel Ink Refill
•Zebra RJF10 Gel Ink Refill
•Zebra Sarasa (NJK-0.4) – 0.4mm
•Zebra Sarasa (NJK-0.5) – 0.5mm

Ballpoint Style Refills

•Ballograf Original Ballpoint Pen Refill (4 Colors)
•Ballograf Pocket Ballpoint Pen Refill (2 Colors)
•Bic Pro+ 1.0mm Pen Refill
•Diplomat EasyFLOW Ballpoint Pen Refill
•Caran D’ache Goliath Refill
•Faber-Castell Ballpoint Pen Refill (Medium)
•Faber-Castell Scribero Gel Ink Roller Refill
•Fisher Space Pen “PR” Series Refills – 15 Different Refills
•Fisher Space Pen “U” Series Refills (UF1, UF2, UF4) – 3 Colors
•Foray (Office Depot) Ballpoint Refill for Parker Refills
•Foray (Office Depot) Replacement For Mont Blanc Ballpoint Refills
•Foray (Office Depot) Ballpoint Refill for Waterman Refills
•Kaweco Soul G2 Refill 1.0mm
•Kaweco Sport Roller Ball Pen Refill (This is a smooth Rollerball gel ink)
•Kokuyo FitCurve Ballpoint Pen Refill (PRR-SJ7D) – 0.7 mm (3 Colors)
•Lamy M22F Refill – Fine, Med, Broad
•Metaphys Locus 3Way Multi Pen Refill – 0.5mm
•Midori Brass Bullet Ballpoint Pen Refill – 0.5 mm
•Moleskine Ballpoint Refill
•Mont Blanc Ballpoint Refills (F) & (M)
•Monteverde Needle Point Refill (Fine)
•Monteverde Soft Roll P13 – Colored inks
•Monteverde Soft Roll P15- (Superbroad, Medium, Ultrafine)
•Ohto P80-05NP Needlepoint Ballpoint Pen Refill 0.5mm
•Ohto P80-07NP Needlepoint Ballpoint Pen Refill 0.7mm (writing width is 0.35mm)
•OhtoPS-205NP Extra-Fine Ballpoint Pen Refill 0.5mm (writing width is 0.35mm)
•Ohto PS-207NP Extra-Fine Ballpoint Pen Refill 0.7mm
•Ohto 893NP Needle-Point Ballpoint Pen Refill – 0.3 mm
•Ohto 895NP Needle-Point Ballpoint Pen Refill – 0.5 mm
•Ohto 897NP Needle-Point Ballpoint Pen Refill – 0.7 mm
•Parafernalia Ballpoint Pen Refill
•Parker Ballpoint Pen Refill (Broad, Medium, Fine)
•Parker GEL Ballpoint Pen Refill (Medium)
•Parker Quinkflow Ballpoint Pen Refill (Medium, Fine)
•Pelikan Giant Ballpoint Pen Refill 337 (Broad, Fine, Medium)
•Pentel Rolly C4 Ballpoint Multi Pen Refill (BKSS7) – 0.7 mm (4 Colors)
•Pentel (KFLT8) Ballpoint Pen Refill
•Pentel Selfit Ballpoint Pen Refill (BKS7H-AD)- 0.7 mm
•Pentel Vicuna XBXST5-A Refill – 0.5mm
•Pentel Vicuna BXM5H Refill – 0.5mm
•Pentel Vicuna BXM7H Refill – 0.7mm
•Pilot BRFV-8EF Acro Ink Ballpoint Pen Refill – 0.5 mm (3 Colors)
•Pilot BRFV-8F Acro Ink Ballpoint Pen Refill – 0.7 mm (3 Colors)
•Pilot BRFN-30F Ballpoint Pen Refill – 0.7 mm
•Pilot BRFN-30M Ballpoint Pen Refill – 1.0 mm
•Pilot BTRF-6F Ballpoint Pen Refill – 0.7 mm (3 Colors)
•Platignum Standard Ballpoint Pen Refill
•Sailor Pica Kirei Anti-Bacterial Ballpoint Multi Pen Refill – 0.7 mm(3 Colors)
•Sailor Pica Kirei Anti-Bacterial “Mini” Ballpoint Multi Pen Refill – 0.7 mm (3 Colors)
•Sakura R-NOB Ballpoint Pen Refill ( SAKURA R-NOB#49) – 0.7 mm
•Schmidt P900 B Ballpoint Pen Refill (Broad, Medium, Fine)
•Schmidt P950M MegaLine Pressurized Ballpoint Pen Refill (Medium)
•Schmidt 4889 MegaLine Pressurized Pen Refill
•Schmidt 9000M EasyFlow Pen Refill
•Schmidt P8900 Super Bowl Refill (Fine)
•Schneider Express 735 Pen Refill (Broad, Medium, Fine)
•Schneider Slider 755 Pen Refill (Extra-Broad, Medium)
•Sheaffer Ballpoint Refill II (Medium)
•Sheaffer K Ballpoint Refill
•Sheaffer T Ballpoint Refill
•Stabilo Ballpoint Refill
•Stabilo EASYgel Refill
•Tombow BR-ZLM Ballpoint Pen Refill
•Uni SXR-80-05 Jetstream Ballpoint Multi Pen Refill – 0.5 mm (4 Colors)
•Uni SXR-80-07 Jetstream Ballpoint Multi Pen Refill – 0.7 mm (4 Colors)
•Uni Power Tank High Grade Ballpoint Pen Refill – 0.7 mm
•Visconti Ballpoint Pen Refill AA49 1.4 (Broad)
•Visconti Gel Refill AA38 (Broad, Medium, Fine)
•Zebra F-Refill Ballpoint Pen Refill – 0.7 mm (2 Colors)
•Zebra G-301 JK-Refill Gel Pen Refills – 0.7 mm (2 Colors)
•Zebra SK-0.4 Ballpoint Pen Refill – 0.4 mm (2 Colors)
•Zebra SK-0.7 Ballpoint Pen Refill – 0.7 mm (4 Colors)
•Zebra Stylus Pen LV-Refills – 1.0mm
•Zebra Zmulsion Ink Pen Refill – 1.0 mm (EQ-1.0)

D1 Style Refills

•Acme Black 4FP Four-Function Pen Ballpoint Pen Refill
•Acme Highlighter 4FP Four-Function Pen Multi Functional Pen Refill
•Aurora Mini Medium Point Ballpoint Pen Refill
•Caran D’ache Ecridor XS Mini Refill
•Cross Matrix Ballpoint Pen Refill
•Cross Micro Ballpoint Pen Refill
•Kaweco D1 Soul Ballpoint Refill
•Lamy M21 Ballpoint Pen Refill
•Lamy M55 Tripen Marker Refill (Orange Highlighter)
•Monteverde Soft Roll Ballpoint Pen Refill – D1 (628)
•Ohto R-4C5NP Needle-Point Ballpoint Pen Refill – 0.5 mm
•Ohto R-4C7NP Needle-Point Ballpoint Pen Refill -0.7mm
•Parker Mini Ballpoint Refills
•Parker Vector 3-in-1 Ballpoint Refills
•Pelikan 38 Ballpoint Refills
•Pentel XBXS5-A (0.5mm)
•Pentel XBXS7-A (0.7mm)
•Pentel Vicuna XKBXES7 Ballpoint Pen Refill – D1 – 0.7 mm
•Pilot BRF-8M & BRF-8F-B 0.7mm Refills
•Pilot Hi-Tec-C Slims (LHRF-20C3-B 0.3mm)
•Platinum BSP-60 Series
•Platinum BSP-100
•Platinum SBSP-120S Hybrid Ink Ballpoint Refill
•Retro 1951 D-1 Ballpoint Refill
•Rotring Tikky 3-in-1 Ballpoint Refills – 0.7mm (2-Colors)
•Staedtler Multi Pen Ballpoint Refill (92RE-09)- D1 – 0.7 mm
•S.T. Dupont Mini Olympio Ballpoint Pen Refill
•Tombow Outdoor Pen Refill (BR-VMP)
•Tombow VS Ballpoint Pen Refill (BR-VS) – D1
•Uni SXR-200 Jetstream Ballpoint Multi Pen Refill (0.5 and 0.7mm)
•Zebra Tele-scopic Slide Ballpoint Pen Refill – 4C – 0.7mm
•Zebra ESB-0.7 Emulsion Ink Ballpoint Pen Refill – D1 – 0.7 mm
•Zebra JSB-0.4 (RJSB4-BK)
•Zebra JSB-0.5 (RJSB5-BK)
•Zebra Sharbo X Ballpoint Multi Pen Refill Component – D1
•Zebra Sharbo X Gel Ink Multi Pen Refill Component – D1

I have been an Evernote user since September 26 2008 (8 years 5 months 8 days). Many of those years were spent as a paying premium customer, but at the end of 2016, I decided it was time to leave. I wanted to share why I am leaving and my plans to replace it.

The Evernote I loved

From the very beginning, Evernote was a wonderful company to support. It was this scrappy upstart that was committed to building a "100 year company" (link) and was incredibly committed to its customers. It believed in openness and came to market with original ideas. It was unlike anything else being offered at the time.

The original founding leaders had this crazy open-dialog podcast that gave listeners an inside look into the company. The freemium model Evernote pioneered worked like a charm. Evernote constantly moved premium features into the free tear and was constantly challenged to make newer & better features for the 5% of their paying premium customer-base. 

Every platform I tested had an Evernote client that worked relatively well and within minutes of setting up a new device, everything I had captured was there waiting for me. It was a wonderful time.

The app was lightning fast and reliable. Sync was blazing and worked every time. Text recognition (even in images and attachments) was super accurate. I was happy.

Even though I didn't need most of the premium features, I started paying a premium membership to support the company. It was my one key app. I used it as my reference folder, as my to do manager (GTD), my list making application, etc. It become an extension to my brain. 

I was an Evernote ambassador, talking about it every chance I had and bringing more and more people into the fold. Everyone that joined Evernote thanked me. Everyone loved it, even those on the free tier. It offered incredible value to everyone that took the time to use it. Search Amazon for Evernote and you get 1,145 products from Moleskin notebooks to books to help organize your life using Evernote. 

Then July 20th 2015, they announced via a blog post that Phil Libin would be leaving the company and his replacement was this polished executive named Chris O'Neill. Other executives also left (such as Max Levchin). Little did we know O'Neill had plans to dramatically change the service we had come to love and depend on.

The Bad Changes

The new Evernote price

The first major shock was the change in pricing. My beloved Premium membership almost doubled in price and the functionality of the free/plus service dropped. 

When prices increase, consumers will evaluate all possible alternatives and determine if the new price is still the best choice for him/her.

For $10 more a year, I can buy an Office 365 home subscription shareable with 5 family members. Everyone on my accounts is entitled to all of the Microsoft Office apps (Word, Excel, Powerpoint, etc), plus each user receives 1TB of online OneDrive storage and of course Microsoft made it's OneNote app free for everyone on all platforms.

As a customer of Evernote, I was asking myself if spending an extra $10 and moving to Office 365 home made sense. For most consumers, it will.

The second was the downgrade if you chose not to pay these new higher prices. You were limited to sync on only 2 devices and your free monthly upload allowance was 60MB which meant it become unusable (for free) for most users.

The junkening

Over the years, Evernote lost its way and tried to become the everything app for everyone (a swiss Army knife). It had a food memories app.

The Evernote Food app allowed you to capture memories of great food you had enjoyed in restaurants (logging pictures, location, friends with you, etc). 

It bought a screen-capture and markup tool called Skitch and after a couple of updates, killed it (moving some of its features into its already bloated core Evernote app).

It had and killed many other apps (A contact app, a meeting app, Flash cards, etc).

Over the years it's main app, the Evernote Client (Mac, Windows), became a bloated mess of slowness and crashing. They migrated from their own data center to the Google Cloud platform ( earloier this year) promising faster and better service. The blog post on February 8 2017 mentions :

All good sentiments but I haven't seen any benefits as a customer. Evernote is still an expensive bloated mess. 

Breaking their own rules

In 2011, Evernote published the 3 laws of data protection:

1. Your Data is Yours
2. Your Data is Protected
3. Your Data is Portable

The fist rule is clear, my data is mine and the only thing Evernote was going to do to it was normal operational tasks the ensure they can deliver the services I was expecting. The new Evernote wanted to add a machine learning function for its premium users and as part of that change tried to update its Terms of Service. This change was so viciously attacked by its users that in December 2016, they were forced to roll-it back and tried to reframe the conversation.

The worry was that the changed language gave Evernote employees the right to "read" your notes as they attempted to spot check and validate their new Machine Learning tools. The reversal meant the change would now be opt-in. This never should have happened the way it did. It showed clear gap in their change management and product management processes.

The second rules stated that :

This seems to conflict with their unilateral attempt to change the privacy language to enable their Machine Learning feature but.... The next part of this rule is:

Evernote had a couple of issues with data availability but the biggest was one that affected "some Mac users" and caused attachments to get deleted (article here). 

So far, Evernote has failed on the first 2 of their data protection laws. The third law was about data portability. The law said:

Ask anyone that has a large collection of notes with tags and dozens of folders, there is no graceful way to export your data in a usable format. Attachments are exported with their original file names (not the note name) and all structure is lost (tags and folder are lost).

I as one of the people that asked for Evernote to make a better export feature to ensure they met their own portability commitment. I wasn't sure how it should work, but knew it needed something better.

As you added more and more notes, this feature became more important and the lack of it became a glaring issue. As much as they say you can export in HTML, the exported data is useless. 

So they failed to meet their own 3 rules of data protection. 

No Markdown Support

As a technical Evernote user, I was part of their forums, UserVoice feature request system and always answered their user surveys. A feature I have wanted for years was Markdown formatting support (which would improve note compatibility). Their standard response was always that this was not part of their road-map. I wasn't the only one clamoring for Markdown support. Their forums listed thousands of users asking for it. 

Unfortunately Evernote was clearly not interested. 

Less consumer more business 

In an interview with The Verge,  Chris mentions the wants a more balanced customer base (less consumer and more corporate. This clearly shows in the steps they have taken and ancillary services they have killed.

Consumer services have been killed (Food, Flash Cards, etc) while corporate ones have been maintained (Evernote Work Chat a slack competitor and Presentation mode a Powerpoint competitor).

Changing competitive landscape

As Evernote continues to squeeze its free tier customers and makes paid tiers more expensive, it's primary competitor, Microsoft OneNote, has gone free for everyone on every platform. Additionally Google has its Keep/Google Docs combo and Apple its's Pages/Apple Notes combo. All of its chief competitors are offering more and more functions for free.

Others like Dropbox have launched services like Dropbox paper offering their existing subscribers cool new Evernote competing features. 

When I started using Evernote, it was the defacto standard integration partner for every app or service that I used. Almost every app I had on my Windows, Mac, Android, iPhone or iPad integrated with Evernote. As Evernote alienates its customers and more competitors enter the market, this is becoming less and less true. There was a huge benefit to knowing everything you had would work with Evernote, as this slowly disappears, that advantage also disappears. 

The Best Evernote Alternative

Having tested dozens of services, there isn't a really good alternative an Evernote power user will like but you have to accept this reality and move on. Evernote has clearly shown disdain for its consumer users and so the search for an alternative is ongoing.

The closest to Evernote has been Microsoft OneNote. OneNote is now free for everyone, getting more polished and feature rich with every update and they are clearly targeting Evernote users. It will definitely take some getting use to but it is a close enough alternative that most users will be extremely satisfied.

Microsoft OneNote works on most platforms, even on an Apple watch. 

In my quest to free my notes, I will be testing Clevernote.io more on that in coming weeks. 

I have gone through the period of grief and have accepted the fact that there is no "perfect" migration tool or strategy. I will lose some functionality and context around my Evernote notes but that's the cost of admission.

We are also seeing new companies pop up and try to fill the new Evernote void. One such startup service is called Bear. 

Bear is a beautiful simple note taking app that reminds me of Evernote's beginnings. It only works on iPhone, iPad and Mac today but who knows what the future will hold. A Bear Pro subscription is $15. 

Conclusion

I don't think the ship has yet sailed for Evernote and they can recapture their glory days if management does the right things but I am doubtful. Many have called Evernote the "broken Unicorn" and I agree. Most companies will stick with the good and trustworthy Microsoft and won't fork over hundreds of thousands a year to Evernote.

And unless Evernote changes course quickly, it will lose its core base of users (those who have been unofficial ambassadors over the years). 

So my recommendation is start the grieving process now and looking at alternatives. 

I've been a Google GMAIL user from the start and get excited when Google releases new features. The sultan of search has increased the inbound attachment limit to 50MB (from 25MB). Outbound attachment size is still capped at 25MB.

This change is rolling out to users and should hit everyone in the next week.

Google announcement here.

Canadians don't have a lot of wireless connectivity choices and this sad reality is reflected in the high prices we pay. I have previously written about Sugar Mobile and their not for everyone mediocre but cheap offering.

Today they have been dealt a blow by the CRTC (read the CRTC ruling here). The CRTC ordered Sugar Mobile to stop using the Rogers network (improperly) within 50 days. 

Obviously Sugar Mobile is disappointed by the ruling and has published this statement on their website.

The Canadian market needs competition to drive innovation and hopefully make the market more competitive. It looks like one option has been taken off the table.

Related Articles:

• Free unlimited video calling when you travel
• KnowRomaing cuts mobile costs when travelling

At Mobile World Congress

KnowRoaming (a Toronto based telecom company) has announced a partnership with global handset producer TCL Communications. 

Three upcoming Alcatel handsets will have the KnowRoaming SoftSim embedded in the phones. This means users will gain access to the global KnowRoaming network (50+ countries) and benefit from reduced roaming rates.

Armenia is a country located in the southern Caucasus region. Christianity is said to have first arrived in Armenia in the year 301 AD, making it one of the oldest Christian nations in the world. The Armenian king Tiridates III was converted to Christianity by St Gregory the Illuminator after being tortured and imprisoned by the king himself. St Gregory is also credited with curing the king of a debilitating illness. Christianity then quickly spread throughout Armenia and became the country's national religion.

Who is Gregory the Illuminator?

Gregory the Illuminator was the man who first introduced Christianity to Armenia. He was also responsible for converting the Armenian king Tiridates III to the Christian faith.

Why did King Tiridates III torture and imprison Gregory the Illuminator?

King Tiridates III tortured and imprisoned Gregory the Illuminator because he was trying to prevent Christianity from spreading throughout Armenia.

How did Gregory the Illuminator convert the Armenian king Tiridates III to Christianity?

Gregory the Illuminator is said to have converted the Armenian king Tiridates III to Christianity after healing him of a debilitating

Branches of Christianity in Armenia

There are two main branches of Christianity in Armenia: the Armenian Apostolic Church and the Catholic Church. The Armenian Apostolic Church is an autocephalous Eastern Christian church that recognizes the authority of the Catholic Church but is not in communion with it. On the other hand, the Catholic Church is in full communion with the Pope and the rest of the Catholic Church.

Christianity has played a significant role in the history and identity of the Armenian people. Armenia was the first country to officially adopt Christianity as its state religion, and the Armenian Apostolic Church has played a central role in the country's history and culture. Christianity has also been a source of strength and comfort for Armenians during times of hardship, such as the Armenian Genocide.

Beliefs of the Armenian Apostolic Church:

• The Bible is the authoritative source of religious teachings.

• There is one God who exists in three persons: the Father, the Son, and the Holy Spirit.

• Jesus Christ is both fully human and fully divine. He was born of a virgin, lived a sinless life, and died on the cross to save humanity from its sins.

• Jesus rose from the dead and ascended into heaven. He will return to judge the living and the dead.

• Humanity is fallen and in need of salvation. Salvation comes through faith in Jesus Christ.

• The church is the body of Christ on earth, consisting of all those who have been saved by grace through faith in Jesus Christ.

• The church is led by bishops, who are successors of the apostles.

• The sacraments are outward signs of inward grace, instituted by Christ, that give us communion with God. There are seven sacraments: baptism, confirmation, Eucharist, penance, anointing of the sick, marriage, and ordination.

• We will experience both physical and spiritual resurrection. At the end of time, Jesus will return in glory to judge the living and the dead, and those who have been saved will spend eternity in heaven with God.

• The Armenian Apostolic Church is in communion with the Catholic Church and the Eastern Orthodox Churches. However, it is not in communion with the Protestant churches.

What are the differences in beliefs between the Catholic and Armenian Apostolic Church?

The main differences in beliefs between the Catholic Church and the Armenian Apostolic Church are as follows:

• The Armenian Apostolic Church does not recognize the authority of the Pope.

• The Armenian Apostolic Church teaches that Jesus Christ is both fully human and fully divine, while the Catholic Church teaches that Jesus Christ is true God and true man.

• The Armenian Apostolic Church does not believe in purgatory, while the Catholic Church does.

• The Armenian Apostolic Church allows for the marriage of priests, while the Catholic Church does not.

• The Armenian Apostolic Church believes that the sacraments are outward signs of inward grace, while the Catholic Church believes that the sacraments are instituted by Christ and confer grace upon those who receive them.

Why is the Armenian Apostolic Church not in communion with the protestant churches?

The Armenian Apostolic Church is not in communion with the protestant churches because of differences in beliefs, such as the following:

• The Armenian Apostolic Church teaches that the Bible is the authoritative source of religious teachings, while many protestant churches teach that the Bible is not the only authority.

• The Armenian Apostolic Church teaches that there is one God who exists in three persons, while many protestant churches teach that there is only one person in the Trinity.

• The Armenian Apostolic Church teaches that humanity is fallen and in need of salvation, while many protestant churches teach that humanity is not fallen and does not need salvation.

• The Armenian Apostolic Church believes in seven sacraments, while many protestant churches do not believe in any sacraments.

• The Armenian Apostolic Church teaches that we will experience both physical and spiritual resurrection, while many protestant churches teach that we will only experience spiritual resurrection.

• The Armenian Apostolic Church teaches that Jesus will return in glory to judge the living and the dead, while many protestant churches teach that Jesus has already returned or will not return.

OpenSignal uses its millions of mobile users to map and test global wireless connectivity and they just released their latest global review summary. The 2 main takeaways are that wireless connectivity speeds are improving globally and users are still leveraging WIFI when available. 

Canada is the only western country to reach 20Mbps wireless speeds, making us the 12th best in the world. Our wireless may be expensive but at least it ranks well for performance. As expected, South Korea has kept its crown as the king of wireless speeds. 

For those wondering, our closest neighbor and friend, the United States of America ranks at the 20th position with a speed of 12.48Mbps. 

Talk to me about WIFI

Canada ranks 4th as it related to time on WIFI. Canadians spend on average ~60% of their time connected to WIFI. Again we rank better than the US at 10% more WIFI time than them. 

Link

I've written about Roam Mobility before:

• Real World testing and Review of the Roam Mobility Service
• Roam Mobility now has US 4G LTE Service
• Roam Mobility Breeze unlocked GSM phone review
• Roam Mobility released new plans
• Comparing T-Mobile's Tourist plan with Roam Mobility
• Roam Mobility offers competitive US roaming for Canadians

Today Roam Mobility is launching new monthly plans that include unlimited talk, text and data. It is a middle of the ground offering between their day plans and their 3-month snowbird ones.

Although these plans were originally designed for Canadian travelers heading to the USA, it is really applicable to anyone going to the US (Europe, Asia, Middle East, etc).

At launch, there are 2 monthly plans (30 day) which both include unlimited talk and text but differ in their data offering:

• 1GB of 4G LTE for $39.95
• 4GB of 4G LTE for $64.95

Once you consume all of your data, you get unlimited 2G data. In my testing, the TMobile LTE network is excellent but their 2G network is so so.

All you need is a non-expired Roam Mobility SIM card and then you can choose these plans on their website.

Why a Canadian should choose Roam Mobility

Telus, Rogers and Bell have all started to offer special Roaming plans ($5-7 per day) where you consume your home monthly plan when in the US. The attractiveness of this plan is the ease of use. You keep your same SIM and number. 

Most Canadians have limited data plans and the risk you run is the overage charges once you've eaten your monthly allocation. With Roam Mobility, you have to switch SIM cards but you are given ample 4G LTE and even if you do bust your cap, you get unlimited 2G connectivity. At least there won't be any $50-100 surprises at the end of the month.

What is my review of Roam Mobility

I have tested almost every conceivable USA travel solution from Roam Mobility, KnowRoaming all the way to buying local SIM cards upon landing. I have found the Roam Mobility solution to be the most robust one I have used.

KnowRoaming provides "unlimited" data for $US8 a day but it is slower 3G. Additionally during my last trip to San Francisco, I couldn't get inbound calling to work and finally gave up after 45 minutes on the phone with their support person. I didn't have my Roam SIM so I was stuck paying the Telus $7 a day fee.

So for USA only travel, I would buy a couple of Roam Mobility cards and use them.

Link to monthly plans page

1 - Random.org

Random.org has been one of my favorite sites for a long time. It uses atmospheric noise to generate its randomness which is much better than the logical pseudo-random generators used by many sites and service.

You choose the password parameters you need and it generates wonderfully random passwords to use with your password manager of choice.

Link

2 - Symantec Identity Safe

Symantec has been a mainstay of the security market since the 90s and they bought a company called PCTools (and its Secure Password Generator). As a PC Tool vendor, they will try to make you download their privacy tools but I wouldn't recommend their password vault.

Use the password generator on the right side of their site to generate high quality complicated passwords with the required complications. As an example, the above complications generated this password for me : dr-cr+wreF5p.

Link

3 - Wolfram Alpha

Wolfram Alpha is a powerful knowledge engine created by the brainiacs behind mathematica, It is a superb tool I use regularly for problem solving but it also generate random passwords. Head over to their knowledge engine and enter Generate Strong Password. Then press the equal sign. 

Then choose the complications you want and press the equal sign again to generate you password.

then it generates your wonderful password

you press on Plaintext and copy it into your favorite website or password manager.

Link

4 - Lastpass password generator

My 2 favourite password managers are Lastpass and 1Password. Both have the capbility to generate strong passwords and you should use that functionality if you have those those. Considering most of Lastpass is now free to use, you really have no excuse.

But Lastpass also offers a web based secure password generator which is clean, easy to use and efficient. 

When you scoll up on that page after choosing your complications, you get a wonderfully generated password of your can click the button and have another one created for you.

5 - GRC Ultra High Security Password Generator

GRC is the home of Gibson Research Corporation. It is owned by Steve Gibson the Grand Poobah of internet security. He found the first spyware and wrote the first anti-spyware app. He is considered one of the most prominent security professionals and makes tones of tools available on his site. 

His site generates perfectly random long complex 64/63 character passwords and he then explains why his passwords are high quality. If you are interested in geeking out, its a wonderful read. 

Link

In an uncertain world where kidnapping for ransom is an all too common occurrence, many hostage negotiators use the no-concession policy. They justify this position by explaining that paying a ransom makes it more likely that the perpetrators will try it again and often times the ransom is used to fund illegal or terrorist organizations.

Although I have seen very little empirical evidence to prove that this no-concesion approach is more desirable than paying the ransom, this mentality was brought into the digital age when cyber-ransoms, cyber-extortions and crypto-malware became prevalent. 

More and more companies though have started to take a different approach and are now prepared to pay ransom in exchange for saving their networks, devices and information. To meet these demands quickly, some companies have started to store bitcoin as a risk mitigation strategy.

Why this change of heart? Many of the most popular well written malware was actually designed to ensure victims could recover their data when the ransom was paid. This attention to detail and solid customer service by the bad guys, means victims are now relatively certain that they will be saved if they pay the ransom. 

Sure paying the ransom means funding organized crime and will likely fuel the next wave of crypto-malware but companies have a duty to protect their organization (rather than take the moral high ground).

This change in mindset is so pronounced that traditional physical K&R (kidnap & ransom) negotiation experts have started to test the cyber-extortion and cyber-ransomware negotiation space. 

True verifiable numbers are hard to find but firms like Recorded Future ( a cyber intelligence company) has stated that it believes the cyber-ransom market has now reached the 1B$ mark. Kaspersky says a company is cyber-attacked every 40 seconds.

Obviously crypto-malware can be counter-acted by proper, regular offline backups but many companies don't start a robust recovery program until it's too late. They either pay the ransom or lose their data. Its that plain and simple.

Right now the advantage is with the attacker. Corporate information security groups have to bat 100% to keep the company safe. This is expensive, time consuming and not always achievable. The attacker just need to infect 1 machine on the network and then can propagate and move laterally from there. 

Companies have started to jump on the Ransomware protection bandwagon. An EDR &"next-generation AV" company called Cybereason offers a free product called RansomFree. They claim it protects against 99% of ransomware by monitoring how applications interact with files on your computer. Did I mention RansomFree is free? I haven't used their product and thus can't recommend it but it does seem to be useful and could really help the average consumer ensure they don't end up getting victimized.

It is clear that this malware is written by extremely skilled and determined threat actors. This isn't code written in somebody's basement but rather a professional extortion company with developers, quality assurance and even customer support to ensure a paying customer is taken care of. 

So the question is will your company prepare by buying and storing bitcoin? If you will, how much should you store? that is the new question.

1 - Buy day-passes online

Most airlines will allow passengers to buy a lounge access day-pass online.

As an example, you can buy a day-pass from Air Canada for access to their own lounge for $25 if you are travelling on a Latitude fare. 

United Airlines offers airport lounge access day-pass for $50 here.

2 - Buy day-passes at the airport

Check directly with your airline. If if your airline doesn't own its own named lounge at the airport, they often have deals with private lounges offering them at competitive prices. As an example, Canadian airline Westjet has partnered with private lounge operators in the various regions it travels (Canada, Europe, Caribbean) to. Westjet offers airport lounge access at very competitive prices.

Some vacation package wholesalers also offer (add-on) lounge access to their customers. As an example, Signature vacations (in Toronto, Vancouver, Edmonton & Winnipeg) sells lounge access to all vacation pass holders. 

3 - Buy access to an independent airport lounge

Some airlines do not offer any type of (direct or indirect) lounge access. Other times companies buy the cheapest ticket they can find which means you may fly 10 different airlines and therefore not gain priority privilege access on any one particular airline. These are the times you may need to buy access to one of the independent lounges. 

If you travel to different airports, you may want to join one of the independent airport lounge access networks like:

• Priority Pass
• Lounge Pass
• Lounge Club

As an example, Priority Pass offers access to 1000 airport lounges worldwide. Priority Pass (sold in Canada) offers 3 levels of membership:

1. Standard($99 a year). Every access will cost $27 for the member or guests.
2. Standard Plus ($249 a year). Member receives 10 annual visits. Additional visits or guests cost $27 each.
3. Prestige ($399 a year). Member receives unlimited lounge access and guests can buy access for $27. 

Some credit cards have standing agreements with these lounge access  wholesalers and allow you to buy access without having to pay an annual membership fee. As an example, Diners Club Canada offers members access to worldwide lounges at affordable prices.

Here is an example of their Canadian airport lounges you can buy access to. Access to a lounge in Toronto is about $US30.

4 - Get a credit card with lounge access

If you travel a lot, it may make sense to use a travel credit card that includes access to airport lounge (either free or a pay per use without requiring an annual membership to a lounge network).

Credit Walk (Canada) has published an interesting article comparing various credit card lounge access programs.

Sleeping in Airports (USA) also has an article about credit cards offering lounge access.

5 - Buy a refundable business class ticket

Some travel forums (e.g. maphappy, boarding area, view from the wing ) recommend that you buy a full price refundable business class ticket for travel the same day as your regular discounted ticket, use the lounge and then refund the ticket. 

I have never used this technique and you should make sure the ticket is still refundable if you use the lounge. I know airlines like United have started implementing lounge access software that will help curb this type of abuse but I know this still works on some airlines. 

6 - Buy lounge access from other passengers

You can sometimes buy lounge access from other travelers on classified type sites at discounted rates (eBay, Craigslist, etc). Make sure you check any restrictions that may apply.

7 - Use a Smartphone App for lounge access

There are travel smartphone apps like Loungebuddy (IOS & Android) . 

Loungebuddy offers on the spot lounge access purchased on your smartphone without requiring an annual subscription.

UPDATED: Microsoft has extended the promo until June 30 2017.

Outlook.com Premium is now out of beta and is being offered at the super affordable price of $US19.95 until March 2017. If you need a custom domain, you can buy one directly from Microsoft for $US10 per year. After the promo, the price will rise to $US49.99

So what do you get?

• Custom domain for five users - You can create personalized email addresses (Outlook premium) for up to 5 people.
• Information sharing - Outlook Premium automatically configures information sharing between all of your user accounts (up to 5) for calendar, contacts and documents. Unlike other services, Microsoft Outlook Premium automatically configures the sharing so it is super simple. We don't know the shared space allocation yet (via OneDrive) but regardless, its a good deal.
• Ad-free inbox - You get a clean ad-free outlook.com experience. This means no graphical ads in outlook.com or onedrive.com.

This offer will expire March 31 2017 so jump on it now. Did I mention you will be renewed at lower rate in the future also? Get the offer here.

The same services on Google's GMAIL would cost $5 per user per month ($60 per year). If you activate all 5 users, it would cost you $300 on GMAIL ($19.99 on Outlook Premium).

Why continuous improvement is important

Companies have competitors, but so do employees. There are others that can do your job, the questions is who can do it better. Continuous development through education (formal and informal) is the only way to keep and and hopefully move ahead. Moving ahead means you gain unique differentiating qualities that hopefully will lead to promotions, better compensation and maybe lead to the job you've been dreaming of.

By improving who you are, you gain the ability to deliver better services to clients, your company, colleagues and friends. A true professional is always striving to become better so that they may serve their entourage better. It increases the value you deliver to others and it increases your value.

Continuous improvement is important both in your professional space and your personal one. You need to become better at what you do (your chosen profession) and who you are (your ability to handle different situations and make the best possible decisions). Sure in good times, better knowledge could lead to promotions but in bad times, it could be the difference that helps you keep you job. 

So continuous personal development improves knowledge, skills and ability. At the same time it strengthens confidence and many times this new calm, cool confident you results in you being more relaxed (even in though situations) which means it improves your well-being.

The bank can take your house or car but they cannot take away your knowledge. What you learn is yours to keep and will benefit you your entire life. An investment in yourself is the best investment you can make.

The 3 minute secret

The biggest complaint I hear from people is that they want to learn and improve but they just don't have the time. 

Time is one commodity we can't buy or make more of. So in the spirit of helping you improve without consuming large amounts of your personal time, I present to you the GetNugget.co app. It is a small and simple iPhone & Android app that distills the wisdom of thousands of well reviewed books into small easy to consume information snippets.

They have thousands of books grouped in these categories:

• Biographies
• Business
• Business Strategy
• Creativity
• Health & Happiness
• Leadership
• Management
• Marketing
• Money
• Our Journey
• Personal Development
• Sales
• Science
• Startups & Entrepreneurship

When you open the app the first time, you are asked to chose categories that interest you.

Then you are presented with books of interest.

When you chose a book, you get the nuggest for that book.

When you click on a nugget, you get the full screen view.

And all of this for free. So go download it now and become smarter.

Everyone knows that music has a magical ability to enhance your emotions. It can push you to your exercise faster, smile more or fall into deep meditative contemplation. A British band called Marconi Union has used scientific research to produce what it calls "the most relaxing song" ever created. The bank worked with professionals (like sound therapists) during the process. 

The song was specifically engineered to lower blood pressure, reduce stress levels, and even lower your heart rate. The combination of sounds and music creates such a state of relaxation that users have been warned not to listen to it while driving.

Mindlab Insight performed research and determined this was the most relaxing song they have ever tested. Weightless "induces a 65% reduction in anxiety and a 35% reduction in physiological  resting rates.

Like it or hate it, one thing we can all agree on is that Apple's in-package lightning cables are horrible. They are weak and usually become frayed and unusable within months. 

First stay away from the cheap Chinese knockoff cables. Every MFI (Made For Iphone) certified cable comes with a special (in cable) authentication chip. Chipworks has a good write up about this secret chip. This is why many of the cheaper lightning accessories and cables you buy on Amazon, eBay and AliExpress, turn out to be useless junk.

Over the years, I have found that certain higher quality cables (micro USB style) are able to transfer data more reliably or support faster charging. Not so with lightning. It turns out that all MFI certified cables I have tested have been about the same as it relates to data transfer speed and charging speed.

So the real deciding factor is the durability of the cable. So over the last several months, I have been real world testing dozens of lightning cables from name brand companies. I wanted to see how they would hold up to the rigours of rough use:

• threw them in my work bag
• used them to charge via battery while in the pocket of my winter jacket
• user them to charge while in the car
• swung them with the phone attached
• crunched them and tightly packed them in jeans pockets
• etc

You get the idea.

The one cable that came out on top was the Anker PowerLine lightning cable. It is competitively prices, MFI certified, it can charge all IOS devices at full speed (except the ipad pro) and it super durable. 

The tips are encased in a solid plastic housing and a nice rubbering joint between the cable and the connectors. 

Anker claims the cable is reinforces with kevlar fibers which is impossible to prove but the cables do feel solid and very sturdy (compared particularly to the Apple, Monoprice and Amazon basics ones). Now before anyone emails me, there are other more durable cables but these typically cost so much, they are not even being considered by the average consumer. Remember that this is a review for a consumer and not one for a product used in an industrial setting where $50-75 is considered acceptable.

The Anker Powerline lightning cables fit comfortable through the opening of various cases including the original Apple ones, LifeProof, Rhinoshield and any other one I threw at it. This is an important consideration and a major win for Anker.

As a sanity check, I read reviews on major online retail sites and comments were overwhelmingly positive. 

You can find these lightning cables almost everywhere so grab a couple. You'll be glad you did.

Cellebrite is an Israeli company that specializes in tools (hardware and software) to break cell phone security. The Universal Forensic Extraction Device (UFED) is their most popular product and it can extract info from a wide variety of cell phones in minutes. Needless to say, law enforcement loves Cellebrite and has made them a very wealthy company. 

Cellebrite confirmed being breached and 900 GB of data was taken (which we believed contained end user licensing information). Cellebrite was quick to point out that passwords or payment information was not taken.

The hackers have published the dump which includes source code and customer information but also more importantly exploitable vulnerabilities for IOS, Android and Blackberry.

Cellebrite's UFED uses many of these vulnerabilities to extract the information its customers want from locked or otherwise protected devices.

Motherboard spoke to world renown IOS security expert, Jonathan Zdarski, who said the IOS vulnerabilities are already commonly known and therefore nothing earth shattering. The Blackberry vulnerabilities haven't been released yet and those will be interesting.

Obviously Celebrite is continuously updating its products with the latest vulnerability discovery so it is safe to assume this won't damage their thriving business with law enforcement. 

You can see a small sliver of the 900GB on site pastebin site (which will quickly disappear of course.)

The links to download the first parts of the dump are here:

1. https://mega.nz/#!sZUkSbDT!l740KTf5TG-TgjN-YNZcejSOfhUn43jZ8jR3Lw_w7dY

2. https://mega.nz/#!0d9zBQLI!DdKhZDXoMEnO6RpZDHWMGVV7nBXXZ98cPzjzVqLsVuw

These files may be taken down anytime so... Your Mileage May Vary.

The hackers are promising to released another small sump with files retrieved "via the weaponized Cellebrite update service deployed on MS Windows based devices and desktops"

The hackers are hacking the hackers. Let's see how this story unfolds.