Hijinks Inc.

Blog

  • Using Google Voice with your Existing Telephone Handsets

    I’m sure there are a large number of ways to take whatever old analog handsets you having sitting around and use them with Google Voice, but most of them require things like setting up your own PBX server. Which could make for a fun weekend project if you’re a major geek, but chances are most people would rather use something a little more straight forward. Enter devices like the Ooma Telo ($199-249), which I’ve recently started using for my office phone.

    It’s an absolutely fantastic device and very easy to use. The really nice thing about the Ooma Telo is that it comes with a whole new phone number, so setting it up is as simple as adding that number to your Google Voice account. Ooma also offers some additional nifty features like Instant Second Line, Multi-ring, and Call Blocking for a monthly subscription of $9.99. A 60-day free trial of Ooma Premier is included with the Telo.

    Alternatively, if you’re looking for something a little cheaper, you might consider the Obihai Obi110 ($49.99) or the Obi100 ($43.99), both are great solutions for integrating your existing phone handsets into Google Voice. These devices use the actual SIP calling function that was added to Google Talk/Gmail last year.

  • Google Owns My Soul

    For years I’ve been giving Google unfettered access to my email and my search history without giving it much thought. And over the course of the past couple years, I’ve continually kept giving them more and more access… That brings us to today, when I finally came to the realization that Google really does own my soul. That is assuming my soul is comprised of personal information, browsing habits, etc.

    Let me break it down for you:

    • Each morning at 5am my company website sends an updated list of products that we have in stock to Google Base to get listed in Google Shopping.  Google now knows what products my company likes to carry as well as how quickly we sell said products.
    • My company uses Google Analytics, not only to track our corporate website, but our clients websites as well. Google now has access to very detailed information about how popular my websites are and  just who’s visiting them.
    • The afore mentioned company also uses Google Places to attempt to draw in new business. This one isn’t that big of a deal, since it doesn’t really increase Google’s access to information about my company. I’m just trying to be thorough.
    • Each of my sites generates a Google SiteMap.  Making it even easier for Google to catalog every little page on my websites, even some that I may have forgotten about.
    • All my websites that run advertisements run Google AdSense. Now I rely on Google to get paid.
    • I use Gmail for my personal email. Google gets to scan through my entire life and contextually provide ads to me. Yay?
    • I also use Google Apps for my business. Which includes the occasional Google Doc upload of a spreadsheet or presentation. Potentially giving Google access to sensitive company information. As well as Google Calendar, which lets them know where I’ll be and when I’ll be there.
    • Several of my ventures use Google Voice numbers for texting and calling. Google has access to an archive of my text messages and voicemails.
    • When I subscribe to an RSS feed I do it through Google Reader, so that my RSS feed reader on my laptop, desktop, phone, and iPad all get the same feed. Guess what? Google gets some solid feedback on what kind of blogs/articles I read.
    • If I record and upload a video it usually goes to YouTube, I also watch movie trailers and the like on YouTube. All the sudden Google knows whether or not I watched Rebecca Black’s “Friday” music video, and if so, if I watched the whole thing.
    • I often use Google Maps to get directions. Now Google knows where I’m planning on visiting, which new restaurant I’m likely eating at, and where my Uncle Phil’s house is.
    • Did I mention that I have an Android phone? Making it even easier for me to continue to use Google products in my day to day life. If I use the Barcode Scanner app to check the price of something, Google instantly knows what I’m out shopping for.
    • And last, but not least, I use Google for 99% of my internet searches. If Google didn’t already know what things I’m interested in, they do now.
    • Oh, and I use Google Chrome to do all my web browsing.

    Don’t worry, there’s still more I can do to give away my life to Google. For example, I could start using Google Latitude, or start accepting Google Checkout on my company’s store, maybe use Picasa to start sharing family photos. Or actually update that Google Buzz account of mine… nah, that’ll never happen.

    [Note: I’m sure I’m using even more Google services and not realizing it, so I may update this list at a later date]

  • Firefox Live: Can’t Look Away!

    Firefox Live
    Get your cuteness fix again

    Firefox has introduced something new in order to get more and more people to download and test Firefox 4 Beta, while at the same time bring in some support Knoxville Zoo. It is called firefoxlive.org and the main idea for this site is to show live videos of cute, little, fuzzy, adorable, beautiful, lovable, delightful, innocent, I-WANNA-SQUEEZE-THEM-SO-TIGHT fox cubs! Check it out for yourselves. If you don’t smile or feel those warm fuzzies inside then check for a pulse you heartless fiend.

  • Firesheep Vs Blacksheep the new security threat

    Over the past several months or so, the Internet has been abuzz about sheep, yes sheep.  Let me explain.  On October 22 2010 at ToorCon 12 http://sandiego.toorcon.org/ a Firefox plugin was released called Firesheep. Firesheep is a tool that makes it very easy for HTTP session hijacking (also called sidjacking) to occur. The tool allows the attacker to capture the session cookie and then log in using that cookie to have full control of the account to do things such as change your Facebook photos, update your Twitter status, etc.

    The primary attack vector is on open WiFi hotspots, like those in coffee shops, airports, and other public places. This is not an exploit in Firefox or your operating system, but rather the problem of open WiFi and the website your connecting to. Firesheep does nothing new and can not be patched.  This can be done with any packet sniffing tool for your platform. What it does do is make it very easy for just about anyone to launch a Firesheep attack on an open WiFi hotspot.

    Solutions
    The ultimate solution to end all Firesheep attacks is the use of SSL on more than just login pages.  On most websites this is something that the the website must first make the internal changes and then the end user must implement with a setting change.  This is not ideal (as it should be on by default but its better than nothing). Facebook says they are evaluating implementing this.  The first major website that has made changes (Source) to protect its users from Firesheep is Microsoft with Hotmail and many of the other Live services. However this setting is not on by default; users must enable it in their settings.  I hope that with time all websites with private, or user data will make this change a default, like Google has done with Gmail.

    Many web companies cite the increased cost in implementing full time SSL connections for their users.  While it is true that an SSL connection does increase the server load the difference is very small.  Google was really the first major Internet service to move a very large service to be encrypted with SSL by default for the entire session with Gmail. A Google engineer has talked about the cost of switching over to full SSL for all Gmail users in this blog post here http://techie-buzz.com/tech-news/google-switch-ssl-cost.html

    “all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that.”

    They concluded that there was not a significant increase in cost or server utilization by implementing this. That being said Google has a ton of servers and a lot of resources to work with so this may not be true for every website.  However the myths of the past that this would be an incredibly expensive process and not worth it are simply not true anymore.  Implementing SSL for the entire session (versus just at log-on now) is the only true solution to this problem.  Many websites say they are working on this now and plan to implement it.  This is a good thing.

    Here are some solutions that you can do to prevent being a victim of a Firesheep attack.

    Be aware of the network you are on.
    Know that if you’re on a open hotspot that you’re vulnerable to attack.  It’s probably not the  best idea to be logging into sensitive websites, checking email, Facebook, paying bills, etc.  If you do need to do these things consider some of the options below.

    Use a minimum of WPA encryption.
    While everyone in their homes should be running a minimum of WPA (preferibly WPA2) many businesses and other public places offer free WiFi that is unencrypted.  Users need to put pressure on business owners and administrators to implement the WPA protocol to protect users.  WPA offers an individualy encrypted session between the user and the router by default.  This does not protect you 100% but protects you from local Firesheep attacks which are the main threat. Many businesses have in the past not wanted to do this because of not wanting to be asked thousands of times per day what the password is or dealing with any complications; however it must be done today because of this and other security risks.  Listening to Security Now podcast #273 they came up with a great solution: put the password in the SSID.  For example the SSID might be (Joe’s Coffee Free WiFi-Password = Joe) or something similar.  This would allow a user who is browsing for the free WiFi to see the password and be secure.  It was suggested that the best way to do this would be to demonstrate the attack to a shop owner; heck, maybe you would get a free drink out of it too.

    Use SSL
    Some websites that have the option to force SSL (Secured Socket Layer) through the entire session but do not have it turned on by default (Microsoft Hotmail for example) so enable it.  This can be enabled on the security tab of the settings page. Regardless of if you’re on an open or encrypted hotspot, SSL protects you and is the ultimate solution.

    Sign Out
    Signing out is something everyone should be doing anyways.  Since this tool exploits a session cookie, if you end your session, the cookie that the attacker may have caught becomes worthless.  It is also just the proper way to close a session and is a must on any public computer.

    HTTPS Everywhere
    HTTPS Everywhere is a plugin for Firefox that is produced by the Electronic Frontier Foundation (EFF) that forces encryption with many major websites.  The EFF is a foundation thats goal is to defend your digital rights. This includes Net Neutrality, privacy and security. Many websites support full HTTPS traffic but make it difficult to use.  HTTPS Everywhere makes this process nearly seamless for the websites it supports.  This is a project that is still in development but is stable and works well.  I have been using it for a few weeks now and noticed no ill effects.  It works on the following websites: Google Search, Wikipedia, Twitter, Facebook, bit.ly, GMX, WordPress.com Blogs, New York Times, Washington Post, Paypal, EFF, Tor, LXQuick, and others. You must install this plugin directly from the EFF’s website https://www.eff.org/https-everywhere as it is still in beta.  Once the plugin goes to a 1. release I expect to see it on Mozila’s plugin page as well.  I hope they will be coming out with a Chrome version soon as well.

    Blacksheep
    Is a Firefox addon that monitors for Firesheep activity on the network .  It does this by broadcasting fake credentials to sites that are know to be targeted by Firesheep and then when someone does try logging into these fake sites it alerts you with a drop down box in the browser.  It is little more than a notification and offers no real protection to your personal information.  You can download it here if you are interested http://www.zscaler.com/blacksheep.html

    VPN
    VPN’s offer secure tunnels back to a connection that you trust such as your home or office.  All traffic will flow through this connection so you avoid someone who might be spying on the open hotspot at the airport your on. They require some setup but are what enterprises use to securely connect users back to the office.  They work just as well for the average user as well.  There are many free and paid ways to do this so here are a free ways to do it.  OpenVPN Other options compiled by Lifehacker http://lifehacker.com/5487500/five-best-vpn-tools

    In conclusion this is a big deal. Everyone should be aware of it as you travel this holiday season.  Often times travelers hunt out free WiFi connection anywhere they can.  Open WiFi is dangerous, it always has been but with Firesheep it becomes much easier for someone to exploit for nefarious reasons. To protect yourself, consider setting up a VPN connection to your home, if you must use open WiFi connections to check sensitive email or social media websites.

    Other Sources not specifically listed in the article but used
    http://www.grc.com/sn/sn-273.txt
    http://techie-buzz.com/tech-news/google-switch-ssl-cost.html
    http://codebutler.com/firesheep
    http://www.slate.com/id/2275850/pagenum/all/

  • Chrome For a Cause

    The Google team has come out with an extension for Google Chrome to make  a difference in the world. That extension is “Chrome For A Cause”. It was released this morning (12/15/10).

    Here is a quick explanation provided by Google: “Google will make a donation to worldwide non-profits on behalf of the Chrome community, based on the number of tabs you open in Google Chrome between December 15-19. You’ll be supporting charitable causes, just by browsing the web.”

    This is a great way to help the world with doing nothing more than you normally would. So go download it now!