Insights For Success

Strategy, Innovation, Leadership and Security

9 things you should pack on every trip

GeneralEdward Kiledjian

As a frequent traveller, I have picked up some tricks that make travelling a lot easier. I wanted to share some of those with you and hopefully make your life a little easier.

Global WIFI Hotspot

I wrote my first review of the (gen 1) Skyroam Global hotspot in 2015 and it became one of my most used travel items. When they released (gen 2) a new LTE capable model, the Skyroam Solis, I bought one and reviewed it as well.

TL;DR: I have tested dozens of global roaming services (hotspots and global SIMs) and the product I carry in my bag every day is the Skyroam Solis.

Some readers have asked if my Skyroam tests were promotional and the answer is no. I have not received any compensation from Skyroam to test and review any of their products. When I find something that works well and is priced competitively, I recommend it.

I recommend you read my full review, but the summary is that the Skyroam Solis is a pre-paid global 4G (LTE) capable hotspot that works in 100+ countries. They offer an "unlimited" data package sold in chunks of 24 hours (day passes) for about $9 a day (or a monthly pass for $99).

Most companies offering this type of service label their offering as "unlimited data" but this doesn't mean you can stream Netflix while cruising the french riviera. Every company I have reviewed imposes some type of "fair use policy". Skyroam's Solis day pass never cut-off your data access but does slow it down to a painful (and barely usable) 2G after you consumer about 500MB per 24-hour period. This period resets during each day pass.  This means that you shouldn't be streaming music or videos (Spotify, Google Music, Apple Music, Youtube, Netflix, HULU, Amazon Video, etc).

As an example, the GeefiGlobal WIFI hotspot fair use policy says "GeeFi will begin limiting the download speed after you exceed 500 MB (megabytes) of data in most countries".

Frequent travellers can buy a Skyroam Solis WIFI hotspot for $149.99 (includes one day pass worth $9). Infrequent travellers can rent a Skyroam Solis with the appropriate number of day passes for $9.95 a day (basically $1 per day to rent the unit plus shipping costs back and forth).

Collapsible water bottle

I wrote about the Nomander collapsible water bottle in 2016 and still recommend it for travel.

TL;DR: The Nomander water bottle is a light flexible easy to pack piece of kit you can store easily and use when needed. It avoids having to pay $5 for a 500ml bottle of water that would otherwise cost $0.50 anywhere in the "real world".

The Nomanderis made from food grade silicone so it doesn't retain smell.  It is leakproof. Where my older recommendation (the Vapur) becomes giggly when less than 3/4 full, the Nomander retains its shape fairly well for a foldable bottle. 

With the plastic sleeve in the middle, the bottle is sturdy enough to stand on its own.  The Nomander is (top rack) dishwasher safe, You can also freshen it up, like most other water bottles by soaking a mixture of filtered water and fresh cut lemons for 24-hours.

The water filter

Browse the aisles of any camping goods store and prepare to be amazed at the dozens of water filters available for your immediate purchase. I have been camping most of my life and have travelled to many locations known for terrible horribly diseased water.

I have tried over a hundred filters, tablets and sterilizers. The one I keep coming back to over and over is the Grayl. I first wrote about the Grayl water filter in 2016 and have been recommending it since. It beats every other filter I had tried before or that I have tested since.

TL;DR: The Grayl water filter is the easy to use, easy to carry, low maintenance and high-reliability water filter you want when in the backcountry or when travelling to locations with questionable water sanitation practices.

When using the orange travel filter, you purify and sanitize the water with one (strong) push. This means I no longer carry a UV sterilizer (Steripen) in addition to a filter (Lifestraw or Sawyer mini).

The Grayl Orange Travel filter removes:

Each cartridge lasts about 300 uses (with 3 full uses a day, a single filter would last 100 days). The filtering process requires a bit of brute strengh but you never have to worry about batteries and there is no need to backwash the filter. 

Portable laundry machine

Everyone starts travelling with lots of extra clothes and big check-in pieces of luggage. Eventually, you learn that one-bag travel is the only way to go. One-bag travel does mean you are travelling with the minimum and thus may need a way to clean your clothes while on the move. 5 years ago I bought a Scrubba wash bag and have brought it with me on almost every trip (longer than a week).

TL;DR: The Srubba is a waterproof bag with scrubbing "teeth" you can use to clean your clothes anywhere in about 10 minutes.

Scrubba has become a trusted travel item for business trips and family adventures (vacations with kids, camping, road trips, etc). I use this with either  Woolite Travel Laundry Soap individually packaged travel packets or Dr. Bronner organic Castille soap. Both of these detergents are gentle, work with all types of materials and wash out easily without leaving a soapie residue.

Airborne and NoJetlag

I started taking both of these products 6-7 years ago and believe they help keep me healthy when travelling (particularly the long North America to Asia flights).

I am not a doctor and the effect could be nothing more than placebo but since I started taking Airborne on longer flights, I find I get sick a lot less Worst case scenario, it is a vitamin C supplement but my experience has been very positive. I have managed to stay healthy even with colleagues have gotten sick.

When travelling to faraway destinations, I started using No-Jet-Lag. While consulting for Cathay Pacific Airlines (based in Hong Kong), a flight attendant recommended it and I have used it ever since (when travelling through more than 4-5 time zones).

The simple rule of thumb is to chew on one tablet, every time your plane takes off and every time it lands.  Then chew on one tablet every 2 hours while in flight. I normally follow the manufacturer instructions and take it an hour before or 2 hours after a meal.

I'm the first person to admit the questionable medical value of homeopathic products and my results may be nothing more than a placebo effect but it has worked for me and has been recommended to me by about a dozen different flight crew members.

Tom Bihn Synapse 25 backpack

Talking about backpacks is almost akin to talking about religion. It seems people are easily offended when you recommend something different than their preferred bag.  Unlike the average traveller, I have 1M+ miles under my belt and have recently tested about 25 different (well rated) backpacks before I recommended the Tom Bihn Synapse 25 backpack February 2018.

TL;DR: If you can only buy one backpack (EDC, work and travel), I recommend the USA designed and manufactured Tom Bihn Synapse 25 backpack.

I recommend you read my full review here. This bag is light, durable and has carefully designed features that will make travel much easier. Plus it is built like a tank and will not break on your mid-trip.

Best carry on luggage

I first recommended the RedOxx AirBoss in March 2012 and it has been my favourite carry-on luggage since. I have tried 50-60 different products since and always come back to this thing. It is designed to last and comes with a no questions lifetime warranty. Along with Tom Bihn, RedOxx offers the best warranty in the business. 

The RedOxx AirBoss is a 100% USA designed and manufactured bag. It is made from incredibly resilient materials. The bag you see above has travelled 1,000,000 + miles since 2012 and it looks almost brand new.

  • Since does not have wheels, I am rarely asked to check its size.
  • It has a flexible shell which means I can push and shove it into even the smallest overhead compartments.
  • It doesn't waste any room on wheels and a pull handle which maximizes available space
  • It can be used with or without packing cubes

If you could buy only 1 luggage that will have to last 10+years, this is the one.

Pacsafe anti-theft packs

There are times when you will be travelling to riskier destinations where theft is a real constant concern (Shanghai, Delhi, Mumbai, Barcelona, etc). Then travelling to these "special" locations, you may have to take specialized gear to stay safe and no one offers a wider selection of anti-theft backpacks, packs and bags than Pacsafe.

I own both a Pacsafe backpack and a shoulder pack. Both of my products are no longer offered but you can easily find something that would meet your needs. During "normal" trips, I would choose the lighter and more functional Tom Bihn Synapse 25 every time but when I need extra security, the Pacsafe products are a must.  The bags are lined with a metal mesh to prevent theft by slashing. Even the shoulder straps are reinforced with metal mesh to prevent a slash and go incident. Best of all, the Pacsafe bags look like normal everyday products.

I own an older version of the Metrosafe and found an everyday use for it you may find interesting. In addition to keeping my valuables safe while I travel, I use it when at the beach or public pool.  I lock it to a bench or medium tall tree and know my valuables (glasses, wallet, cell phone, etc) will be there when I get back. When at the beach, I can go swimming without worrying that someone will steal my wallet. All you have to do it pair it with a travel cable based lock. 

OnePlus policy that makes it a better buy than Samsung, HTC or LG

GeneralEdward Kiledjian

As a security technologist, the security philosophy of the OEM is a crucial determinant of my decision to buy or recommend a device. This is where Apple shines with it's iPhone update strategy. Every single iPhone receives updates (security and version) at the same time. 

This is why I highly recommend Google's Pixel devices. The Pixel line offers the same regular and speedy update schedule. The other Android manufacturer that has shown it cares about upgrades is OnePlus. Until this week, it did a great job delivering updates quickly, but it didn't formally commit to a software upgrade schedule. 

All of that changes this week when OnePlus unveiled its new operating system (Android) maintenance schedule. It has copied the Google Pixel model and will deliver major upgrades for two years and security updates for three years. 

“As per the maintenance schedule, there will be 2 years of regular software updates from the release date of the phone (release dates of T variants would be considered), including new features, Android versions, Android security patches and bug fixes and an additional year of Android security patch updates every 2 months.”
— OnePlus OS Maintenance Schedule

Conclusion

OnePlus has always offered solid well-designed devices at competitive prices. This new software maintenance schedule commitment makes their offering that much more compelling. 

I can no longer recommend devices from manufacturers that do not regularly deliver security and version upgrades. This is why I only recommend Android devices from Google, Blackberry Mobile and OnePlus. 

Is TOR Private and Anonymous?

GeneralEdward Kiledjian

One of the most frequently asked questions I receive from readers (from this blog, Twitter and LinkedIn) is "Should I consider TOR private and anonymous?" 

This question is interesting with fervent activists on each side [of the issue]. On one side are TOR proponents extolling the virtues of the platform and explaining how it will save humanity from the scourge of privacy-invading networks. On the other side of the discussion are conspiracy theorists that claim TOR is nothing more than an NSA honeypot (a data collection tool). 

Like most important topics, the truth is never as clean as we would like it. The truth is that TOR is a little bit of this and a little bit of that. Let's dive straight in. 

Who started TOR?

Conspiracy theorists love highlighting the fact that the United States Navy developed TOR. So the first question we need to tackle is regarding this origin statement.

The core privacy functionality of the TOR network, the onion routing, was developed by United State Naval research laboratory employees named Paul Syverson, Michael G Reed and Favid Goldschlag. The purpose of the technology was to protect US intelligence communication. 

The TOR Project was launched in September 2002 by Paul Syverson,  Roger Dingldine and Nick Mathewson. In 2004, the Naval Research Laboratory released the TOR code under a free license, and the EFF (Electronic Frontier Foundation) began funding the initiative. The Tor project we know and love today was started in December 2006 as a 501(c)(3) non-profit organization with support from the US International Broadcast Bureau, Internews, Human Rights Watch, the University of Cambridge, Google and  Stichting NLnet.

It is true that the majority of the funding for the free and open source project came from the US government. 

Does the government control TOR entry and exit nodes?

When talking about TOR privacy and confidentiality, there are 2 distinct question most astute users ask:

  1. Can someone "see into" my traffic?
  2. Can someone tie TOR traffic back to me? 

The first theory I read about consistently was that world governments (particularly the 14 Eyes Countries) control the majority of the TOR Exit nodes thus can "see into the traffic." Looking strictly at the Exit node piece, governments have no deterministic way of knowing where a suspects traffic will exit from the network. As long as they don't control all of the TOR Exit nodes (which we believe they do not), they can't be sure the suspect traffic will flow through their nodes. Additionally, if the site you are visiting is using cheap and easy to implement security (like TLS) then even if the government controls the exit node, they won't be able to "see inside the traffic." Traffic that joins the TOR network to access a TOR hidden service never exits the network so it wouldn't even pass through an Exit node.

What if a government controls both the Entry node and Exit node you use? Assuming you are using TOR to browse the "normal" internet then you will hit an exit node. If the government(s) control enough of the entry and exit nodes, they can use statistical correlation tie traffic back to you. 

If you are browsing a site with well-designed security, they still would not be able to see "inside your traffic" but would know that you originated the traffic flow (aka collect metadata). 

It is important to remember that the TOR Project isn't just idly sitting on the sidelines watching the government violate its technology. They are actively working to harden the platform and work tirelessly to make it more secure every day. Some of the techniques used by the TOR platform include:

  • Switching TOR circuits regularly and unpredictably. Thus making long-term data mining more difficult. 
  • Ensuring that the TOR nodes used are as randomized as possible. Thus making predictability of route near impossible.
  • and more 

Has the TOR browser been hacked?

The answer is yes but hold on before you install the TOR browser from your computer. I would submit that almost every commercial or free software has exploitable bugs that would compromise a users privacy and confidentiality. The question isn't whether a product has these types of exploitable bugs but rather what the software "vendor" does about them. The TOR project has been an incredibly honourable steward of the TOR platform. They quickly patch any discovered vulnerability. 

The other "trick" for the extra paranoid is to switch the security level in the TOR Browser to high. This will break some sites, but you want strong security don't you? 

Can I be tracked using the TOR Browser?

I wrote an article in 2016 talking about browser fingerprinting techniques and referred readers to the EFF's Panopticlick site to test this on their own devices. Browser Fingerprinting is a technique that leverages information your browser gladly provides to sites to uniquely identify you and then track you as you browse the web. 

To illustrate the power or browser fingerprinting, I ran the Ponopticlick site on my "normal use" machine using different browsers. 

  • My reference browser will be Google Chrome (same results with or without UBlock Origin): Your browser fingerprint appears to be unique among the 1,747,285 tested in the past 45 days. Currently, we estimate that your browser has a fingerprint that conveys at least 20.74 bits of identifying information.
  • The Brave "privacy" browser (default configuration): Your browser fingerprint appears to be unique among the 1,747,235 tested in the past 45 days. Currently, we estimate that your browser has a fingerprint that conveys at least 20.74 bits of identifying information.
  • Microsoft Edge (Win 10 latest update): Within our dataset of several million visitors tested in the past 45 days, only one in 218410.63 browsers have the same fingerprint as yours.
    Currently, we estimate that your browser has a fingerprint that conveys 17.74 bits of identifying information.
  • Microsoft Internet Explorer (Win 10 latest update): Your browser fingerprint appears to be unique among the 1,747,285 tested in the past 45 days. Currently, we estimate that your browser has a fingerprint that conveys at least 20.74 bits of identifying information.

  • Tor Browser with safest security option: Within our dataset of several million visitors tested in the past 45 days, one in 92.3 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 6.53 bits of identifying information.

So in safest mode, the TOR browser does dramatically reduce information leaking about your browser but the fact you are using a low popularity browser is in fact itself a tracking tool. The short answer to this question is that tracking is still possible.

Should I trust the TOR Browser?

I've addressed some of the most common questions I receive, but the only reason you read this article is for this one question alone. You want to know if the TOR browser is safe enough for you. 

Unfortunately for you, I'm a security professional, and I believe security is never black or white. The question of whether the TOR Browser is safe enough for you is the real question and that depends. 

It depends on the types of activities you are performing. 

On the low end of the spectrum is a general user that wants to use TOR to browse questionable websites from work without leaving traces in the company proxy logs or without being stopped by a URL filtering tool. For this type of user, the privacy and anonymity afforded by TOR are probably sufficient. It is unlikely that a nation state will target you for deanonymization and tracking. 

On the other end of the spectrum is a hardened criminal trying to sell nuclear secrets to the highest bidder. You would probably be classified as a high-value target by the global intelligence community, and thus they would use the full arsenal of tools to identify and track you. If you are a criminal mastermind hellbent on world domination, you probably need better tools than TOR. 

A tweet by Edward Snowden explains it best:

Security is a complex system of risk management and mitigating controls. There is no magic bullet where everyone is safe and anonymous all of the time. True security is a complex architecture of different technologies implemented in very particular ways, to achieve the protection level you desire or need. 

If you are browsing adult content from home and want some level of anonymity, TOR is perfect. 

If you want to browse it while at work, know that most companies have agents installed on your workstation to track your browsing regardless of the browser used. 

Therein lies the real risk. Whether you are using TOR or the end-to-end encrypted Signal messenger, the tools themselves are often secure.  However, if someone compromises either of the endpoints, you can still be de-anonymized. This is why true security must be done in layers.

Maybe you need to run a secure Operating System, like Qubes OS that routes its traffic through TOR (booted from read-only media and hash checked to ensure it has not been tampered with). Additionally, even if you have a safe and secure computer, operating system and connection, you must still be careful not to involuntary divulge clues about yourself when online, so security hygiene is also very critical. 

Security is though. Perfect security doesn't exist.

Calgary airport offers the best WIFI performance in Canada

GeneralEdward Kiledjian

Ookla, everyone's favourite speed test service has just published internet performance metrics for North American airports. Calgary Airport has been rated as the best performer of all Canadian airports and is the third best in North America.

  1. Seattle Tacoma International
  2. Denver International Airport
  3. Calgary International

Montreal's Pierre Elliot Trudeau Airport was rated the worst. Toronto's expensive Toronto Pearson International Airport is rated 23rd.

Examples of Darknet (TOR) sites

GeneralEdward Kiledjian

I have received a lot of requests from readers, LinkedIn and Twitter connections to provide examples of some "interesting" darknet (TOR Onion Network) sites. I have posted over a dozen on my LinkedIn page but thought I would show a couple here.

My security team and I perform internet and darknet reconnaissance work to create briefing packages on cyber crime, determine trends and spot organizational dangers. As part of this research, we sometimes stumble on interesting examples that I share. 

I have chosen not to hide the onion addresses (aka the URL) because I want to show that these are not made up designs but actual sites. I discourage anyone from using or visiting these sites. I am providing these as example for educational purposes only.

Bitcoin Fig is a centralized Bitcoin tumbler. A Cryptocurrency tumbler is a service that intakes identifiable, tainted or stollen cryptocurrencies and delivers them back with an obscure trail. This is used to improve anonymity when questionable transactions are being performed. These firms typically charge 1-4% of the "cleaned" amount and operate out of countries with strict private banking laws like Cayman Islands, Panama and the Bahamas.

The The Cannabis Growers and Merchants Cooperative CGMC is a "by invitation" cannabis market. They offer a trustless (aka escrow) shopping experience to protect buyers.

The sense of anonymity offered by TOR, attracts many with much more questionable products. Above is the French connection that deals in Heroin, Meth, brown sugar, Superman XTC pills, black tar, Amber glass BHO crumble and other products guaranteed to screw your life.

We've covered drugs and now we turn our attention to sports betting. BETTOR claims to be a marketplace that sells winning bets (not predictions). They claim to have 100% winning bets for football, basketball and tennis. I don't gamble so I cannot vouch for the quality of their recommendations. 

CyberGuerrilla is another example of groups using the pseudo-anonymity of TOR to do what they probably wouldn't on the "normal" internet. This site describes it's mission as "The CyberGuerrilla Collective is an autonomous body based in Europe with collective members worldwide. Our purpose is to aid in the creation of a free society, a world with freedom from want and freedom of expression, a world without oppression or hierarchy, where power is shared equally. We do this by providing communication and computer resources to allies engaged in struggles against capitalism and other forms of oppression."

I describe this site as a blog platform for closet anarchists. 

Escrow defense is a buyer/seller escrow service. 

Cash is King is a get rich quick scheme. You pay them in BItcoin and they "sell" you cash that was destined for destruction. They claim to have a way of moving the cash before it is destroyed but need you to "launder it". How much is this service you ask?

What if you were scared as a king by Burger King and want nothing to do with a King? What is a cash strapped person to do? You can always buy counterfit US dollars from the USD site

What if you want to deal with digital currency? No worries, enter Vendor. Vendor sells hacked Paypal accounts.

How do you cash out these PayPal accounts without getting caught? Conveniently they offer a "cheap" laundered bitcoin service for a small nominal fee ($45USD for each BTC).

So now you have your drugs, your cheap cash and your cheap bitcoin. All this money is burning a hole in your wallet and you want to spend it on "cool" stuff. How about some counterfeit clothing?

What about stolen electronics like a Sony Playstation, an iPad, iPhone, Acer laptop,  or Samsung Galaxy S9?

 

Since you haven't spent all your money yet, maybe you should think about the future and use DoubleBit to grow your crypto using darknet markets. For a "small" fee, they will "invest" your crypto for growth then will return "clean crypto" back to you with outrageously generous short term returns (I am being sarcastic, I have never used their service so I wouldn't know).

Why invest when you simply buy money from the BigDeal marketplace (http://bh3ly32vcg52brrc.onion/)

If you work for a publicly traded company and want to cash out some insider knowledge, you can use The Stock Insiders site