Ed’ favourite things - Meet the Ti Arto EDC Pen

August 6, 2020GeneralEdward Kiledjian

Ti_Arto_EDC_Pen-Posted_Compare_2048x2048_2048x2048_cf3fb232-9843-444f-951f-64070dc813cb_2048x2048.jpg

*** This is not a sponsored post ***

I love Titanium EDC gear. Now that my obsession with Ti is out of the way, let’s talk about pens. Most people buy the cheapest pen they can find or that their company will provide. I would like to submit that a well-designed pen is as much a tool as it is a work of art.

I bought my Ti Arto EDC pen in 2016 and it has been with me every day ever since.

IT has been around the world multiple times and is still my favourite pen ever (and I have owned very expensive ones).

What makes the Ti Arto EDC Pen great

First, it is machined out of a solid piece of titanium. Second, it accepts 750 different pen refills without having to hack or mod the refills or use (easy to lose) spacers. Third, you can adjust the length of the pen by swirling the back (longer or shorter).

Why is titanium great for everyday carry? Because titanium is a very hard and resistant metal. This pen has travelled in my wallet pocket for 4 years around the world and isn’t dented. Obviously it is created a bit but I find it shows character that way. the scratches aren’t deep and can’t be felt using the pen.

The Ti Arto EDC pen is well balanced (capped or uncapped) which means it is comfortable to use even for someone with smaller hands or for someone that writes a lot. Even after 4 years of daily use (and abuse), the cap stays on the end when desired. It doesn’t slip off because of gaskets on it.

When writing with the cap screwed on, the cap doesn’t rattle.

The Ti Arto also has a wider girth that makes writing for long periods more comfortable (aka less hand strain).

The refills

When you buy the pen, it comes with a Schneider 0.4 mm black gel ink refill installed. Over the years I have tried different refills and have chose the Signo RT as my preferred choice right now (although the fisher space pen refill was also a good choice).

Big Idea Design, the Ti Arto’s designers, have tested 750 different refills and they created a google spreadsheet with the list of supported refills.

Conclusion

I know many of your reading this will consider a $90US pen a frivolous purchase when you can buy a disposable pen for $1.99 or a slightly better quality reusable Pilot pen for $10-20. Your position is perfectly understandable.

I believe in buying fewer items but buying high-quality ones for the products you chose to introduce into your life. Think about how many times you have used a pen in the last 2 weeks. This is something that will last a very long time and that you can be proud to show friends and colleagues,

If this is something you think you would be interested in, here is the link on Big Idea Design’s website (not an affiliate link) : here.

I own other Big Idea Design products that will make it into my favourites list so stay tuned.

Your smartphone security guide (iphone and android)

July 28, 2020GeneralEdward Kiledjian

There are companies out there that will pay top dollar for working full chain smartphone vulnerabilities that will lead to a complete compromise (check out Zerodium as an example ). A full zero-click compromise for a patched android phone can net you a cool 2.5M$ (Wired).

Considering how we use smartphones and the information they contain (or can leak), these aren’t just simple electronic tools. Smartphones can be considered a bionic extension of your mind—anyone who can access your phone gains unprecedented access to your mind, life and psyche.

You may doubt the validity of the above statement, but think about it. Your smartphone knows where you are and where you have been. It knows who your friends and colleagues are. It knows whom you interact with. It has access to all your emails and other messaging. It has a camera that can be remotely triggered and a microphone to listen in on any of your private conversations (when was the last time you were more than 6 ft from your smartphone?).

Who is this article for?

The more secure you make something, the less usable it becomes. Security professionals have to tailor their security recommendations based on the risk profile of their customers.

For this article, I am assuming you are a “normal” general computing user that is not subject to elevated risks or custom attacks (aka you aren’t in the intelligence field, a journalist in a less favourable geography, a politician, etc.)

Why is this important? An average user will be targeted by unsophisticated actors (ex-partners, lovers, former angry friends, coworkers, or script kiddies) or medium sophisticated actors (scammers, general hackers, etc.)

An average user is not important enough to merit an attack by state-sponsored actors or organized crime. These advanced actors have more developed capabilities that would require a customized security program built by an experienced security professional.

What are we trying to accomplish?

Whether I am building a multimillion-dollar security program for a large cloud service provider or helping you secure your own smartphone, the goal is always the same.

Absolute security does not exist regardless of how careful you are or how much you spend.

The goal of a solid security program is to be "good enough" to tire your attacker and encourage them to move onto their next victim. Even with the most expensive door lock, a thief can use a battering ram to break down your front door, but they probably won't. You buy a lock that is sufficiently strong to resist breaking with kicks. A good security program is the same.

Let’s begin.

Encrypt your device

If you are running an iPhone with IOS 12 or later, it comes automatically encrypted out of the box. IF you are running an older version, check out these instructions. Most modern Android devices from reputable manufacturers come encrypted as well. If you are running a phone from a lesser-known manufacturer, a phone that comes from a market where encryption is illegal or it is older, check out these instructions to encrypt your phone.

Password or Pin

Since IOS 9, Apple has made a six-digit pin mandatory (although you can still force it back to a four-digit pin). Remember that once an attacker finds your pin code, they are in, and no additional tools are protecting you.

The goal is to make your adversary’s life as difficult as possible. A 4 digit pin means your attacker will have to try 10,000 possible combinations. It may seem significant to you, but remember, they have tools to automate this process. Simply moving to a six-digit mixed password means there are 1,000,000 possible combinations.

If you choose to implement a passphrase instead, you make it more difficult for you but you also make it more difficult for an attacker to crack.

Fun fact, approximately 25% of all smartphones can be cracked by using one of these pin codes:

1234
1111
0000
1212
7777
1004
2000
4444
2222
6969
9999
3333
5555
6666
1122
1313
8888
4321
2001
1010

Most phones also support a feature that wipes all the data from your phone after a certain number of wrong attempts have been made. This eliminates the threat of automated attacks.

Remotely wipe your phone

. If you feel someone else may be in possession of your phone, and it is connected to the internet, you may be able to remotely wipe the data.

On Android it is normally called Find My Device

On iPhone it is called Find My iPhone.

You can log into the manufacturer portal to find your device or wipe it if necessary.

Sample iCloud Find my phone interface with the Erase button

Find my device links

Android : https://support.google.com/accounts/answer/6160491?hl=en
IOS : https://support.apple.com/explore/find-my

Two Factor Authentication

Remember that your phone is an extension to your online Google or Apple ID. It is very important that you protect these from unauthorized access. You should be using a long, complex, non-dictionary, passphrase to log in. You should also enable two-factor authentication to add another layer of protection to your account in case your password is compromised.

The easiest is to use Time based One Time Authentication codes.

On Apple devices, you will use your smartphone (or any other Apple device connected to your account. The Apple instructions are here.

Google users can use a software TOTP system with any one of the free TOPT clients available. The cleints I recommend are :

or some password managers (e.g. 1Password) also offer this as a function. The most secure option is to use a hardware token (e.g. Yubikey) but this is slightly more demanding and I won’t be covering it here.

Update and uninstall

Most attacks are against old vulnerabilities that remain unpatched. If you have a phone from a manufacturer that does not regularly deliver (monthly) security updates or the updates for your phone have stopped then it is time to buy something else.

You must update your phone operating system and all the apps on it regularly. Doing this will reduce your attack surface (ake make an attackers life more difficult).

Remember that applications may have undiscovered or unpublished vulnerabilities. In addition to updating them using the Apple AppStore or Google Play, you should uninstall any applications you do not regularly use. Many of these apps are stying on your anyway but they could be the weak gateway an attacker gains access to your phone.

Where possible, use the web version of services. As an example, instead of using a Twitter app (on most of my devices), I use the PWA website at mobile.twitter.com. This gives me full functionality without needing an app (that can track me or compromise by device).

Only install apps from official apps stores (Apple AppStore or Google Play). Apps in these stores are cryptographically signed to prevent impersonation by attackers. If you are a little more adventurous (on Android), you can also check out the F-Droid alternative app store.

Reboot often

We have seen many attacks in the last 3 years that are not persistent. This means they go away after you reboot your device. This is why it is a good idea to regularly reboot your device. I typically try to reboot it every 8 hours or so (while I am awake).

Turn off your phone

A phone that is off can’t be attacked.

An unsophisticated attacker will not be able to compromise your phone’s baseband chip and turn on your phone.

It is a good idea to turn off your phone when you can (at night or when you will be away from it from a while). Plus turning it off while charging will often allow your phone to charge a bit faster.

Install a firewall

You may not know it but if you use a Windows or macOS device, there is a manufacturer-provided firewall on your device. Unfortunately, smartphones do not come bundled with them but they are extremely useful.

It seems every week we read about another couple hundred apps (on IOS and Android) that made it to the app store but that were malicious. A firewall will define what apps will be permitted to use WIFI and/or LTE.

The best firewall for Android is Netguard and the best one for IOS is called Lockdown.

These apps can work in 2 modes:

blacklists mode, is where you choose what apps should not be allowed to communicate
whitelist mode, is where no apps can communicate unless you specifically allow them to

Obviously whitelist mode is the most secure but may require a little bit of tweaking when an app just doesn’t work right.

Due to recent societal changes, expect the authors of these apps to change the above terms shortly. Blacklist will be changed to blocklist and whitelist will be changed to allow list.

Disable WIFI and Bluetooth

Anytime you are out of a trusted location (home or work), turn off WIFI and Bluetooth. Also make sure that any feature that would automatically turn them back on is disabled (e.g. Automatically connect to public networks).

Attackers can set up a malicious network and easily trick your device into connecting to it. This is trivial but not part of this discussion so I won’t explain how to do it here.

Many public venues (e.g. malls use your phones Bluetooth beaconing to track you as you walk around. This works without any intervention from you. When you don’t need Bluetooth, turn it off.

Remember that public WIFI is evil. Any WIFI that you don’t control can be used to steal your information. If you have to connect to untrusted WIFI, use a VPN. Please use a good VPN and know that good VPNs are never free or extremely cheap. You get what you pay for.

Many will recommend TOR but it is slow and most users would find the experience painful. So I stopped recommending TOR for most users.

Browsers

Browsers are dangerous. Dangerous. Dangerous. They run code delivered to your device from another computer which means it could be a wonderful way for someone to compromise your device remotely.

If you don’t believe me, read this article China hacked iPhones and Android devices to target Uyghur Muslims.

For iPhone users, I recommend sticking with the built-in Safari. Apple has done a relatively good job with it and it should be secure enough.

On Android, my browser of choice is Bromite . Bromite has native support for the uBlockOrigin adblock engine( the best in my opinion). It supports DNS over HTTPS, to encrypt your DNS queries. It is always in incognito mode and it offers many more wonderful security-friendly features. Remember to turn on HTTPS everywhere in it and disable Javascript.

Is IOS more secure than Android?

To close out this article, I will quickly touch on the question I receive the most often.

For this discussion, we have to separate privacy and security. This article was written to improve your security not your privacy. They do not usually go hand in hand.

For a general user looking for a no worry relatively secure platform then IOS is probably the way to go.

For a general user that doesn’t mind a little work and that wants good security, Android is the way to go. IT offers more customization options to make your device more secure.

For a more security-conscious geek, then I recommend going to GrapheneOS. GrapheneOS will require some work (you have to install it) and will make you uncomfortable (does not come with any Google services or the Google Play store) but it is the most secure consumer option right now.

Exodus Privacy will help you identify the trackers embedded in your favorite android apps

July 20, 2020GeneralEdward Kiledjian

Companies large and small are always looking for new and creative ways to violate your privacy.

One popular tool of the trade is to embed trackers and ask for more permissions than necessary to "steal" user data. The question is, how do you know what trackers are embedded in your installed Android apps? This is were The Exodus Privacy Report tool comes in.

Here is a sample report for the Adobe Acrobat app

When you click on one of the trackers, it gives you interesting information

Clearly they want to acquire as much information about you as possible to track your device. You can then decide if the app is worth giving up all this information or if you want to use another app that is less invasive.

Are iPhone users safe? The answer is no, but researchers don't have permission to analyze IOS apps. We know that many of the worst offending apps are on both platforms and use cross-platform Software Development Kits.

So what do you do? Remove any apps from your smartphone that you don't use regularly. Before installing any application, make sure you read and understand the permissions being requested by the app. If a game wants your location, access to your camera or other weird permission, pick something else.

Are there "good" apps?

Yes, there are. Protonmail is an example of an app that only has crash analytics trackers built-in. Another example of a "good" app is the DuckDuckGo Privacy browser; it contains zero trackers.

I was disappointed to see NordVPN with its six trackers. NordVPN is tracking user behaviour.

You can access the database online here.

My view of the TikTok risk

July 16, 2020GeneralEdward Kiledjian

This is an opinion piece.

TikTok is a Chinese social media network that allows creators to publish short videos. It started with a ton of slapstick comedy and karaoke but has since matured with much more diverse content. It has become one of the most popular social media platforms because of its powerful video pairing algorithm. It has an incredible ability to show you a continuous stream of content you will find interesting, and it is usually correct.

You can see samples on their trending webpage without needing an account.

TikTok belongs to a large Chinese company called ByteDance. This is problematic for western politicians because (it is suspected) Chinese corporations have been stealing IP from their western counterparts for decades.

But why is the USA talking about banning TikTok (a rare censorship move by the US government)?

It is important to remember that China has banned most western social media apps within its borders. Without working around the great firewall of China, a citizen cannot access Facebook, Twitter, Reddit, or any Google property. It banned them to stifle conversation, to censor free speech and to monitor its citizens.

You can use a website like Blocked In China or Comparitech to check if a site is accessible from China

I have lived in Hong Kong and worked in China for a considerable amount of time. So I hope that I can bring some interesting perspectives about China and this TikTok discussion.

The first thing to remember is that you cannot evaluate this matter through an American lens.

Every medium-sized company or larger (think larger than 50-75 employees) is beholden to the Chinese government. This means that the Chinese government can seize, capture or use any information held by any Chinese company. Unlike US authorities, they do not need a court order to undertake any of these activities). Even though the Chinese government has allowed companies to operate with a semi capitalistic model, they theoretically own all Chinese companies operating in China.

A more risky point is (it is said) the fact that the Chinese government incentives Chinese companies and citizens to expand internationally and sign partnerships with western organizations to steal IP. The goal (it is said) is to use this knowledge to build a Chinese variant. Once perfected, the end-goal is to export this Chinese version overseas and take over that market (this works in every vertical from clothing to aerospace).

Read about their 14th five year plan here. Think of the five-year plan as a master blueprint for their economy. It lists the industries they want to lead in during that five year period. The next one (2021-2026 will cover the environment and green tech). During those five years, they want to become industry leaders at any cost (remember the IP theft claim above).

If you watched Silicon Valley on HBO, they alluded to this characteristic when Jìan-Yáng "borrowed" American company ideas to start copies in China (time-code 0:44).

Sometimes patriotic hackers could also attack foreign companies to aid China. The US Department of Justice pinned the Equifax hack on 4 Chinese hackers. This hack gave hackers ,and (it is said) the Chinese government, access to the credit records of millions of Americans. They also had access to confidential Equifax business processes.

So what?

Let's summarise

every Chinese company is owned by the Chinese government
The Chinese government has access to all the data these Chinese companies have

So considering the above, prima facie, Tiktok should be a national security threat. Last year American senators "woke up" and asked their national intelligence agencies for analysis.

Obviously, Tiktok pushed back by saying that they use American servers running in the USA. TikTok also appointed an American CEO.

Think of all the data these companies collect about you (name, location, social graph, habits, likes, etc.). Used "properly" it can generate a ton of obviously useful and some less obviously useful data points.

Read my 2014 article about how Target predicted its’ customers were pregnant before they knew it by data-mining their buying habits. Now imagine what could be done with a ton more information.

Regardless of where the data sits, the company that owns TikTok is ByteDance, a large, fully Chinese organization. Even if the data sits in the USA, ByteDance (it is believed) cannot refuse a request from the Chinese government (regardless of where the data sits).

Remember that Chinese employees have access to the American servers and data. It is claimed that ByteDance has ties to the communist party back home. All of these simply bring TikTok closer to the Chinese government and make obtaining information that much simpler.

In addition to concerns about China gaining access to traditional social media users’ data, there is the concern of TikTok being a tool to exercise soft power.

A popular tool used in cyber offensive activities is Psychological Operations (PsyOps). The goal of a psyops program is to secretly fuel the fire in a foreign country's population to take actions desirable to you.

We heard about TikTok users coordinating on the platform to troll Trump's Tulsa rally.

Was this truly a grassroots movement, or was a foreign adversary secretly working in the background to encourage actions aligned with its interests? Remember that a good psyops program is secret and almost impossible to identify.

Americans see TikTok as a bastion of free speech, but it isn't. Many have claimed Tiktok removes other types of videos that would not normally be considered bad in the west:

TikTok Is Reportedly Removing Videos of People with "Abnormal Body Shapes"
TikTok 'tried to filter out videos from ugly, poor or disabled users'

We have heard other complaints about videos critical of China also were removed. I don't know if this is true, but it would be consistent with how we believe China operates. Don't forget China uses TikTok to flex its soft power by encouraging creators to publish pro Chinese content.

This goes back to the original point of not evaluating TikTok with your American lens. Whereas the removal rules for videos on Youtube, Facebook or Twitter are relatively well accepted (harmful, child abuse, exploitation, promoting hate, etc.), Chinese rules for removal of content are very different. China has an ambiguous law that aims to “prevent the spread of rumours”, What constitutes a rumour is purposefully vague and this law has been used to shut down dissenting voices. When watching online complaints about the types of videos actually being taken down, it seems more aligned with enforcing this law to protect the Chinese “face”.

My assessment is that the Chinese government doesn't care about users discussing American politics. They want to ensure no one criticizes China, the Chinese system or the government's authoritarian rule. This is exemplified by TikTok deleting a video by a makeup channel. She talked about the plight of the Uyghur while doing her makeup and had her video deleted.

China believes in free speech as long as it doesn't impact them or their narrative of the world. Try searching TikTok for videos discussing Hong Kong independence, Taiwan independence, or anything else criticizing China.

Here is a shocking trend for you. Teens in the US and Europe that believe they may have been shadowbanned will publish videos with the Chinese national anthem playing in the background, with pictures of Xi Jinping and professing their love for China. Even though this is being done mockingly, doing this enough could have unintended psychological consequences and start creating positive associations in these teens about China.

Conclusion

I am anxious to see if the USA will ban TikTok and on what grounds. Will they conduct a full and impartial review, or will it simply be a decision of political convenience. Don't get me wrong, as a security professional; I don't trust any company based in China that is beholden to the Chinese government. The general public making dance videos may not care that their data could be used to build a profile of each user.

That if the Chinese government wanted, they could use the videos to create a sizeable facial recognition database with a robust social graph.

That this data, merged with other data from other breaches and leaks, could help build a reasonably reliable profile of hundreds of millions of people.

That the platform could be used to sway younger voters in a particular political direction more aligned with Chinese interests.

I am curious about how the US would implement a ban? Even if they mandated the appstores remove the apps, Android users could sideload it, or TikTok could build a Progressive Web App (a web page that looks and acts like an app). We simply don’t have the same censorship tools as China.

I don't know if the platform IS a risk to national security, but I personally don’t trust it.

If I start seeing more "Chinese contraband" content on TikTok, then I will be inclined to believe they are independent of the Chinese government. I want to see

videos about the Muslim minorities being sent to re-education camps
videos asking for freedom to be restored in Hong Kong
videos talking about Taiwanese independence
videos criticizing the communist government
videos discussing he persecution of Falun Gong members (even imprisonment)

Until then, I hope users understand what could happen with their data. Particularly parents of younger children. Once something is uploaded to the internet, it can never really be removed.

Ed’ favourite things - Meet the Supply Co Single-Edge razor

July 7, 2020GeneralEdward Kiledjian

*** Let me state at the top, that this is not a sponsored post. ***

Look at my picture on my blog, and you will notice I have a shaved head. I have been shaving it since I was 18 years old using the standard Gillette cartridge razor and shaving cream method.

Earlier this year, I started investigating alternative shaving techniques and tested over a dozen injector razors and double-edge razors. Cartridge style razors (Gillette, Harry's, Schick, etc.) are the type of blade most of us grew up using. They are highly available and easy to use.

I shave my face and head every day; the cost of cartridges is significantly more (even with Harry's or Dollar Shave Club.) A typical blade lasts st most a week.

So single-edge and double-edge replacement blades cost less. Contrary to popular advertising, adding more blades didn't make the shave easier on my skin. Using a proper shaving regimen with the single-edge or double-edge razors yielded a gentler shave with less irritation.

Exploring

I bought a bunch of different razors (handle and blade combos for double-edge and single-edge injector kids). My double-edge blade collection is a collection sourced from 14 different countries.

After everything was said and done, I chose the Supply Co single-edge injector style razor as my preferred shaver.

I tested the following injector razors:

Supply Co (version 2)
Shave Classic Single Edge Razor Handle
Schick injector razor (old version)

I tested the following injector blades:

Schick
Supply Co
Personna mini

Introduction to the Supply Co Razor

The first characteristic you will notice is just how nice the razor feels in your hard.

It is an all-metal build using Metal Injection Molding (typically used to manufacture aerospace components or medical items). This process allows them to create razors with very tight tolerances. You would expect an all-metal razor to be slippery. Still, the bead-blasted surface allows for easy gripping, even with wet hands. It is very subtle, and the razor looks sleek and smooth.

Supply Co understands that preferences are personal. They include three configuration plates for the blades (think gentle, classic and close). After testing all three, I chose and still use the close adjustment plate. You can use any injector blade with the Supply Co razor.

They include a small supply of Supply Co razor blades with each kit (and they run free blade for life promos every once in a while). Their blades are slightly thicker than the competition, making them particularly suitable for mowing down multi-day beards. The Supply Co razor injector comes with eight blades and a used blade catcher underneath.

A traditional Gillette style cartridge razor required two passes to get a good shave (even with their 5-blade razors). Using a pre-save cream, shave soap, and the Supply Co razor requires an additional pass. The result is a less irritated and closer shave.

What about the cost?

I always used high-quality shaving products, so moving to a pre-shave cream and shave soap didn't increase the cost that much. The Supply Co razor is ($75USD) is more expensive than a traditional Gillette razor ($10-15USD).

Still, the cost of razors and blades catches up at five months, and it becomes much cheaper after that.

The other important factor to consider is that the Supply Co razor is guaranteed for 100 years. As long as you don’t lose or abuse the razor, you likely won’t have to buy another razor for a while (if ever).

What about the Double-Edged razors

I tested several razors and blades. All in all, I must have gone through 30 separate combinations. Which blades did I try? here is the list of double-edge blades I tried

Derby Extra
Astra Superior Double platinum
Shark
Asco
Lord Cool
Big Ben
Shark Platinum
Rapira Voskhod
Clifton
Treet Dura Sharp
Silver star
Vidyut Super-Max
Ladas

Here is the list of double-edge razors I tried:

Wilkinson Sword
Merkur Classic 3 piece
Merkur progress adjustable 2 piece
Weishi Long Handle

I found the Supply Co razor more gentle (less irritation). I found it particularly challenging, shaving the back of my head with the double-edge (more prone to cutting and missing patches of hair) than the Supply Co razor.

In preparation for this entry, I shaved a 2-day beard with my favourite double-edge combination and the Supply co razor with their in-house blades. With three passes using the same process, the Supply Co side was smoother, less irritated and had fewer nicks.

Change in mindset

The other unintended change was my mindset around shaving. Not sure why this change happened, but it did. I had always seen shaving as a necessary evil.

When I switched to the single-edge razor with a pre-shave cream, shave soap with a boar hair brush and an alum stone, I find shaving a relaxing self-care ritual.

Shaving is personal

Shaving is a very personal experience, and everyone will have different preferences. I suggest you get involved in the dozens of online communities and find the combo that best suits you.

A handful of members in these communities also switched to the Supply Co after my experience, and have now become converts.

Some may prefer the double-edge razors, while others will always see shaving as a chore and go with the mid-priced cartridge razor on special at their local pharmacy.

Ultimately shaving is something most of us will do for many years, so it is worth investing a little bit of time in finding the best solution for you.