On Message with Ben Gross

ongoing - OpenID at Work: Tim Bray writes about Sun’s recently announced internal OpenID service. Sun is now offering an OpenID provider, but only for Sun employees. This means that third parties could theoretically allow people from Sun to log in via their OpenID relying party service and know that the individuals were in fact Sun employees. This could be used for training, discounts, etc. The primary problem is that currently there are far more OpenID providers (sites that offer credentials) than OpenID Relying Parties (sites that take credentials). It is an interesting example as it does allow external sites to verify affiliation easily, although an employer email address would do the same thing, but with less potential privacy protections.

Digital Domain - Goodbye, Passwords. You Aren’t a Good Defense.: Randal Stross writes about the current state of password management for the New York Times. The executive summary is that it is not good. He talks about a few authentication mechanisms that are vying for popularity online. He mentions Microsoft’s Identity Cards which he seems to like and OpenID which he does not.

http://www.links.org/files/openid-advisory.txt: Another example of the continued fallout from the unfortunate modification made by a Debian developer to OpenSSL. In this case, Ben Laurie from Google’s Security team and Richard Clayton from the Computer Laboratory at Cambridge University, found that some OpenID Providers used TLS (SSL) Certificates that used weak keys due to the OpenSSL changes. An attack becomes more viable when combined with recent DNS cache poisoning techniques. OpenID is not uniquely vulnerable here, it is just an interesting example of combinations of security flaws that have far reaching affects.

Related posts


Link Roundup on Identity Management 4/13/08 Understanding CardSpace | : As part of his Perspectives series, Jon Udell interviews Vittorio Bertocci, the author of Understanding Windows CardSpace. The inter ...

Link roundup for 8/10/07 Smartphone Browser Shootout: Palm, BlackBerry, HTC Vs. iPhone: An article by David DeJean at InformationWeek. The author describes a series of tests of various ...

Link roundup for 2/8/08 Email Standards Project Acid Test | Email Standards Project: this is a test inspired by the Web Standards Project (WaSP) Acid tests that are widely used to gaug ...

Link roundup for 8/23/08

August 23rd, 2008

A Guide to CSS Support in Email: Campaign Monitor put out a revision to its excellent guide to using CSS in email. They tested their finding on 22 webmail and desktop email clients for a comprehensive overview that they summarized nicely for quick reference.

Tuning and Feeding: My best practices for getting the most out of Twitter: Howard Rheingold has been chronicling online communities since long before most people have been online. He writes about his use of Twitter in Smart Mobs and describes his personal best practices for Twitter use and how these practices have made the service more useful to him.

A brief history of identity protocols: Eric Norlin of Digital ID World wrote a brief overview of the current identity protocols for CSO online.

Related posts


Link roundup for new OpenID uses and problems ongoing - OpenID at Work: Tim Bray writes about Sun's recently announced internal OpenID service. Sun is now offering an OpenID provider, but only for Sun emplo ...

Link roundup for 8/20/08 The 3 Loops of Designing for Audience: Gregor Hochmuth has a nice write up on the loops of audience interaction for engaging your audience in modern social web ...

Link roundup 8/5/08 Bookmarks Are Dead. Long Live Bookmarks: Jeremy Wagstaff writes about the current state of bookmarks and bookmark synchronization tools in his Loose Wire blog. ...

Link roundup for 8/20/08

August 20th, 2008

The 3 Loops of Designing for Audience: Gregor Hochmuth has a nice write up on the loops of audience interaction for engaging your audience in modern social web services. He uses specific examples with the Twitter messaging service, but his guidelines would apply to many services. His loops are: 1) Users building a model of their audience 2) Audiences giving feedback to the people who post content 3) Users giving feedback to the system about the people and content that are important to them.

HitMeLater: A Snooze Button For Your Email: TechCrunch has a brief review of an interesting service called HitMeLater. If you send an email to the HitMeLater service with the number of hours later you desire a reminder as the username, it will send you your message back that many hours later. You can also ask the service to mail you back on a specific day of the week. It is a simple but effective reminder system.

An Illustrated Guide to the Kaminsky DNS Vulnerability: Steve Friedl put together a long, but very readable and highly illustrated overview of the recent DNS vulnerability. It’s worth a look for anyone still trying to understand how the vulnerability works or its implications.

Related posts


Link roundup for the DNS flaw DoxPara Research: Is the personal blog of Dan Kaminsky, the researcher who discovered the DNS flaw. His posts are a good source of information for following the ...

ETel Mashup Contest Winner: After Hours Doctor Office Earlier today O'Reilly Media and StrikeIron took votes from ETel conference attendees for the finalists for their Telephony Mashup Contest. The winning mashup w ...

Link roundup for 8/7/07 Annals of Technology: Damn Spam: "The losing war on junk e-mail" by Michael Specter in The New Yorker is a lengthy overview of the current state of spam and fil ...

SSH is the de facto way to establish a secure connection with a command line interface. It is an essential too for people who regularly manage Unix servers, networking gear, and a variety of other devices.

There are now three SSH clients that will work on any iPhone or iPod Touch with access to the iPhone App Store. It is true that iPhone SSH clients have been available early on for jailbroken iPhones, but the new clients are available on non-jailbroken iPhones.

Currently, there is no clear winner as each SSH client has its own tradeoffs and none are ideal. Since they are all likely to be revised quickly, if you absolutely need one right now, buy whichever one has the functionality you need. These SSH clients would all be maddening for long term use, but have great potential for emergency fixes, monitoring, and just running a few commands without needing access to a computer and a network.

The developers of each of these SSH clients have submitted updates that will be available as soon as they go through the App Store approval process, most likely in the next week or two. The good thing is that each of the apps is inexpensive and show promise. All three developers seem responsive. I’ll write an updated post after the updates for all three apps (and if there are newcomers) are released.

I used a recent version OpenSSH sshd running on FreeBSD and on Linux for testing.

Some commonalities across clients:

  • All worked in both portrait and landscape mode
  • All support a default 80×24 terminal in portrait mode
  • All supported saving at least the hostname and nickname for future session reuse
  • All worked with color ls
  • I was able to bring up and use (to some extent) Pine and Emacs on each
  • Each client allowed access to the built in iPhone keyboard that supports most meta characters you might need including tilde, pipe, brackets, angle brackets, ampersands, and asterisks.
  • None of the clients supported an alt key, meta key, or an explicit break key.
  • No esc key, but can use Ctrl-[
  • All will work on iPhone/iPod Touch with access to the App Store and 2.0 firmware or higher
  • All with work with Wi-Fi and EDGE/3G(HSDPA)
  • None of the clients supported host-based public key authentication, ssh-agent, or port forwarding.

 

iSSH (App Store)

 

by: Zinger-Soft
Price $4.99
Version tested: 1.0
Size: 525.1kb

iSSH Overview

I found iSSH to be the nicest to work with overall for the current crop. It edged out the others because of the widest terminal emulation support and its use of the touch screen for arrow keys, which I found to make a much better user experience especially with Pine and Emacs. Another nice touch swiping up (up arrow) would allow you to scroll back through your command history. iSSH is based off the open source PuTTY client like pTerm.

The account screen includes fields for Description, host, login (username), and an optional command to run on login. The password is requested after each connect.

iSSH the Good

  • Widest range of terminal emulation support: VT100, VT102, VT220, ANSI, xterm, and xterm-color
  • Nice use of the touchscreen to emulate arrow keys and to handle scrollback without scrollbars
  • Keyboard allows for Ctrl, shift, Function keys, the tab key worked and allowed for command completion
  • Developer seems responsive. Has a support forum on Google Groups

iSSH the Bad

  • No alt, meta, or escape keys although Ctrl-[ worked in place of esc.
  • Does not show a session key fingerprint. It’s unclear if it actually caches the session key or not.
  • No way to delete a session you have created
  • Canceling an SSH session is slow
  • Supports screen rotation, but the screen rotation causes existing text on the screen to be covered up.
  • Finding the correct position on the screen to delete or edit existing sessions is difficult
  • No online manual
  • No support for non-default SSH ports
  • Was not smart enough to know when the terminal session ended, you have to hit the exit button
  • Has an exit session button, but it can take a long time to quite an existing session
  • When adding a configuration the first character of each entry defaulted to having the caps lock on.

 

pTerm(App Store)

 

by: Instant Cocoa (Eric Maland)
Price: $4.99
Version tested: 1.1
Size: 494.4kb

pTerm Overview

pTerm was the second official iPhone SSH client out the door. The client supports SSH, Telnet, and raw socket (TCP) connections with Xterm terminal emulation. Like iSSH, pTerm is also based off of the PuTTY code base.

When you create a new account in the client, it has fields for nickname, host and port, which means you have to put the username in each session.

Upon initial connect, presents key fingerprint and allows you to cache host keys. You can accept once or permanently as with standard desktop clients. I did not test what would happen if the host key changed and there does not seem to be a way to delete saved keys.

As with the other clients it support both portrait and landscape modes, you can double click to make keyboard appear and disappear.

Can pinch to zoom in and out although it was a bit difficult to find the right size sometimes. A few automatic settings might be nicer.

Color ls, Pine, and emacs worked, but lack of arrow keys was annoying and limited their utility.

pTerm the Good

  • Has terminal emulation (only Xterm)
  • Supports SSH as well as Telnet and raw sockets
  • Shows key fingerprint on connect
  • Can edit account information
  • Supports pinching and zooming
  • Supports scrolling to emulate larger screen area

pTerm the Bad

  • Terminal emulation limited to Xterm
  • Text did not automatically reflow around keyboards so you will likely have to scroll the text in order to see the command line if you want to type
  • Only control key. No specific alt, meta, tab, arrow keys, page up, page down, break, or function keys
  • No history buffer
  • Does not remember session usernames
  • Pinching and zooming seems a bit finicky

 

TouchTerm (App Store)

 

by: jbrink.net
Price: $2.99
Size: 878.7kb
Version tested: 1.1.517

TouchTerm Overview

TouchTerm was the first official iPhone SSH client in the App Store. The client is based on OpenSSH and OpenSSL rather than putty like pTerm and iSSH. Currently TouchTerm is the most customizable. You can change screen colors (foreground, background, cursor) in addition to the font size.

I found TouchTerm was my least favorite in terms of user input. There is an odd input box that effectively added another step each time you wanted to type. The box would occlude the screen and then disappear after you typed your text. TouchTerm was the only client with a clear screen button.

Color ls, Pine, and emacs worked surprisingly, but lack of terminal emulation makes it far less practical.

TouchTerm the Good

  • Can edit session information
  • Can save session password
  • Extensive online manual and release notes
  • Button to show command history
  • Soft keys for clear, control, tab, esc.
  • Supports pinch and zoom
  • Supports scrolling to emulate larger screen area

TouchTerm the Bad

  • Only supports saving one session
  • No exit button, so you have to exit and renter the application to start a new session.
  • No support for alt/meta, or function keys.
  • Pinch and zoom was a little finicky
  • No preset font sizes

 

Related posts


Interviews with Scott MacGregor, Lead Engineer of Mozilla Thunderbird Both Wired.com and Read/WriteWeb recently interviewed Scott MacGregor, the lead engineer for the Mozilla Thunderbird email client. Last week, the Mozilla founda ...

Link roundup for 9/11/07 TidBITS Networking: Penelope Project Ships Eudora 8.0.0b1: Adam Engst has a nice writeup of the first open source beta of Eudora which is the first pass at merg ...

Link roundup for 8/11/08 Nerdy nerds only: Version 1.0 of Chandler officially released: James Fallows of the Atlantic writes about the public release of Chandler. The Chandler Project i ...

Link roundup for 8/11/08

August 11th, 2008

Nerdy nerds only: Version 1.0 of Chandler officially released: James Fallows of the Atlantic writes about the public release of Chandler. The Chandler Project is the long running open-source personal information management and messaging project from the Open Source Applications Foundation (OSAF). The project was routinely criticized as a boondoggle, but may have begun to redeem itself with this release. Mitch Kapor (a founder of Lotus) originally founded and funded OSAF, but stepped down from the board in January 2008 and has said he will stop his funding for the project at the end of 2008.

Greasepocket: Bridging the Browser to the Client: Brady Forest at O’Reilly Radar writes about Greasepocket which is a variant of Greasemonkey for the iPhone. This is very interesting as it could bring a new level of features and customizations to iPhone power users. Greasemonkey essentially allows users to make changes to web pages at render time by inserting site-specific JavaScript. The source to the Greasepocket project is not yet available and it is unclear if Apple would ever allow such a program to be officially distributed via the iTunes store or if it would only work on jailbroken phones. Greasemonkey like functionality is available for most modern desktop browsers and would similarly benefit users of smartphone browsers.

How to save on your data plan using MobileMe: Jeremy Gilbert ran a series of experiments with a packet sniffer on his iPhone to determine which configuration settings would result in the smallest amount of data transferred for messaging and synchronization. His interest stems from an upcoming trip to Africa where he is very concerned about data roaming charges. Vendors of smartphone operating systems have a long way to go both in reducing data usage and providing better tools and information to help users monitor and reduce their data usage when roaming.

Related posts


Link roundup for 8/10/07 Smartphone Browser Shootout: Palm, BlackBerry, HTC Vs. iPhone: An article by David DeJean at InformationWeek. The author describes a series of tests of various ...

Link roundup for 2/8/08 Email Standards Project Acid Test | Email Standards Project: this is a test inspired by the Web Standards Project (WaSP) Acid tests that are widely used to gaug ...

Video Showing Growth of a Mobile Internet Service Robin Jewsbury of Refresh Mobile posted a video showing the growth of their content sharing service EyeMags according to their Google Analytics data. The Mobile ...

DoxPara Research: Is the personal blog of Dan Kaminsky, the researcher who discovered the DNS flaw. His posts are a good source of information for following the effects of the flaw, additional vulnerabilities, and current mitigation strategies.

Kaminsky Details DNS Flaw at Black Hat Talk: Brian Krebs summarizes Dan Kaminsky’s long awaited Black Hat talk describing the widely discussed DNS vulnerability and the status of patching existing vulnerable installations worldwide.

Patch for Internet Security Hole May Not Do the Job: John Markoff at the New York Times describes Evgeniy Polyakov’s new attack which can result in DNS cache poisoning on a fully patched BIND installation in less than 10 hours using two off the shelf computers and a gigabit ethernet link.

KaminskyDNS - Clarified Networks: Two videos produced by Clarified one on the progress of DNS Repair Visualisation (first published at Black Hat 2008) and the other Kaminsky DNS Vulnerability View in Clarified Analyzer. High definition versions are available as well.

Related posts


Link roundup for 8/20/08 The 3 Loops of Designing for Audience: Gregor Hochmuth has a nice write up on the loops of audience interaction for engaging your audience in modern social web ...

Link roundup for new OpenID uses and problems ongoing - OpenID at Work: Tim Bray writes about Sun's recently announced internal OpenID service. Sun is now offering an OpenID provider, but only for Sun emplo ...

Google Releases Web-based Chat Module Today Google released a Flash based Google Talk gadget. Overall the user experience is smooth and the tabs for individual chats are handled well. Links from You ...

The Fifth Conference on Email and Anti-Spam (CEAS 2008) is less than two weeks away. The conference includes presentations and papers from both academic and industrial researchers. CEAD is one of the only events focused on messaging research. The conference has been uniformly high quality in previous years and all papers from previous events are publicly available.

Session topics from this year’s conference include: filtering techniques, trusted friends, sending spam, email usage and applications, filtering and evaluation, and black and whitelisting.

Keynotes feature Lois Greisman of the Federal Trade Commission and
Bradley Taylor of Google’s anti-spam team.

The CEAS Spam Filtering Challenge live data stream ended today. Selected participants of the challenge will present at the conference.

The conference will be held from August 21st - 22nd, 2008 at Microsoft Research Silicon Valley in Mountain View, California.

Related posts


CEAS 2007 Live Spam Challenge The Conference on Email and Anti-Spam (CEAS) invites participation in the CEAS Live Spam Challenge. Participants will compete in filtering a live 24-hour e-mail ...

Upcoming Research Conferences on Messaging The fifth annual Conference on Email and Anti-Spam (CEAS 2008) will be held August 21-22, 2008 at the Silicon Valley offices of Microsoft Research in Mountain V ...

Link roundup for 11/26/07 12 spam research projects that might make a difference: Network World gives a short description of a dozen research anti-spam research projects from university ...

Link roundup 8/5/08

August 5th, 2008

Bookmarks Are Dead. Long Live Bookmarks: Jeremy Wagstaff writes about the current state of bookmarks and bookmark synchronization tools in his Loose Wire blog. He discusses the latest release of the Delicious service, PersonalBrain, and what these might mean when combined with new services such as Twitter.

iPhone Calendar Syncing: Daring Fireball’s John Gruber writes describes the differences in the iPhone synchronization models between iTunes and MobileMe. He clearly shows tradeoff’s in each choice. Apple will hopefully bring parity to both options in the near future.

Mozilla SSL policy bad for the Web: I agree with Nat Tuck’s sentiment that the way the Mozilla 3 browser handles self-signed SSL certificates is poorly handled. Nat makes the case that there are plenty of valid reasons to use self signed certificates and that these certificates still offer useful eavesdropping protection. The user interface in the latest Mozilla client virtually ensures that non-technical users will assume that a self-signed certificate is completely invalid.

Related posts


Link roundup for 2/29/08 E-mail typosquatting poses leakage threat: an interesting additional problem presented by Oliver Friedrichs at the Black Hat conference. Individuals have regist ...

Link roundup for 8/10/07 Smartphone Browser Shootout: Palm, BlackBerry, HTC Vs. iPhone: An article by David DeJean at InformationWeek. The author describes a series of tests of various ...

Link roundup for 5/1/08 Struggling to Evade the E-Mail Tsunami: Randall Stross at the New York Times writes a refreshingly entertaining piece on the often overdone topic of email overl ...

Link roundup for 7/31/08

July 31st, 2008

Purging Public E-Mails: When to Say No: ABC News discusses a number of the recent cases where government officials ordered the deletion of official emails and their backups. The article also describes the great inconsistencies between various states and agencies in archiving and retention policies.

Xobni Can Make Good Old Email Even More Useful: In his Personal Technology column at the Wall Street Journal, Walt Mossberg gives the Xobni Outlook plugin high marks for improving search, navigation and weaving in addition useful information. There have been a number Outlook plugins over the years that extend search and construct network information. Xobni clearly does a good job with integration so it will be interesting to see if the product is broadly adopted.

MultiFirefox 2.0 : This is a useful utility from from Code Contortionist for web developers on the Mac. It allows users to easily switch between multiple versions of Firefox, which is makes life easier when testing compatibility across browsers or when beta testing new browsers.

Related posts


Link roundup for 1/7/08 Shelf - Context for MacOS - jerakeen.org: the software is still in proof-of-concept stage, but the idea is promising. Shelf runs in the background and polls the ...

Link roundup for 1/14/08 Official Gmail Blog: Create personal mailing lists through contact manager: Google has added a simple group alias feature (not really a mailing list) to the new ...

New Pew Report — A Typology of Information and Communication Technology Users In their latest report, "A Typology of Information and Communication Technology Users", the Pew Internet & American Life Project classified American's by th ...

Email Hacking Going Commercial: Dancho Danchev writes on his blog about a commercial service that uses a software package with a collection of security vulnerabilities (many are Cross Site Scripting/XSS attacks) combined with a network of contractors, a validation service, and several payment options all wrapped up in a single commercial service. This is yet another example of why XSS attacks and CAPTCHA failures are such a big problem.

How to break CAPTCHAs: Blackhat SEO covers a compendium of articles, talks, and writeups on CAPTCHA vulnerabilities and attacks. It is clear that much of the web’s CAPTCHA infrastructure is rapidly fraying. It’s increasingly difficult to build CAPTCHAs that are secure enough from automated attacks, but that do not result in large number of failures for normal people.

Cell Phone Spying: Is Your Life Being Monitored?: Geeks are Sexy has a post on commercial remote call monitoring and tracking options (many of which are legal only under specific circumstances) for mobile phones. The article covers both World Tracker and Flexispy.

Related posts


Link roundup for 10/15/07 How 2 Guys' Iowa Connection Took Big Telecoms for a Ride - WSJ.com: The Wall Street Journal describes the history and explains how freeconferencecall.com exploi ...

GrandCentral Mobile Access GrandCentral Mobile launched earlier this week. GrandCentral provides a single phone number for managing a set of phone services. The services has VoIP services ...

Link Roundup on Identity Management 4/13/08 Understanding CardSpace | : As part of his Perspectives series, Jon Udell interviews Vittorio Bertocci, the author of Understanding Windows CardSpace. The inter ...


Home | White Papers | Privacy Practices | Contact Us

Copyright © 2008, Messaging News, Inc. All Rights Reserved.