On Message with Ben Gross

Using a Plus to Simplify International Dialing

When I travel out of the country, I usually test out new VoIP services both for calling back to the states and receiving calls while I am traveling. I consistently find that while the rates for VoIP services are very attractive the usability and flexibility leaves a lot to be desired when I am on the road, particularly when no network connection is available.

Depending on the length of my stay, I purchase a prepaid SIM to use in a spare unlocked mobile phone so that I can make and receive local calls at local rates. Since most countries outside of the US offer free inbound calls, having a local SIM is even more attractive although navigating voicemail prompts in another language can be challenging. I often use on of the VoIP services to forward a US number to my international cell phone number so that I can let friends and family reach me without incurring international charges on their part. Rates for calling international mobile phones range from $0.15 to $0.30 a minute so be careful who you give your forwarded number to if you try this method.

Calling from multiple devices and multiple services is where plus dialing standard becomes important. People who make regular calls overseas from a mobile phone or a VoIP service will likely be acquainted plus dialing. However, I find that there is quite a bit of confusion about what plus dialing is and how it works from people who have only called internationally using landline phones. For those interested in the gory details, the official specification dialing using the international prefix symbol (commonly known as a plus) is the ITU specification E.123 : Notation for national and international telephone numbers, e-mail addresses and Web addresses

If you want to dial a phone number in another country using a standard landline phone, you need to dial an additional set of digits. Lets pick an imaginary number in the Netherlands 011 31 20 00012345 as an example. The breakdown for this number follows: The international dialing prefix is 011 for the US, The country code for the Netherlands is 31, the city code for Amsterdam is 20, and the remainder is the local number. We are now used to dialing ten digits for long distance call in the US. For example, (415) 555 1212 (country code, area code, local prefix, last four digits).

The problem is that the number you call depends on what country you are calling from. Dialing the same number in the Amsterdam from Brussles would require a different a slightly different number 00 31 20 00012345. Also, in many countries there is a local digit added to the numbers for in country dialing, so the number might look like this 31 0 20 00012345.

Plus dialing is a more straightforward option for mobile phones, VoIP phones, and newer business phones. With plus dialing the phone network can assume that the number is a complete international number and treats the same way no matter what country you are in when you dial the number. The one constraint is that your phone must me able to dial a plus.

Under the new system, you dial a plus, the country code, city code, and then the local number. For example, +31 20 00012345 as opposed to 011 31 20 00012345 or 31 0 20 00012345. Dialing a US number would take the form of +1 415 555 1212 . The nice thing is that once you have your numbers in plus dialing format you don’t have to worry about variations when you travel. You can dial the same number from your cell phone and a VoIP call such as from Skype. Most cell phones can dial using a plus sign, although you might have to search for the correct key combination. Most landline phones do not have the ability to dial a plus.

I normalized my entire address book so that all numbers are internationalized. This way no matter what system I use to dial (cell, VoIP, etc) it will be correct for wherever I am. I synchronize my address book with my mobile phone and use the same address book for dialing with any VoIP services so I only need to store and use one form of the phone number. I will talk more about cleaning and synchronizing address books in a future article.

A Better Way to Share Links in Email

I regularly share links with friends and colleagues. I use several social bookmarking services, but the vast majority I share via email. Firefox, Safari, and Internet Explorer have a function to create a new message with an email link. The main disadvantage of sending links using the built-in browser methods is that the links they generate are prone to breaking unless the whole message is converted to HTML rather than plain text.

I prefer a bookmarklet for emailing links. Bookmarklets are bits of JavaScript saved into a bookmark that act like simple browser plugins. BetterExplained’s How To Make a Bookmarklet For Your Web Application is an excellent introduction. Opera and Google Chrome browsers do not currently offer functionality for emailing a link, so a bookmarklet is your only option. My version of the bookmarklet has a few improvements over the built-in browser methods, extensions, and other similar bookmarklets I’ve seen. Previously, I constantly made minor adjustments when emailing URLs to reduce the chances that the link would work correctly for the recipient. The new version of the bookmarklet has improved my workflow for sharing links.

The bookmarklet:

    javascript: function trim12(str)
    {
        var str=str.replace(/^\s\s*/,''),
            ws=/\s/,
            i=str.length;
        while(ws.test(str.charAt(--i)));
        return str.slice(0,i+1);
    }
    location.href='mailto:?SUBJECT='+encodeURIComponent(trim12(document.title))
    +'&BODY='+encodeURIComponent(trim12(document.title))
    +encodeURIComponent('\n<'+location.href+'>')

To use this bookmarklet yourself, simply drag the following link to the bookmark bar in your browser. [Email link]

The most common way that browsers implement the email a link feature is to create a new email message with the document title in the subject and the link in the body. Most email clients will recognize these links as URLs and turn them into clickable links that you can open in your browser. There are several problems with the built in methods for emailing links.

  • The first problem is that the algorithms that recognize the URLs do not always recognize valid URLs or may only partially recognize the URL leaving the recipient with a broken link. In these cases you have to copy the URL from your email client and paste it into your browser. Certainly not a difficult or time-consuming task, but every bit of additional effort reduces that chance that the recipient will click on the link

  • The second problem is that if a URL is long the email client may wrap the line with the URL. There are several ways that email clients wrap long lines and conflicts arise periodically between different email client line wrapping styles. When links with URLs are wrapped this creates additional complexity for the receiving email client to correctly parse the URL and increases the chance of failure. Dan’s Mail Format Site has a nice description of the URL wrapping issues in his Body: Line Length article.

  • The third problem is that some web pages include additional whitespace in the document title to visually offset the text. The extra whitespace is not desirable when mailing the link as it can make the title line less readable and add unwanted blank lines before the URL.

Safari, works around the first two problems by creating a rich text/HTML email message and turns the URL into a real hypertext link. Safari and Internet Explorer both have the option to email an entire webpage. In this case, the browser simply copies the HTML from the webpage into an email message. This method solves the problems of URLs being incorrectly recognized or poorly wrapped, as the recipient’s email client does not need to parse the text to discover the link. I generally avoid emailing entire web pages as most mail clients parse a very restrictive subset of HTML to reduce security vulnerabilities and the page formatting may not appear as intended.

Most bookmarklets I have seen to email a link mirror the built-in browser functionality and thus have the same problems. Bookmarklets often have an additional problem where ampersands and other meta characters are not properly escaped and may cause the bookmarklet to fail or truncate the titles.

My modified bookmarklet presented above includes the document title in subject and the document title, a carriage return, and the URL in the body. The URL is wrapped in angle brackets < >, which most allows the majority of email clients to correctly interpret complex and wrapped URLs. The World Wide Web Consortium (W3C) recommends this method in Wrappers for URIs in plain text as does RFC2396 Uniform Resource Identifiers (URI): Generic Syntax, the specification that defines the modern URL. Finally, I use the JavaScript function encodeURIComponent to protect page titles from ampersands and other characters breaking them. The \n version of the escaped newline character must be used as opposed to %0A. In later revisions of my bookmarklet, I included trim12 from Steven Levithan’s Faster JavaScript Trim, which will trim excess whitespace from the document title so that the subject line is not surrounded by spaces and there are no blank lines before the URL.

The bookmarklet relies on the browser’s default mailto: handler to determine which email application should be used to creat the message with the link. Each browser and operating system has multiple ways to set the mailto: handler. Changing the default mailto: handler is generally straightforward for most desktop email clients, but can be more complicated for webmail clients such as Gmail and Yahoo! Mail. Here are a few options to start with. Changes in Firefox 3.5 greatly simplified the procedure for changing the e-mail program used by Firefox. The Affixa application is a simple way to change the mailto: handler for Windows users to set popular desktop clients, Gmail and Yahoo! Mail as the default handler. The Internet Options settings for Internet Explorer make it straightforward to change the default to desktop another application or Windows Live Hotmail. Clint Talbert’s page Click Testing for Protocol Handling is a quick and easy way to test if your mailto: handler is working correctly.

Updated August 2nd, 2009 to add trim code and including information on mailto: protocol handlers. Fixed problem with CMS HTML corrector breaking bookmarklet code.

Trends in Password Masking Security and Usability

John Gruber’s Daring Fireball pointed me to Jakob Nielsen’s Alertbox column Stop Password Masking, which resulted in a thoughtful and interesting thread of conversations and a few experimental solutions. Password masking refers to the practice of displaying an alternate character, usually a star or a bullet in place of the actual characters typed into a password field. The idea is that this prevents another party from viewing the password while it is entered. Nielsen argues that in most cases masked passwords are not needed since should surfing is not a major issue and that this is even less of an issue on mobile devices. He says masked passed passwords often reduce usability by increasing the number of errors since users cannot see what they are typing. This problem is further compounded on mobile devices where typing is more difficult and slower. Since users are less certain about what they are typing, they are much more likely to choose passwords that are simplistic or copy and paste the passwords from less secure locations. Nielsen says that high value password forms should offer an optional checkbox for masking passwords so that they can be used on an as needed basis.

Jason Montgomery’s Response to Nielsen’s “Stop Password Masking” on the SANS Institute’s The Application Security Street Fighter Blog that provides a more nuanced commentary on the tradeoffs between security and usability for password masking. Montgomery argues that Nielsen’s points are valid and suggests that password managers, pass phrases, and two factor authentication can sidestep some the problems by increasing the security of stored passwords as well as the ease of recalling them. Earlier I reviewed, 1Password, a password manager for Mac and iPhone that I use daily.

Bruce Schneier, a respected security expert, agreed with Nielsen in his brief response, The Problem with Password Masking. His post generated a large number of comments, which caused Schneier to temper his opinion in a later article The Pros and Cons of Password Masking. Schneier concludes that even though there are significant downsides to password masking, the practice is less problematic than either not masking passwords at all or complicating the interface with an optional password masking checkbox. The second article also generated a thoughtful discussion in the comments. In Strong Web Passwords, Schneier summarizes the Usenix HotSec07 article Do Strong Web Passwords Accomplish Anything? by Florencio, Herley, and Coskun, which argues that complex passwords do little to increase security when adequate policies are in place to limit the number of password attempts. Schneier suggests that the password masking feature on BlackBerries with SureType (non-QWERTY) keyboards and the iPhone (see: iPhone 2.0 password masking) that shows the current character and masks all previous characters is a reasonable alternative.

Farhad Manjoo’s Slate Magazine column, Fix your terrible, insecure passwords in five minutes, offers a solid set of suggestions for creating better passwords and describes why this is important in light of the recent Twitter break in. Macworld’s Joe Kissell offers his own set of suggestions for creating better passwords in a series of articles listed in Top password tips

The ongoing discussion led several developers to create prototypes that demonstrate password masking techniques. Each implementation has an online demo and source code publicly available. All prototypes are currently written in jQuery.

  • Stefan Ullrich’s iPhone-like password fields using jQuery and Oliver Storm’s Mypass each implements a password masking field similar to the iPhone and BlackBerries with SureType that displays the current typed character, but masks all previous characters by replacing them with bullets.

  • Byron Rode’s showPassword is a jQuery plugin that implements a password entry field that defaults to fully masking the password with bullets, but also includes Nielsen’s proposed checkbox to display the password when requested.

  • arc90 created two experimental password masking implementations. The first, HalfMask creates a masking effect by placing translucent random characters on top of the original password characters. This allows the person entering the password to view the original, with some concentration, but makes it far more difficult for another person to casually observe the password. The second implementation, HashMask, masks the password in a standard way by replacing each character typed with a bullet, but adds a visual representation of the password in the form of a Sparklines. This way the person entering the password has a visual indication that the password is correct, although they need to remember the Sparkline.

  • Mattt Thompson’s Chroma-Hash was inspired by arc90’s HashMask and masks passwords in the standard way, but adds a visualization of the password as it is typed using colored bars generated from a hash of the password. This allows users to quickly check that the visual representation is correct before entering submit. It has the side benefit of allowing fast comparisons when password confirmations are required for entering new or changed passwords. Lee Gao created pyChroma, a Chroma-Hash implementation in Python, which has source, but unfortunately no online demo.

Finally, Kevin Vigneault describes considers several other related options in his post Confirming Passwords Is Annoying: Is There a Better Way?, which was a result of a thread on IxDA “Confirm password” field - Superfluous? that appeared several months before Nielsen’s column.

Article updated July 31st, 2009 to add additional references.

Pingdom Free Accounts Work With iPhone Application

Pingdom is an uptime monitoring service that can notify you via email or SMS when your web server, mail server, or another services goes offline. The service offers reports that are useful for tracking availability, response time, and errors for your servers over time. I have recommended the Pingdom service in the past. See Review of the Pingdom uptime monitoring service The basic package is $10 a month and comes with five service checks, 20 SMS alerts, and unlimited email alerts. The business package is $40 a month and comes with 30 service checks, 200 SMS alerts, discounts on additional SMS alerts, and unlimited email alerts. Additional checks are $6 a year each and additional SMS messages are available for $0.45/basic and $0.20/business.

Yesterday, Pingdom announced that it would begin to offer a free account that comes with one service check and 20 SMS messages. Additional SMS messages are available for $0.45 each, although additional checks are not. Currently, the free account has all the same features as the paid account including checks down to one-minute resolution. The only constrain is that you must log into your free account every ninety days to keep it active. There are many uptime monitoring services that have free accounts for a single service, but I have been a Pingdom customer for over a year now and have been very happy with the service and regularly recommend it. The pricing of the service is geared towards business users and I suspect many individuals will be happy with the free account.

The Pingdom released a free iPhone application in January. I tested the iPhone application with a free account and it worked the same as a paid account. The Pingdom mobile application is currently very basic, but can be useful if you want to quickly look at the status of your services and the uptime and response time for each service for the last 30 days. The application will also show you information about each check. It is not possible to see longer-term trends, details on errors, or to make any changes on your services. Hopefully, Pingdom will add features to the mobile application in future releases. If the service took advantage of Apple’s push notification for iPhones it could remove the need to SMS alerts for users with iPhones.

New and noteworthy for 6/24/09

Email patterns can predict impending doom: Jim Giles at the New Scientist describes recently published research from the Florida Institute of Technology in Melbourne based on an analysis of the Enron email corpus relating to the downfall of the Enron corporation. The paper’s authors found that the number independent communication cliques where communication was not shared with outsiders rose sharply as the the company began to collapse. The authors theorize that this was an indication of the stress building in the company.

Email Address Length FAQ: The Extra Pair of Hands blog has a useful summary of the real world limitations on email address length. The FAQ provides a number of examples of limits address lengths in existing systems and the practicalities of memory allocation. The author suggests best practices for constructing email records in databases.

Iran’s Web Spying Aided By Western Technology: Christopher Rhoads and Loretta Chao from the Wall Street Journal report that the infrastructure used by the Iranian government to monitor, filter, and block access to the internet was purchased from European companies.

New and noteworthy for 6/23/09

Anatomy of a Blog Post Well Received: Marshall Kirkpatrick from ReadWriteWeb has a nice piece investigating the details of the sources of traffic for a popular blog posting. Twitter, PopURLs, and Delicious were the three biggest. His post is a clear indication of why good analytics are so useful as they allowed ReadWriteWeb to determine which traffic sources are important and which aspects such as time of day of the post and transmission from one source to another influence post popularity.

Bottom-up collaboration in the construction industry: Bob Leung of Woobius describes the principles he found most important while he was developing a bottom-up collaboration system. They are: 1) allow anyone to initiate collaboration, 2) respect the reality of collaborative trust, and 3) allow people to make mistakes. He argues that all collaboration systems must compete with email since it is ubiquitous.

Promoting your product or service with banner ads - is it worth it?: David Greiner at Campaign Monitor blog has a great post describing the phases of evaluating a banner ad campaign. This is an excellent writeup of a real world ad campaign that includes their analytics strategy and statistics on conversions.

New and noteworthy open source email implementations

New SMTP implementations are often error prone and take a long time to mature. That said, the following two new SMTP server implementations are innovative and worth following as they develop.

LamsonProject: Lamson The Python SMTP Server: Zed Shaw has a new SMTP server written in pure Python. The server is intended as a framework for other email-based applications in the flavor of a web application stack. Lamson currently works as a SMTP server, a, mail proxy, a mail relay and is able to use most relational databases as a backend-store.

Developer Blog - gilles@ on smtpd: Last year, Gilles Chehade began working on a new smtpd implementation for OpenBSD. One interesting aspect of the project is that its configuration files use a clean readable syntax similar to that of the PF firewall. The OpenBSD project has a long history of rewriting core system components that become popular in their own right. OpenSSH and PF are notable examples.

RFC-compliant email address validator: It is well known that many email address validation routines do not accept the full range of valid email addresses. This can be maddening for people with addresses that fall outside of this range. Dominic Sayers posted a PHP email address validator that is RFC-compliant.

New and noteworthy for 6/9/09

DKIM for Discussion Lists: J.D. Falk has written a nice practical overview of using DKIM with mailing lists on the CircleID blog. He says that he hopes his description will help dispel the myth that DKIM and mailing lists are incompatible. Not everyone agrees with recipe Falk posted and links in the comments point to a more involved discussion.

Firefox and more: historical view of browser usage: Asa Dotzler of Mozilla posted a graph with browser penetration of the most popular web browsers from October 2004 to the present. The graph draws on data from Net Applications and list growth rates for IE, Firefox, Safari, and Chrome.

On the Street and On Facebook: The Homeless Stay Wired: Phred Dvorak writes about internet-connected homeless in San Francisco for The Wall Street Journal. Internet connectivity is nearly required for a modern connection to society and the interviews describe the lengths people go through to obtain access to computers, network connectivity, and power for laptops.

New and Noteworthy in WiFi for 6/8/09

Skyhook Lets Wi-Fi Signals Take the Place of GPS: Jenna Wortham’s article on Skyhook Wireless for The New York Times talks about the history, present, and future of Skyhook’s geolocation service which provides position data using WiFi access points rather than GPS or cellular tower triangulation. Skyhook’s service is now used to provide location data for Apple’s iPhone, the Firefox browser, and Eye-Fi camera cards.

HotelChatter’s Annual Hotel WiFi Report 2009: This annual report from HotelChatter is useful as a list of hotels with free WiFi. The summary is that budget hotels typically offer free WiFi and upscale hotels often charge day rates, although many are beginning to do away with this fee. The problem is that the list is solely based on price, there is no information about the quality of the connection such as security, bandwidth, what ports are blocked, or if there are overly aggressive filters.

The Devicescape Wi-Fi Report: Research on Usage and Trends: Devicescape developes consumer software that makes it easier to connect to WiFi access points. Some findings from the report included that the iPhone was the number one device used to connect to WiFi, that more than ninety percent of users want access to WiFi when they are traveling, and that more than half of the users were willing to pay for WiFi. The number one WiFi annoyance reported was complicated WiFi login screens. The surveyed population is comprised of Devicescape’s users so the results are naturally biased towards that population.

New and noteworthy in mobile for 5/25/09

Why text messages are limited to 160 characters: Mark Milian at the Los Angeles Times has written a brief and entertaining overview of how the Short Message Service (SMS) came be to the standard for mobile to mobile messaging and why the messages are limited to 160 characters. The length was originally determined in a decidedly non-scientific manner by the head of the non-voice services portion of the GSM standards committee and has stayed with us ever since.

Report: Mobile Website Performance Getting Worse: ReadWriteWeb’s Richard MacManus covers the recent report from Gomez and dotMobi analyzing the performance of mobile sites in the airline, banking, and search industries. The data show that overall from March to April the performance of mobile web sites has gotten worse. The report scores each site on five metrics: discoverability (how easy it is to find), readiness (how easy it is to read) , availability (how reliable it is), response time (speed), and consistency (how consistently the site performs in different times and locations). The data from the report is interesting, but it unfortunately does not include either Google or Facebook leaving much to be desired in the search category.

Why Does The CDC Have Better Data On Mobile Penetration Than The FCC?: Mike Masnick at Techdirt points out the absurdity that National Center for Health Statistics (NCHS) at Centers for Disease Control (CDC) has collected more accurate data on mobile phone penetration than the Federal Communications Commission (FCC). The CDC’s wireless data are a byproduct of the agency recognizing that it was missing crucial portions of the population it was trying to survey. The CDC then began to gather data on mobile phone use in households to be able to better target its public health surveys.