I tried out Noom, the weight loss and cognitive behavioral therapy program. The app is more like CBT for upselling customers than CBT for weight loss. Now I’m hoping they’ll delete my sensitive medical data and refund the $3 they tricked me out of. (They did, quickly in response to my support email.)

I was excited to try Noom. I’ve used basic calorie counters in the past and was hoping for something better. I’m also curious about CBT. And a friend recommended it.

The account creation process goes OK at first. Then it gets more and more involved, taking 10–20 minutes to fill out the questions. There’s little UI tricks to keep you engaged: fake progress bars, questions injected at random intervals. Classic product UI hacking.

At first it told me that I’d reach my weight goal in about a year. Seemed reasonable! Then it kept shaving weeks off that as I answered questions, like I was making progress already. The conclusion it came to is that I was going to lose 18 pounds in the first month. Pretty sure that’s not possible, certainly not healthy.

Then the upselling begins. They ask some questions to find out your interests and then offer premium packages. “Folks who pay for this package lose 35% more weight” Look, I just want to try the basic thing.

It looks like a 7 day free trial but before you know it they want you to pay asserting “it costs $10 to offer a 7 day trial”. Really? They gave me a choice of what to pay from $0.50 to $18.83. I chose $3 and had to pay via PayPal / credit card; super sus they don’t just use Google Pay on the Android app.

They also try to get you to sign up your friends. They talk about how having folks involved in your program will make you more successful. Which is probably true but then immediately they’re asking for email addresses and offering discounts and gift certificates. It’s marketing, not therapy.

The whole thing was so sleazy and deceptive. Particularly for a therapy-like product. Real therapists have all sorts of ethical guidelines to stop them from exploiting their customers. Noom instead seems to be using CBT to trick customers into paying more. Gross, gross, gross.

My Starlink Internet service has gotten pretty bad; every evening I’m well under 50Mbps and some hours I only get 2Mbps. (Compare 100Mbps+ last year.) I’ve given up trying to stream 1080p video at night; that’s a pretty dismal result for a new Internet service in 2022.

Starlink imposed major restrictions on US customers last month: 1 TB / month data cap and expected download speeds dropped from 50-200Mbps to 20-100Mbps. Details of all that on my secret blog. Note they didn’t drop the price, we’re still paying $110/month.

Maybe the new caps will help the congestion? I’m sympathetic to their technical problem. They have limited bandwidth and they have to share it somehow. Caps are an awkward solution; most users have no idea how much bandwidth they are using or why and thus can’t control it. Starlink’s caps are nice in that if you exceed the cap you just get lowered in priority, not charged money or cut off. So maybe it’ll be self regulating.

My real fear is that instead of improving service the result of all this is Starlink is just going to add even more customers to an already overloaded network.

Starlink is oversold in North America. I've had the service since March 2021 and it's mostly great. But every evening it slows down. On bad nights I can't watch a single 1080p video stream reliably. Over half of Starlink customers report problems. Starlink's speed test app now admits "the network may be affected by slower speeds during busy hours". As if that were OK.

Overselling capacity is a common problem with American ISPs. More customers means more revenue and if customers get a crappy experience? Too bad, there's no regulation to stop them. Starlink has a serious financial challenge so of course they have an incentive to oversell. And service quality is likely to keep getting worse. Their user growth is accelerating and the new RV service means literally anyone can buy a dish now without waiting (albeit at a lower service tier.) They are adding capacity but their growth plan hinges on the troubled Starship launch vehicle.

Customers were promised better. Starlink was advertised as offering 100-200Mbps and 20ms latency; their legalese description promises 50-250Mbps / 20-40ms. My reality is speeds drop to 10-20Mbps every evening. Upload speeds are tiny, often well below 5Mbps. 20ms latency is a fantasy; 50ms is typical. And capacity is highly variable minute by minute, a technical challenge for rate limiting protocols.

The US government is giving Starlink $900M to sell rural Americans 100Mbps download / 20Mbps upload. But Starlink is delivering just a tenth of that download speed during peak hours and nowhere near that upload speed ever. I hope the FCC RDOF contract includes measured performance targets.

I am still grateful for Starlink, it's significantly better than anything else I can get in Grass Valley, CA. But they're making a business decision that's bad for customers. It's a reminder of how important it is to have Internet competition. Investing in wired infrastructure is as important as ever.

Goodreads lost my entire account last week. Nine years as a user, some 600 books and 250 carefully written reviews all deleted and unrecoverable. Their support has not been helpful. In 35 years of being online I've never encountered a company with such callous disregard for their users' data. Update: Goodreads gave me a recovered copy of my data

Do you use Goodreads? Don't trust them with your data. Protect yourself with a backup; use their data export service right now. Consider quitting Goodreads entirely. LibraryThing and The StoryGraph are promising competitors. This blog post also has some ideas on DIY indieweb alternatives.

Don't trust any cloud service with the only copy of your data. Most companies are not quite so reckless but consider what you'd miss if an uncaring company lost your data. Many of the better services have data export products; Google Takeout is fantastic, Twitter has good export, as does Facebook and Instagram and Letterboxd and others.

I've enjoyed using a product like Goodreads. My plan now is to host my own blog-like collection of all my reading notes like Tom does. It will be a lot of work to set up. Fortunately not all is lost, I happened to take a data export last July and I can recover some of the more recent data from emails they sent to my friends. It's a shame they block Archive.org.

For anyone wondering how Goodreads could have simply lost all my data, I'm wondering too! It bespeaks contempt for users. And terrible system design, services should not be able to lose data irrecoverably. The specific bug is related to my removing Twitter API access to Goodreads last week (they stopped supporting Twitter login months before). Somehow that triggered their system to delete everything. Goodreads promises me it was a true delete, the data is wiped from their database. I don't believe this: sites generally flag data as deleted, they don't actually remove it. Goodreads also ignored my request to restore my data from backup. Either they don't have backups or they can't be bothered.

I've learned a hard lesson in trusting cloud services. Unfortunately just having a copy of your data isn't enough; it's a lot of work to build a useful product. In the meantime I will be more careful about which companies I trust. Goodreads has been in decline ever since Amazon bought them in 2013. Apparently an anti-competitive purchase, not a strategic acquisition.

I felt physically ill reading this story about Facebook’s facilitation of murder and slavery.

... reports from employees who are studying the use of Facebook around the world, including human exploitation and other abuses of the platform. They write about their embarrassment and frustration, citing decisions that allow users to post videos of murders, incitements to violence, government threats against pro-democracy campaigners and advertisements for human trafficking.

There’s been plenty of stories about Facebook’s malfeasance over the years. Two things make this story particularly awful. One is the human scale of the harm they cause. It’s not some abstract discussion about political influence, it’s personal examples like a woman named Patricia being recruited and sold into slavery. The other is that Facebook knows about the problems and is choosing not to act. Or at least not act enough to be meaningful.

Facebook treats harm in developing countries as “simply the cost of doing business” in those places.

I had enough. I rage quit Facebook Thursday. Or at least tried to.

The problem is I’m a captive of Facebook. Because despite all the horrors it’s still a good semi-private way to keep in touch with people. It’s my primary social connection to the small gay community in Nevada County, for instance, including a group that organizes weekly meetups. Also it’s helped me reconnect with old high school friends. I’m well aware of the hundreds of other social media tools I could ask them to use, I helped design some of them. But the reality is that a lot of community happens on Facebook and if you don’t participate there, you miss out.

I don’t know what I’m going to do with Facebook. I was going to delete my account but feel I can’t. I’m trying to stay logged out but I already feel the need to connect occasionally, even if only to arrange social connections outside of Facebook. I’m one of those extremely online people, I can’t just disconnect entirely. But I’m being forced to visit the house of a psychopath.

This story this week is one in a series of investigative articles by the WSJ. Some Facebook employees have been trying to lessen the harm their company is doing and they’re tired of being ignored. So they’re talking to reporters, particularly Jeff Horwitz. As a collection the reporting is incredibly damning. Lying to their oversight board, ignoring mental harm to young women, amplifying anger and lies, sabotaging American vaccination efforts, and helping the business of murderers and slavers.

Facebook is in some ways just reflecting the larger evils of society. I’ve worked on social media policy. I understand the difficulty of moderating conversations. But as a medium Facebook is a very efficient amplifier of evil; its existence uniquely enables things like the genocide of the Rohingya. That creates an obligation on Facebook to mitigate the harmful uses of their product. They have failed to that. Maybe the only remedy is to stop them from operating.

PS: the WSJ has a strong paywall. There are accessible copies of the specific story I reference here and here. The Firefox extension Bypass Paywalls Clean can help you read the WSJ and other sources.

It’s property tax time. So I went to the SF treasury website to pay my tax bill. And got an SSL certificate error from Firefox.

Oops the cert expired a year ago and is for the wrong domain. I get it, government web sites are often underfunded and don’t work well. Maybe they didn’t know how big a problem this presents in modern browsers that are enforcing SSL security. So I wrote a polite note to support. And got this response from the San Francisco 311 Customer Service Center.

Please use the right protocol to access our website. Please use http://sftreasurer.org instead of https://…

OK then…

The Internet mostly survived the leap second two days ago. I’ve seen three confirmed problems. Cloudflare DNS had degraded service; they have an excellent postmortem. Some Cisco routers crashed. And about 10% of NTP pool servers failed to process the leap second correctly.

We’ve had a leap second roughly every two years. They often cause havoc. The big problem was in 2012 when a bunch of Java and MySQL servers died because of a Linux kernel bug. Linux kernels died in 2009 too. There are presumably a lot of smaller user application failures too, most unnoticed. Leap second bugs will keep reoccurring. Partly because no one thinks to test their systems carefully against weird and rare events. But also time is complicated.

Cloudflare blamed a bug in their code that assumed time never runs backwards. But the real problem is POSIX defines a day as containing exactly 86,400 seconds. But every 700 days or so that’s not true and a lot of systems jump time backwards one second to squeeze in the leap second. Time shouldn’t run backwards in a leap second, it’s just a bad kludge. There are some other options available, like the leap smear used by Google. The drawback is your clock is off by as much as 500ms during that day.

The NTP pool problem is particularly galling; NTP is a service whose sole purpose is telling time. Some of the pool servers are running openntpd which does not handle leap seconds. IMHO those servers aren’t suitable for public use. Not clear what else went wrong but leap second handling has been awkward for years and isn’t getting better.

I ran into an awkward problem in Europe; I couldn’t get SMS messages. It’s a design flaw in Apple’s handling of text messages, its favoring of iMessage over SMS. If you turn data roaming off on your phone when travelling, you may not be able to get text messages reliably.

If you have an iPhone suitably logged in to Apple’s cloud services, other iPhones (and Apple stuff in general) will prefer to deliver text messages via iMessage instead of SMS. You see this in the phone UI: the messages are blue, not green. In general iMessage is a good thing. It’s cheaper and has more features.

The problem is Apple’s iMessage delivery requires the receiving phone have an Internet connection via WiFi or cellular data. If you have no WiFi at the moment and have data roaming turned off, your phone is offline. And so Apple can’t deliver to you via iMessage. They seem to buffer sent messages for when you come back online. Which is too bad, because your phone could still receive the message via SMS. Unfortunately iMessage doesn’t have an SMS delivery fallback.

In practice this design flaw meant I had to leave data roaming turned on all the time because I needed to reliably get messages from another iPhone user. Which then cost me about $30 in uncontrollable data fees from “System Services”. Some $15 was spent by Google Photos spamming location lookups (a bug?), another $15 receiving some photo iMessages from a well-meaning friend. Admittedly the SMS fallback I’d prefer would also cost some money, but I think significantly less in my case.

There’s a broader problem with iMessage which is that once a phone number is registered with it, iPhones forever more will not send SMS to that number. Apple got sued over this, so now they have a way to deregister your number.

The world has had its first self-driving car fatality: a Tesla autopilot failed. So far the world hasn’t freaked out. I think self-driving cars will be way safer than human-driven cars. But there’s a lot of shaping the truth in Tesla’s announcement.

(Fair warning: this blog post is uninformed hot take territory. I’m reacting to Tesla’s description of the crash, published two months after the death. We’ll know a lot more after an independent investigation.)

Tesla’s press release is masterful. It characterizes the cause of the accident like this:

the vehicle was on a divided highway with Autopilot engaged when a tractor trailer drove across the highway perpendicular to the Model S. Neither Autopilot nor the driver noticed the white side of the tractor trailer against a brightly lit sky, so the brake was not applied.

A truck pulled out in front of the car on the highway. It may well have been an unavoidable accident. We’ll know eventually.

But note the facility of claiming the “driver” didn’t notice the truck. How do we know that? The man is dead, we have no idea what he saw. I don’t know about you, but I’ve never once failed to spot a white truck against a bright sky, particularly when I’m driving towards it at 70mph. I could see how a computer vision system would fail that test though.

“The brake was not applied”. It takes time to apply the brakes after you see your death coming at you. Doubly so if you’re not actually driving. The passenger-behind-the-wheel was almost certainly not having his foot hovering gently near the accelerator / brake like an engaged driver would. That slows reaction time. I do this all the time with my simple cruise control and it scares the hell out of me when some slow jerk pulls in front of me and I don’t react quickly.

(I also admire the comfort of “he never saw it coming”. Sort of takes the sting out of the next sentence, which describes the unfortunate’s grisly decapitation.)

The real problem here is Tesla’s autopilot is a half measure, “driver assist”. It doesn’t fully drive the car. This design is the most dangerous of all worlds. I had this experience with my airplane’s autopilot all the time. At some point when the automation does enough work, you can’t help but check out mentally, let the machine take over. But if the machine isn’t capable of taking over entirely you can end up dead.

That’s why I’m in favor of fully autonomous vehicles. No steering wheel, no accelerator, maybe just a single brake or other emergency cutout. Of course in this situation the software has to work reliably. Let’s say a fatality rate of 50% of human drivers. And insurance and the law have to adapt to this shift of control to software. I believe the technology nerds are very close to having systems that can fully drive a car with no “driver assist” ever needed, at least in clear weather. It will be a better future. And those robot cars will kill some of their passengers. Far fewer than humans are killing now.

The Economist infected readers with malware. The vector? PageFair, a technology for web publishers for circumventing ad blockers. The payload was a remote access tool. Goodbye bank accounts!

This is outrageous. I install software on my computer to block ads, a clear statement of user preference. The Economist colludes with PageFair to ignore my choice, to run software on my computer that I explicitly don’t want. That software they run turns out to be installing malware.

The folks who write things like PageFair need to be sued into oblivion. Not just the company; stop the people who built this abusive technology from ever creating software again.

The addition of ad blocking capability to iOS has brought on a lot of hand-wringing about whether it’s ethical to block ads in your web browser. Of course it is! Blocking ads is self preservation.

Ad networks act unethically. They inject huge amounts of garbage making pages load slowly and computers run poorly. They use aggressive display tricks to get between you and the content. Sometimes negligent ad networks serve outright malware. They violate your privacy without informed consent and have rejected a modest opt-out technology. Ad systems are so byzantine that content providers pay third parties to tell them what crap they’re embedding in their own websites.

Advertising itself can be unethical. Ads are mind viruses, tricking your brain into wanting a product or service you would not otherwise desire. Ads are often designed to work subconsciously, sometimes subliminally. Filtering ads out is one way to preserve clarity of thought.

I feel bad for publishers whose only revenue is ads. But they and the ad networks brought it on themselves by escalating ad serving with no thought for consumers. The solution is for the ad industry to rein itself way in, to set some industry standards limiting technologies and display techniques. Perhaps blockers should permit ethical ads, although that leads to conflicts of interest. Right now Internet advertisers are predators and we are the prey. We must do whatever we can to defend ourselves.

The Apple Watch, that fancy new high-tech product, had a XXE vulnerability. That’s a security flaw in XML parsers that dates back to at least 2002. It keeps popping up in new products because apparently safe XML parsing is too hard for anyone to get right.

I love the Internet service I get from Astound, but not so much their online account system. The billing login is pretty screwed up. Things to know:

• The billing credentials are separate from your “Internet Account Manager” credentials.
• Username and password will both be forced to lowercase.
• The password recovery system will mail you your password in plaintext.
• Parts of the online system ask for a registration password. That password is “astound”.
• Astound formats account numbers in three fields, like 005 0123456 01. The form presents two boxes: try 005 012345601

Riot’s hugely popular game League of Legends is still installing malware, some five months after saying they don’t use it, players can delete it, and they planned to remove it.

The malware in question is Pando Media Booster. A few years ago this software was arguably useful, it allowed games like LoL to distribute patches via a peer-to-peer network. But Pando was discontinued in August 2013. Then in February 2014 someone used Pando to install malware on any suckers who still had the software. The software Riot is still distributing. And all of Riot’s customers who clicked “yes” on the update dialog had their browsers hijacked.

Riot has millions of users all over the world. I’m sympathetic to how hard it is to make software changes; they’re famously behind on a whole lot of development projects. But continuing to distribute malware to customers is unacceptable.

Interesting report of stolen Bitcoins, a phishing scam involving a Google ad. I just confirmed that the phishing ad is still running on Google on a search for blockchain.

The ad says the URL goes to blockchain.info. The URL displayed on mouseover on the link is to a Google redirector, goo.gl/vL2zmr. But when you click the link you go through a few redirectors and end up at blockchain-info.consulpisos.com, which is allegedly a phishing site. It sure looks suspicious; that page goes straight to a “type in your password” page, which the real site hides behind several clicks.

I don’t much care about the Bitcoin part of this, but Google should really not be selling ads with fake URLs on display.

There are two terrible web properties out there that everyone hates, Scribd and Quora. Please don’t use them. Instead of Scribd just host a PDF anywhere, or upload text to pastebin or make a nice blog on WordPress or Medium or something. And instead of Quora use Ask MetaFilter or StackExchange.

Scribd’s business model is to host documents in formats that are unusable. For instance, here’s a copy of the Declaration of Independence. Or rather, the free preview; you have to download it to read the rest and a one-day guest pass costs $9. Here’s a copy of Elliot Rodger’s insane manifesto. It starts “This is the story of how I, Elliot Rodger, came to be.” Only I had to retype that phrase; if I copy-and-paste I get “]fjs js tfh stgry gl fgw J, Hccjgt Tgmahr, eknh tg dh” because Scribd uses some stupid DRM font. Easy enough for a pirate to reverse engineer but impossible for normal use. They also broke “Find”; there’s some Javascript thing overriding the browser that doesn’t seem to work.

Quora’s business model is to trick people into sharing information for free, then put it behind a login. It’s like Experts Exchange 2.0! For instance, on Quora you can read Who owns the copyright on content contributed to Quora? Only you can’t just read the text. Depending on your history with the site and the way you got there you may see a giant popup demanding you log in obscuring the page, or the first answer clear and then the rest blurred, or if you’re lucky just the page. It appears nondeterministic.

Both businesses are deliberately trying to lock up text content to make it harder to access, to force users to pay or share advertising data or some such bullshit. The part that kills me is some engineer actually wrote code to deliberately break document sharing on the web. It’s terrible.

Seven years ago I wrote about XML security problems, the XXE vulnerability. This flaw is the gift that keeps on giving: someone exploited Google with it this month.

XML is a ridiculously complicated data format. And XML parsers implement all the features, including the obviously dangerous and useless ones. And engineers keep forgetting to turn those features off. It’s just terrible.

League of Legends has a serious security problem: denial of service attacks. Some of these attacks are against the game as a whole and bring down the whole system. Presumably Riot can eventually protect their servers from that. Worse are targeted DDoS attacks against single players; it’s not clear they can defend themselves

The motivation for attacking individual players is ugly. The game is very competitive at the highest levels of play, with prize money and pro careers on the line. Knocking an opponent offline or just lagging them is enough to get a win. Even if the game is thrown out as invalid a DDoS is still way for a losing game to be converted into a tie.

There are guides on how to avoid being a DDoS victim. They boil down to “don’t reveal your IP address”, which in practice means “don’t use Skype from your real IP”. VPNs, playing only from Internet cafes, etc are other options. But these are minimal solutions at best; hiding your location from the world is really difficult. There’s new rumors the whole IP identification part is entirely automated and foolproof.

I don’t really know how a normal Internet consumer can protect his ISP from being knocked offline with a DDoS. It’s an ugly situation.

Apple totally screwed up SSL with a fundamental bug in their certificate checking implementation in both MacOS 10.9 and iOS 7. Every consumer iPhone, iPad, and Macintosh running recent versions of their OS is vulnerable. My understanding is SSL certificate checking basically does not work and any secure site can be spoofed with a man-in-the-middle attack. It’s about as deep a flaw as it goes. There’s a patch for iOS out but not yet for MacOS. You can test if a browser is vulnerable here.

The bug boils down to a simple typo in the code, the good ol’ C gotcha that indentation doesn’t match control flow. Bugs like that happen in C. What’s alarming is Apple didn’t catch the bug; not with a lint tool, not in code review, not in unit testing, not in integration testing. No aspect of Apple’s software development process caught this bug before releasing it to millions of users. That’s terrible engineering practice; in a critical security library it’s outright negligence.

At the moment MacOS users are entirely vulnerable and there’s no fix. In the past Apple has taken many weeks to fix critical bugs in things like Java, hopefully they’ll be faster here. Using Chrome instead of Safari will insulate you from malicious web servers, Chrome wisely has its own SSL implementation. But a whole lot of other Mac software is relying on the broken certificate library, presumably including Apple’s own software update system.

Nice of Apple to publish the exploit before the fix.

RSA Security (part of EMC) was one of America’s most respected security companies. Thanks to Edward Snowden, we now know the price of their reputation: $10 million. For that tiny sum RSA sold out their customers, deliberately installing a compromised random number generator in their core security library BSafe at NSA’s request. For $10M, a company’s reputation destroyed.

The nature of NSA’s sabotage is worth looking at in detail. We knew back in 2006 that Dual_EC_DRBG, a NIST standard crypto random number generator, was fishy. That algorithm has baked into it an arbitrary constant; two Microsoft researchers figured out that if an adversary had chosen that constant, then the numbers were predictable and any system built on it was insecure. Snowden’s leaks confirmed in Sep 2013 that this backdoor had been placed. And now in Dec 2013 we know the price: $10M. (Interestingly, one old-school cypherpunk knew the price back in September).

It’s worth noting that RSA’s complicity with NSA is not their only enormous security black eye. Back in 2010 their flagship SecurID two factor login system was also widely compromised, it’s assumed by the Chinese government trying to get military and commercial access to US and European interests.

Open source ends up looking good in all this mess. NSA has probably attacked other random number implementations. There was a weird push from Intel to get Linux to completely trust their undocumented hardware generator, something resisted by the Linux team (thankfully). And OpenSSL, the open alternative to RSA’s library, doesn’t use the compromised algorithm (although their code has had its problems).

I remain indignant that NSA is willfully going around deliberately sabotaging the security of core Internet components. Even if you believe it’s good for NSA themselves to be able to break all encryption, it is so dangerous to have back doors like this hiding in systems. NSA is actively undermining everyone’s security.

Here’s something ugly, the whois response for pirate book site readanybooks.net. Below is an extract of the interesting parts that both MacOS and Debian’s whois display.

$ whois readanybooks.net

   Domain Name: READANYBOOKS.NET
   Registrar: XIN NET TECHNOLOGY CORPORATION
   Whois Server: whois.paycenter.com.cn
   Name Server: RICK.NS.CLOUDFLARE.COM

Billing Contact:
  Name           : li xiaoing
  Email          : jr361005@126.com
<script src=
  "http://img2.xinnet.com/d/js/acmsd/thea178.js">
  </script>&nbsp;

Huh? What’s an HTML tag doing in this whois response? And under what circumstances might that script tag be executed? I can imagine a naïve Web interface just injecting that script wholesale into my browser. Every way I load the referenced script it seems benign (right now), but that’s an attack vector waiting to happen.

Another reason to end passwords as a method of authentication is the poor usability of strong passwords on mobile devices.

1. Typing a strong password like xry7s6Dx26Pz is nearly impossible on a mobile keyboard, particularly since for some dumb reason I can’t even see it when I type.
2. I can’t use a password agent like LastPass effectively on iOS because there’s no way for it to plug in to Mobile Safari. I’m stuck awkwardly copy and pasting passwords between the LastPass app and Safari, having to type my master password every time. LastPass does have its own baked-in browser but that’s far too limited on iOS.
3. Trying to log in to other apps pretty much requires copy-and-paste of the password, since there’s nothing like a pluggable authentication framework.

Sorry if this is stating the obvious, but the lack of usability of strong passwords on my iPhone and iPad is a big part of why I don’t log into sites on mobile devices.

Google has reduced itself to outright spamming users to promote its products. Here’s a screenshot of an email I got today about Google’s failing payments product, Google Wallet. Note the footer, the email is marked “You have received this mandatory email service announcement to update you about important changes to your Google Wallet account”. What are those important changes?

1. A call for me to use Google Wallet more
2. An ad for the Android version of Google Wallet
3. The Google Play logo
4. Logos for stores that accept Google Wallet
5. A request that I subscribe to more Google Wallet ads

In summary: four ads for Google products, one ad for random other companies that happen to use Google Wallet, and zero important changes. I guess I should block noreply@wallet.google.com?

It’s cliché now to point out how disappointing Google, Inc. has become. But this seems bad even for the trend. All that’s missing is the “+1 on Google+” button.

One of the great failures of the Internet era has been giving up on end-to-end encryption. PGP dates back to 1991, 22 years ago. It gave us the technical means to have truly secure email between two people. But it was very difficult to use. And in 22 years no one has ever meaningfully made email encryption really usable.

A big part of the problem is the architecture of Internet services. Most of us host our email on a third party server like Gmail or Lavabit or whatever. That makes true end-to-end encryption very difficult. Instead we have to trust our hosting service with access to our email, and as we find the government can compel them to rat you out (or simply break in).

We do have SSL/HTTPS, the only real end-to-end encryption most of us use daily. But the key distribution is hopelessly centralized, authority rooted in 40+ certificates. At least 4 of those certs have been compromised by blackhat hackers in the past few years. How many more have been subverted by government agencies? I believe the SSL Observatory is the only way we’d know.

The cypherpunks movement foresaw all of this surveillance risk. It outlined principles and technologies to protect individuals from both evil hackers and overreaching governments. It failed to actually implement it.

I no longer really use passwords to log into websites. Instead I use an authentication agent that lives in my browser and proves my identity to websites. Sadly, the authentication protocols of the Web require sending my secret token rather than doing some safer public key protocol. And the details of figuring out how to transmit the token to each website are needlessly complex.

To put it another way, passwords are completely broken; even strong passwords like “qeadzcwrsfxv1331” are crackable. With LastPass in my browser I literally do not know what my password is on pretty much every one of the 479 websites I log in to. I already run a complex authentication protocol. The stupid thing is that it’s a very bad protocol, involving stuffing secrets into random form elements on the web page.

Mozilla Persona is a strong proposal for how to end passwords in a better way, at least for desktop computers. And Tim Bray has lots of good notes on the authentication and identity. I still think OpenID is sufficient, or maybe the newer OpenID Connect system. Hell, at this point I’ll accept log in with Facebook or Google+ Sign-In. But whatever it is needs to be universal. And it really should be vendor neutral.