Headworx

Finally. Digital cryptography has been applied to a civil satellite positioning system. Satellite positioning is one of the technologies that deeply influence our daily lives. Thousands of services rely on the fact that a mobile phone can instantly figure out where on Earth it is. Mobile maps are the first obvious example.  But there are other less obvious. Time stamping voltage and current samples in power distribution grids to synchronize them. Arbitrage of high frequency trading on stock exchanges. Maintaining microsecond time slots in 5G networks. Weather forecasting. Seismic monitoring. Tracking and recovery of items that broadcast Bluetooth signals. Photo tagging. Drones. City rentals of electric scooters and bikes. And many more... Then of course we have aircraft navigation, ship navigation, and many high value services. Disruption of satellite signals has been an easy target. There are several methods to do this. Brute-force jamming is the most straightforward. But there ar...

So much for iPhone privacy. I had thought that paying in a physical store with contactless Apple Pay was more or less protecting my privacy. It turns out this is not the case. I mean of course paying by credit card you give your static credit card number to the merchant. But that should be it, right? Just the number. Not your email, home address, phone number and God knows what else. So I was quite stunned in Queenstown, New Zealand, after landing I went to a sports shop to buy some freeze dried food and a gas canister. When paying I rarely pay attention to the details other than the transaction amount but I thought there was a glimpse of my phone number and my email on the terminal for a short while. This was confirmed later this day when I received a bunch of emails from the store - welcome, coupons etc. Had I provided them with this data voluntarily? Nope. I even went through my email history and there was no trace of any earlier communication from that store chain. So they must hav...

CLEAR ( https://www.clearme.com/ ) is a commercial service promising accelerated way through airport security. Its existence is questionable, as airport security is done by a government agency, so why would a commercial entity charge extra money for getting people in front of the government queue? Well, after all we have the best democracy money can buy. But of course CLEAR is not the only one, as "status" travelers also have their Fast Track systems. CLEAR is like a subscription-based "faster than fast track" track. A while back it was available only to US Passport holders, so despite United airlines giving me CLEAR membership for free, I could not make use of it. It let me create an account but then I got stuck in the process. And I forgot about it. Until recently I saw a $129 charge on my credit card for yearly membership. United clearly withdrew their offer of "zero cost CLEAR membership", and I had my account (despite not being able to use it), so the...

I should have known this time. This happened to me in the past multiple times. I bought an SSD drive which was 256GB on the outside and only 40GB inside. I bought suspiciously inexpensive 1TB microSD card which was way less than that in practice. I bought branded fragrances which were fake. And this time I bought AirPods Pro 2 for a too-good price. They were fake. Fake, but really hard to distinguish from originals. I just could not believe what I saw.  The AirPods looked and felt like the originals. Perhaps the audio quality was not that great, but that is always a bit subjective. Anyway I wanted them for my Mom. She has some minor hearing loss. I read all the recommendations about the Pro 2s stepping in the role of a hearing aid (with a firmware upgrade). Of course I wanted to try this feature, so all I was looking for right after pairing with my iPhone was the firmware update. The AirPods paired like the originals. Displayed all the native features, including the serial number,...

We have talked a lot about Bluetooth NLC since the launch of the standard in September 2023. There are many dimensions impacted by this latest wireless lighting control standard. And the importance of it has already been correctly recognized by the policy makers and global market players world wide. There have been good interviews - with Bluetooth SIG's Damon Barnes and myself published - which I believe do a very good job explaining what Bluetooth NLC is and how it impacts connected lighting. DesignLights Consortium (DLC) has recently released a request for proposals for consultants to help define a clear pathway to adopting connected lighting for energy efficiency programs in North America. They nail the problem, which was the short term thinking in the past: In many present lighting retrofit projects, the extremely low cost of incentivized uncontrolled LED lighting is a major deterrent to networked lighting control (NLC) adoption. If uncontrolled LED lighting had no incenti...

Source: CNX Software I remember people's faces back in 2011 when responding to "what is your company doing?" question my answer was - software for light bulbs. That was almost two years before Philips Hue came out. Now fast forward 12 years, we have reached the level of elevating that software concept to the global standard level, through Bluetooth NLC. Bluetooth NLC is the standard's body response addressing the needs of universal cross-vendor interoperability in the smart lighting space. Of course they are not exactly "light bulbs", as less and less people make and use them, but rather commercial / industrial grade lighting fixtures and luminaires. With the proliferation of LEDs the bulb form factor has gone away nor there is a need to have them replacable. So the E26/E27/E14 screw standards are gone, but the lights now are intelligent and want to be connected. At a glance the lightbulb functions seem very simple - turn on and turn off. Then there is dimmi...

It seems the security aspects of wireless networking finally start becoming important to the market. I have had multiple discussions with multiple customers about that recently.  And honestly - it has been very bad almost everywhere. Everywhere except the official Bluetooth mesh, where the security architecture is at another level. There is a good overview published by Bluetooth SIG back in 2017, and for those who are willing to dive deeper, there are the specifications - both adopted and the upcoming drafts. But without diving into the details, there is one fundamental question any customer concerned about the security of a wireless system should ask: show me the blueprint, show me how you have architected that and how it works. Vendors can claim anything, but the claims practically cannot be verified. So if they claim their security is good, they should not have any issue providing openly the architecture of their system. Any excuse to do that should be a warning, or even a red...

Most of us are familiar with the 6-character airline reservations numbers. Today it is almost impossible to travel without one. They uniquely identify a booked trip (which may include multiple tickets) and any related action requires that number. Check-in, itinerary change, cancelation...  To make sure the reservation number is used by an authorized person, airlines typically ask for a surname, before allowing any changes. But the surname is rarely a secret. So when someone shares the ticket information which includes the reservation number, basically anyone can access that reservation. Twitter is full of stories when a person innocently posted a flight ticket only to realize someone called the airline to cancel her flight. Hard to say tru or fake but possible nonetheless. So be careful. It seems now at least some airlines learned the lesson and have rolled out additional authentication steps, such as a temporary code. So unless you have your email account hijacked, this additional...

There was a lot of privacy - protecting noise when Google was conducting their initial StreetView image scans. Then many countries banned the use of dash cam video recorders. These include many European countries: Belgium, Luxembourg, Austria, Portugal. And now we have learned that each Tesla car, spiked with recording video cameras, transmits the video footage, which then has been shared openly. Ars Technica has a full article on that here:  https://arstechnica.com/tech-policy/2023/04/tesla-workers-shared-images-from-car-cameras-including-scenes-of-intimacy/ . Now it really does not matter this is an opt-in feature: Tesla's customer privacy notice says. "In order for camera recordings for fleet learning to be shared with Tesla, your consent for Data Sharing is required and can be controlled through the vehicle's touchscreen at any time.  As the driver/owner opting in really means they opt in anyone who happens to be in the field of view of one of these cameras. So shoul...

I have found myself in a pretty unusual situation - between a hammer an a hard place. It started with a super ordinary transaction at Best Buy, purchasing an Apple gift card. The gift card did not work, saying "the code is invalid". I reached out to Apple support and after going through the usual checks "have you typed in the code correctly?" a human support person pick the issue up and quickly explained to me that "this gift card was cancelled at the place of purchase". And that the only option was to contact the Best Buy store. I tried Best Buy's online chat but the agent was of not much help either. He was apologetic, but the conclusion was to ride back to the store and "the customer service will help you". So I did. Actually the store manager happened to be the customer service person, so without being forwarded like a hot potato, he quickly produced the "POS transaction fingerprint" (a log file spanning 6 pages when printed) an...

The key problem with the Internet is trust. Or lack of it. There is tons of information. It is just almost impossible to tell for sure what is real and what is fake.  Interestingly it is much easier for machines to verify what to trust, because of the established authentication protocols based on widely adopted cryptographic standards. For humans it is just a jungle of click-baits. Ultimately what we verify is what we see. And what we see is rendered by applications, displayed on screens. And very often what we see looks legit while it is not. The whole problem of scam and phishing.  And it takes years to build the trust. Then, as Elon Musk demonstrated during his week at Twitter, it is just a moment to ruin the reputation. [For those who were not following: Twitter had had a "blue mark" program for high profile celebrities and institutions. Musk started selling this mark for $8 to anyone, without verification. So there was an eruption of imposter accounts, all granted the Tw...

Passkeys have been heralded the final nail into the password coffin. And I do agree this is a great step/milestone and I'm really looking forward to have this enabled across all devices and all applications. But as lots of us will benefit from this rare development which increases both security and ease of use (typically these things are opposite), there is the growing "layer 8" security attack surface. Which is the attack on people who are unfamiliar with how things really work. Probably most of the vulnerabilities will lie around the ownership and protection of personal devices (which are now holding all the keys). Just to illustrate the issue. The battery in my several years old iPad has been dying and I decided to have it replaced. The standard Apple procedure is "give us your old iPad and we will give you back a refurbished one". I did not like this procedure as it required erasing the old device and reinstalling everything on the new (refurbished) one. Ev...

Las Vegas is fabulous. You know that even before you arrive, as this is exactly what the flight attendants tell you when boarding a LAS flight. Of course. It cannot be anything else but fabulous. And the Vegas fame aside, it really was fabulous for us las week at LightFair International, the first grand industry trade show after COVID19. There was desire and energy in people to meet face to face and shake hands. We saw that back in March at New York's LEDucation. Which was the indicator of the LightFair to come. The booths were crowded for all three days - we has meetings up until the last hour. And of course mornings ad evenings were busy too with joint breakfasts with customers and after hours parties. It has been so encouraging to see that much energy in people and so many happy faces. This all means the lighting industry is back up to speed and guess what is the leading theme these days? Energy savings. Of course. LED retrofits are becoming no-brainers and with lighting control...

User authentication is the most unsolved problem of the Internet today. For 30 years we have been lost in the passwords jungle. Hardly anyone understands and is able to navigate this jungle. We give our passwords left and right, lose them, recover, use 2-factor authentication on a single device and so on. Web service providers are trying to get more and more sophisticated which works very often against them. So is all hope gone? Maybe not. The three Internet giants, Apple, Google and Microsoft, have just announced to " Expanded Support for FIDO Standard to Accelerate Availability of Passwordless Sign-Ins ". Which sounds promising, but personally I'm a bit hesitant to call it a victory. What is good is they declared they wanted to work together on an open standard and cross-platform support for it. That is very good news. Because regardless is so-called FIDO2 will technically meet the challenge, with the commitment of the big 3, there clearly be FIDO2+ or FIDO3, which wil...

The Internet played a huge role during the COVID pandemic, to keep us globally connected. Despite the lockdowns we were globally connected and thanks to webcams and teleconferencing software applications we could continue being together. Now the war that Russia started in Ukraine changed all that. The Cloud is no longer global. The location of servers and who operates them has become fundamental. Russia (and in consequence the Russian citizens) have been cut off from the services they had been using so happily. Thousands are stuck and stranded in Thailand and many other holiday destinations. Cashless and flightless - without access to their banks and with no (easy) means to return home. The government cannot transact either and considers switching to Bitcoin . But even if Russia accumulates Bitcoins, it is not that easy to spend the cryptocurrency - at some point they will need to convert.  The cuts have so far been virtual, the West simply switched off the services. But one can a...

In the previous era software updates were significant events. Not only they did not happen automatically, but even to check if there was one, you had to do some special things. Look up a web page, download the installer package, uninstall the previous version, remembering to save settings somewhere, then run the new install and restore the settings. Then appstores came around, popping up notification bubbles which were inviting to download and install updates. Now the updates are gone. Not that they are not anymore, but we mostly just don't see them. Both Apple and Google have hidden the updates and they execute kind of behind the scenes. And it works for most people, But then there are some devices which can be considered a part of the "infrastructure" and updating them fully automatically probably is not the best idea. I have the Firewalla boxes on my home networks and despite being very happy with them I have never pulled the trigger to switch the networks to be Firew...

Passwords are probably the most unsolved user experience issue since the beginning of the Internet era. The biggest fail. There is one thing that keeps them alive, which is (the recovery) email. Email is - in the end - the last resort when we mess with passwords, by simply forgetting them. The problem with passwords is that by trying to make them more secure, by enforcing policies of "difficult" passwords or policies to change them frequently, we force users to keep them stored in plain text either on easily accessible electronic notes or on post-its. And any web service which is accessed less frequently, we probably start with the "forgot password" option which emails us a recovery link. Then there are password managers which themselves are a mess. I have always had issues trusting them fully. Probably one useful thing they offer are statistics. E.G., Google Chrome tells me I have about 300 passwords to various web sites. 300 is obviously not manageable in any way ...

The irony is that people who care about (backing up) their data tend to lose it... Most just don't care and this approach is good enough. After all Google Photos, iCloud and similar services will take care of device backups automatically. And so will any of the messaging or social sharing sites. I do know some people who rely entirely on WhatsApp as their backup for photos and other stuff. That just works, as long as you do not have any special needs (such as storing certain file types or making sure the photos are not down-sampled). Then there is a group of those who care a bit more. They purchase premium tiers of the cloud services, enabling them to store full resolution photos and other files by either manual uploads or automatic mirroring. And then there is the very paranoid group who do not trust the cloud services. They take the most effort of setting up and maintaining local backup devices - most typically in form of NAS (Network Attached Storage) devices. All in faith of be...

Palm Pilot was my first touch screen device. 25 years ago, it was revolutionary. It turns out Palm still lives today, in a form of a tiny Android phone - the Palm Phone. This device is useless as a primary phone, as Palm went a bridge too far squeezing the battery such that it lasts half a day on light use. But with volume and weight of 25% of a typical 2021 phone, it is great for casual use. It runs proper Android and just about any app you may want. And Palm did really a good job customizing the UI to fit the small screen - the launcher is first class. It can be a backup on the road. Broken screens happen. and this thing is so tiny it is no brainer to carry it as a backup device when traveling. It is a great "fitness" phone, if you need one. Again the tiny nature helps with any activity and it is waterproof. There is even a specially designed custom armband which puts the on the forearm - easy to navigate things like music or calls. For me it is primarily an audiobooks-on-t...

On the positive side Apple AirTags are great. Tiny, long lasting, ultra-wideband enabled (to enable directional indicators when locating a lost one). And of course, the key advantage of this system is the crowdsourced network of billions of iPhones globally, which can help reporting a lost device. And on the surface the system is designed to protect privacy. But not all that glitters is gold. Let's scratch that surface a bit. While AirTags are designed to protect the owner, they do not protect against malicious owners. The simplest use case is that I buy an AirTag and drop it in a pocket of a person I want to track. Instantly I have that person pinpointed on a map, in real time. A stalker's dream. Technically if that person happens to have an iPhone, it will eventually start alerting about a "foreign" tracking device she carries, but that is only on an iOS device. Non-iOS users are in the cold. Secondly, AirTags internally do not implement a secure environment and th...