There are limits to 2FA and it can be near-crippling to your digital life

Even 2FA can run up against limitations—like this Find My iPhone attack.

A video demonstration of the vulnerability here, using a temporary password. (credit: Kapil Haresh)

This piece first appeared on Medium and is republished here with the permission of the author. It reveals a limitation in the way Apple approaches 2FA, which is most likely a deliberate decision. Apple engineers probably recognize that someone who loses their phone won’t be able to wipe data if 2FA is enforced, and this story is a good reminder of the pitfalls.

As a graduate student studying cryptography, security and privacy (CrySP), software engineering and human-computer interaction, I've learned a thing or two about security. Yet a couple of days back, I watched my entire digital life get violated and nearly wiped off the face of the Earth. That sounds like a bit of an exaggeration, but honestly it pretty much felt like that.

Here’s the timeline of a cyber-attack I recently faced on Sunday, July 23, 2016 (all times are in Eastern Standard):

That’s a pretty incidence matrix

That’s a pretty incidence matrix (credit: Kapil Haresh)

3:36pm—I was scribbling out an incidence matrix for a perfect hash family table on the whiteboard, explaining how the incidence matrix should be built to my friends. Ironically, this was a cryptography assignment for multicast encryption. Everything seemed fine until a rather odd sound started playing on my iPhone. I was pretty sure it was on silent, but I was quite surprised to see that it said “Find My iPhone Alert” on the lock screen. That was odd.

Read 20 remaining paragraphs | Comments

Dark Patterns are designed to trick you (and they’re all over the Web)

No, it’s not only you—some user interfaces today intentionally want to confuse and enroll.

Allow Harry Brignull to explain.

It happens to the best of us. After looking closely at a bank statement or cable bill, suddenly a small, unrecognizable charge appears. Fine print sleuthing soon provides the answer—somehow, you accidentally signed up for a service. Whether it was an unnoticed pre-marked checkbox or an offhanded verbal agreement at the end of a long phone call, now a charge arrives each month because naturally the promotion has ended. If the possibility of a refund exists, it’ll be found at the end of 45 minutes of holding music or a week’s worth of angry e-mails.

Everyone has been there. So in 2010, London-based UX designer Harry Brignull decided he’d document it. Brignull’s website, darkpatterns.org, offers plenty of examples of deliberately confusing or deceptive user interfaces. These dark patterns trick unsuspecting users into a gamut of actions: setting up recurring payments, purchasing items surreptitiously added to a shopping cart, or spamming all contacts through prechecked forms on Facebook games.

Dark patterns aren’t limited to the Web, either. The Columbia House mail-order music club of the '80s and '90s famously charged users exorbitant rates for music they didn’t choose if they forgot to specify what they wanted. In fact, negative-option billing began as early as 1927, when a book club decided to bill members in advance and ship a book to anyone who didn’t specifically decline. Another common offline example? Some credit card statements boast a 0 percent balance transfer but don’t make it clear that the percentage will shoot up to a ridiculously high number unless a reader navigates a long agreement in tiny print.

Read 31 remaining paragraphs | Comments

Dealmaster: Get a Dell Optiplex 9020 micro desktop for $632

Plus other deals on smartphones, smart TVs, and more.

Greetings, Arsians! Courtesy of our partners at TechBargains, we have a bunch of great deals to share this week. One of the biggest deals is on a very small item: now you can get a Dell Optiplex 9020 micro desktop with a Core i7 processor, 8GB of RAM, and a 500GB hard drive for just $632. Only slightly bigger than a soda can, this small desktop supports VESA mounting under a table or behind a monitor so you can hide it in your setup for a clean workplace look. The list price for that tiny PC is $799, so you're saving nearly $200 with this deal.

Check out the full list of deals below, too.

Featured

Read 8 remaining paragraphs | Comments

Mini John Cooper Works goes back to the original Cooper works

We take the most powerful Mini ever back to where the Mini Cooper was born in the 1950s.

It’s drizzling as I roll into the south-west London suburb of Surbiton, and every so often the automatic wipers on the Mini John Cooper Works I'm driving spring into life to sweep drops of water from the screen. It’s early, and the town is barely awake yet. But even as the pavements start to fill with Suburbiton commuters bustling between newsagents, big-chain coffee shops, and railway station, one part of the town remains empty and ignored. Yet that’s the place I’ve come here to see.

The new generation Mini JCW is named after the man whose vision and no-nonsense organisation created the Cooper racing cars that changed the face of Formula 1 motor racing in the 1950s, and the Mini Coopers that livened up 1960s circuit racing and rallying. So I’ve come to Surbiton—where the Cooper Car Company was based—to find the building that was the original works. From there I’ll head off in search of the greatest of the JCW’s distant ancestors.

First, to find the place where it all started. The Mini’s infotainment controller is on the console between the front seats, where the big rotary control is easy to reach and operate. Navigating the main mode buttons nearby is less easy; until you memorise the position of each one, you have to look down to choose between media, radio, phone, and nav. All set, the Mini navigates me precisely through the thick Surbiton traffic to the junction of Hollyfield Road and Ewell Road where the Cooper works stands. And it’s a bit of a disappointment.

Read 20 remaining paragraphs | Comments

The scientific arms race to age our whiskey

Despite more whiskey research than ever, proprietary desires may limit our understanding.

Maureen Stronach, an employee at Diageo's Dalwhinnie distillery, views whiskey drawn from a cask in the store room on April 21, 2011. (credit: Jeff Mitchell / Getty Images)

Almost every distillery tour follows the same format. First, you’re led by a display of raw materials. Then, the guide takes you around the fermentation tanks and by the still. But the magical part is what comes next. Once the whiskey is collected from the still, it’s put into barrels and stored in cool, shadowy warehouses called rickhouses. The air here smells of the vanilla and oak and grain from the spirit that’s evaporated. And since most rickhouses aren’t even wired for electricity, you almost feel like you’ve stepped back in time. Whatever comes from here will taste like pure wonder.

In reality, the spell was cast long before you stepped foot into these whiskey-scented buildings. Labels, websites, and other bits of marketing work together to paint pictures about things like generations of distillers, specific grain blends, or the surface details of aging. And within those first steps of any tour, a guide spins a narrative made of half myth and half fact, incorporating widely accepted statistics like the percentage of each barrel that evaporates each year. Despite the lack of published evidence to back such information up, these whiskey standards are often repeated as fact, especially by PR reps, bartenders, and enthusiastic consumers.

The truth is, most of the research being done on whiskey, especially about how and why it ages, will never be available to the public. With revenue from whiskey sales topping $2.7 billion in 2014 in the US and projected to keep rising, producers’ hesitance to share is somewhat understandable. In many cases, the data collected could give any company a competitive advantage.

Read 39 remaining paragraphs | Comments

A Magic: The Gathering addict moves to China

“The more I re-invested into Magic, the more I placed all of my self-worth into the game.”

This piece is an edited excerpt from James Hsu's recent book, Magic: The Addiction: My 20-Year Gaming Journey. James is a life-long gaming enthusiast and technophile. He currently lives in Beijing.

Magic: The Gathering has opened many cultural doors for me. A game with the international reach of Magic allows its players to compete in locations around the world. In places like New York, Amsterdam, and Munich, I have played Magic with strangers, armed only with our mutual love of the game as a shared language.

This became an unexpected benefit in my early thirties as I relocated halfway around the world, from Canada to China, in search of a new beginning.

Read 75 remaining paragraphs | Comments

Dealmaster: Get a Dell XPS 8700 desktop with Core i7 for only $599

Plus deals on TVs, laptops, unlocked smartphones, and more.

Greetings, Arsians! Courtesy of our partners at TechBargains, we have a number of deals to share today. One of the best is a powerful Dell PC: now you can get the Skylake-powered Dell XPS 8700 desktop with 8GB of RAM and 1TB of storage for just $599. That's an incredibly low price that won't last long, so grab it while you can.

Check out the full list of deals below as well.

Featured

Read 6 remaining paragraphs | Comments

I Am Setsuna review: A hollow, confusing ‘90s RPG throwback

Tokyo RPG Factory’s debut is flat as fresh-fallen snow, empty as a snow angel.

At times I Am Setsuna is truly beautiful.

I Am Setsuna wears its influences on its sleeve—also on its pants, shirt, shoes, and company branded baseball cap. The game pulls heavily from SquareSoft’s SNES classic RPG Chrono Trigger to the extent that the inspiration is mentioned by name on the front page of the game's website.

That means you know going in that you're in for a top-down, turn-based JRPG where time ticks down actively during battles, and you can see your foes on-screen before facing them. There are no surprise encounters here—save the ones scripted into the story.

The story follows the titular Setsuna through the perspective of Endir, your masked, silent cipher of a protagonist. Setsuna has been selected as a sacrifice—like her aunt, mother, and many other women before them—on the theory that sacrificing one girl every few decades will cause the monsters that inhabit the world to leave them in peace.

By the time Endir enters the picture (on his own quest to kill Setsuna for unrelated reasons), monster activity is on the rise, and these beasts seem to be more organized than ever. Cue a fateful meeting between our hero and heroine where he decides against cold-blooded murder, and suddenly a journey ensues that pulls a growing cast of party members in its wake.

Read 26 remaining paragraphs | Comments

Monster Hunter Generations review: The next colossal footprint

Generations picks up where the past left off, and runs with it.

"Hunter Arts" are fun and flashy, without breaking the spirit of the game.

Pick up your charge blades, insect glaives, and cheese fondue—there’s monsters what need hunting. The aptly named Monster Hunter series has returned, this time without a number following the name. This time, it’s just Monster Hunter Generations, and the name refers to more than the time it takes to learn these games (assuming you’re in what seems like the majority of Western players that are rightly intimidated by Capcom’s Japanese moneymaker).

As with every Monster Hunter since the first, what you're learning is how to strike down massive, and not-so-massive, creatures of the wild. Think of each major monster as a boss fight—one that can take nearly an hour to complete as you track and hack away at prey over wide, repeatedly visited zones.

Doing so successfully means chopping them up for parts and turning the material into better equipment. Break it all up with some grinding, gathering, and fetch quests and you've got the thousand-hour-plus loop the series has been known for over multiple "generations" of hardware.

It's a legacy this latest entry is particularly aware of. “Generations” refers to the fact that this Monster Hunter is pulling from past entries. It’s like a greatest-hits album for the franchise, if you will. Familiar hunting grounds return from Monster Hunter Freedom 2, the Japan exclusive Portable 3rd, and even the debut game in the franchise. Each locale has been ever-so-gently modified to make available elements from Monster Hunter 4 Ultimate. That means there are more ledges on beasts’ backs for you to grab on to as you ride them down to the ground.

Read 19 remaining paragraphs | Comments

How to set up your own VoIP system at home

An exhaustive guide to setting up all manner of at-home phone trickery.

(credit: Philippe Put)

The landline phone may seem an anachronism to many, but if like me you work from home it can still be an essential business tool. Even if you're not a regular home worker, many people still like to have a phone that's separate to their mobile. In a family house or shared house, it can sometimes also be useful for different people to have their own number too.

In the past, your choices were fairly stark—either multiple analogue phone lines, which is what I had when I first moved into my flat, or ISDN. While the latter was very popular in parts of Europe, it never really took off in the UK or US. BT's pricing was part of the problem, together with a lack of equipment. Nevertheless, for many years, I used a small German ISDN PBX at home. It made it simple to separate business and work calls, and thanks to the 10 number blocks BT issued as standard with ISDN2 lines, my lodger could have a number too.

Pricing was the killer for ISDN in the home, unless you could claim it as a business expense. Now, however, VoIP services make it much easier to provide the same sort of functionality at a fraction of the cost, and it's much easier than you might have thought, too. Here's how I did it.

Read 42 remaining paragraphs | Comments