In my Google 2 step authentication article, I covered extra security you could place on your Google account (come on, you’ve all implemented it now haven’t you ? ), but key-loggers can still get your username and password when logging onto a public unsecured computer, and the less information you give away the better. While it’s still only experimental, Google seems to be working on a solution:

1. Point the unsecure terminal’s web browser to accounts.google.com/sesame and you’ll see a QR Code.
2. Scan the on screen code on your phone
3. Your phone’s browser will ask you to verify your Google account and password
4. Once verified, the unsecure terminals browser will automatically redirect you either to Gmail or iGoogle ( your choice ).

The QR Codes are only valid for a short amount of time, and you do need a smartphone with internet access and the ability to read QR Codes. It’s all pretty cool

This was an experimental project by Google and the actual project ended about 1 hour after I finished writing this post. Rather than having wasted my time, I thought I’d leave this here as an indication of the sort of things that Google is coming up with in regards to security around your Google account ( hopefully Julie lets this post through ). I’ll keep things up to date if it or similar comes back again. For those that are interested about security around their Google accounts there was a great article in The Atlantic a while ago called Hack!. Well worth a read when you have a spare moment.  This is exactly the same scam used with my friends Hotmail account in the my first article.

Oh and please whenever you make use of any public terminal make sure you log off and take your tinfoil hat with you before you leave. 

Filed in categories: News

Tagged: Google, Internet security

Google Security Part 2 – Open Sesame – Look ma, no hands login originally appeared on The Gadgeteer on January 20, 2012 at 9:00 am.

One of my friends had her email account hijacked recently.  The hijackers had obviously got hold of her password somehow and were sending out emails to her address book claiming she was stuck overseas and needed money sent to her. I’d read about this sort of thing  but never had it happen to myself or anyone close to me. I suspect that it would be quite easy for the less-knowledgeable and naive to not realize and send money and be taken for a ride, as it was certainly more “sophisticated” than the typical Nigerian scammer email.  I actually toyed with them for a while  (to the extent of trying to sending them to my mate Kon Stabel at the address of the local police station ) and the jackers were pretty “sneaky” about trying to get money out of me.

It was then I decided I should really do something about strengthening my own security around my accounts by turning on Google’s 2 step authentication which I’d read about but never got around to implementing.

Working in IT you’d think I’d know better; however, this got me thinking about all the information I have stored in my Google account. Access to my email alone would allow access to other sensitive information, which as a flow on from my emails gives them access to other websites indirectly. Password resets to the email address for other non-Google applications or sites could be performed, as well as the ability to gain access to applications that use your Google account as a “passthrough” login for that application. In addition if you’re part of the “Google-verse” (“luckily” my above friend had just a Hotmail email account ),  access to your Google account gives you access to email and all your other Google apps such as Google+, documents, photos, reader, YouTube, and other info. A bit scary really

Google 2 step authentication works on 2 things, something you know – your password – and something you have – your phone/tablet.

It’s easy to turn on from your Google Account Settings

Once you turn on 2 step authentication, whenever you login to your Google account you put in your normal password and the site will then ask you to enter your authentication code consisting of a 6 digit number.

 

Google Code Verification

This code can be delivered to you in a number of ways:

• SMS to a specified mobile number.

• Voicecall to a specified mobile or land line number.

• Google Authenticator app  for Android/iPod,iPhone,Ipad/Blackberry – This app  generates a real time, time-sensitive code for you to enter based on your account. The system is very similar to the more commercial- and business-related RSA tokens that many enterprise businesses use for their 2 step authentication. It will allow you to create codes for multiple Google accounts if you have them.

 

The Google Authenticator App for Android

So to log in, you need to know your password and also have your mobile phone to receive or generate your 6 digit code. So even if your password is compromised the would be thief still requires to get hold of your phone to finally hijack your account. Each code is only valid for around 30 secs.

You can apply this code to last up to 30 days, so you won’t get asked for a new verification code again for 30 days on that same machine. If you find yourself having to login to another new machine or onto an public/shared device, then you’ll have to input a verification code again.  On a public machine if you don’t use the 30 day option, the next time you logon to that machine you’ll have to reenter another verification code, something quite handy if you find yourself having to use internet cafes to access you Google account. Even keyloggers will only be able to grab your password, as your verification code you enter will only be valid for a short space of time.

 

Application Specific Code

Some devices and applications won’t let you enter the second security code so you need to create an Application Specific Password (e.g. Gmail login for Android). To enable these to access your Google account you generate a 16 digit alpha/numeric code that you use in place of your normal password. It appears to me that the code is a hash of your user name and what you name the application (e.g. “Gmail for Android Login”).  (As per below discussion it would appear it’s not a hash unless it’s time based as well.  Putting the same application name in gives different codes. Perhaps it is just random). You then use this code rather than your normal password to logon. You normally only have to use this password once, and you can always revoke the pass code if you need to for any reason.

If you’re out of mobile range or you don’t have your phone with you, Google can also supply you with a list of backup codes which you can print or store somewhere were you’d normally have access to it other than your phone.

As an exercise, sit down and work out what information and access would be available should Your Google account be hacked. While there’s a small amount of extra work involved with setting up 2-step verification as well as some extra “work” involved in logging into your Google account, the extra security you get is well worth the effort to protect your sensitive information.

Addendum: 4 Jan 2012  - I’ve just found that the Google Authenticator can also be used as a 2 factor authenticator  for  Lastpass password manager as well

Addendum: 7 Jan 2012 – A quick heads up about using the Authenticator on either multiple or on new devices.  If you turn on authentication and just follow the instructions on a single device  then when you want to add a new device ( which will happen with upgrades ) or add an additional device then you’ll actually have to turn off verification and recreate your account codes ( only your live ones, not the application specifics ) both on your old and new device.  The trick is that when you initially  turn it on take a screenshot of your bar code and/or the key it gives you and store in a safe place. Then you can just load GA onto your new device and rescan or manually input the account verifications when you create the account in the app.

Filed in categories: Miscellaneous, Reviews

Tagged: Gmail, Google, Internet security, Security

Google 2 Step Authentication Review originally appeared on The Gadgeteer on January 2, 2012 at 8:00 am.

Google has released an update  to their Google+ app for iOS.  Finally  iPad and iPod Touch users can join  Google’s “Facebook Killer”  beta social networking site. That being said it appears that the client isn’t actually optimized for iPad, it’s just a big blown up iPhone version ( but then again the Android app’s not optimized for Google’s own Honeycomb yet either  )

Can Google+  replace Facebook as the social network of choice ?

Available now from the Apple ITunes Store.

Filed in categories: iPhone, iPad, iPod related, News

Tagged: Google

Apple iPad and iTouch Users can join the Google+ Circle originally appeared on The Gadgeteer on August 10, 2011 at 3:00 pm.

Forbes is reporting that Google is unhappy with the Android Market. Apparently, people don’t like paying for Apps. (who knew?) Android’s Platform Manager said there will be changes in the future including Carrier billing and In-app payments. My guess is you are going to start to see a lot of cool little apps suddenly cost $0.99! Google will be banking on users making impulse purchases when they don’t have to pay up front and just have it added to their bill at the end of the month (Bill Shock).

Apple has been very much more successful at having most applications actually cost money and developers are eager to continue to produce for the platform because of it. Looks like Google finally wants to make some money off Android.

Filed in categories: Android related, News

Tagged: Android, Google, News

Google making Changes to Android Market originally appeared on The Gadgeteer on January 27, 2011 at 8:30 am.

Maybe this doesn’t technically count as a gadget….but… I live in probably the largest metropolitan area in the country without subway/light rail public transportation, the Detroit Metropolitan area.  “Car Capital” means you travel in this area by CAR. Public transportation be damned. Fortunately I have visited many major cities worldwide and have seen some awesome public transportation systems; among the best, Moscow and Seoul, Korea.  Frankly, I love figuring the systems out.  Sometimes, in planning a trip, I have tried to find out routes beforehand to make sure I can get where I want by public transportation- you know, do I need to rent a car or not, etc.

Recently I was planning a trip to Salt Lake City for work.  I wanted to see how I could get to where I’m staying to see a Utah Jazz game.  I spent some time looking through the websites for Utah public transportation, trying to see if I could get where I wanted to go.  They had a “plan your trip” tab which was worthless basically (as were a few for other cities I have tried).  Then I went to one of my favorite map sites Google Maps.  One of their options for seeking the directions you want from place to place (besides driving and walking) is…Public Transportation!  What I had looked for for 20 minutes I found in 20 seconds there.  Route numbers, bus lines, bus #, travel time, heck they probably tell you the drivers name if you want. With their system so easy and efficient to use, I’m now going to have to find another way than figuring out subways to feel macho. Perhaps I’ll try to figure out which coffee sizes actually correspond to small, medium and large at Starbucks…

Example: say you are in Chicago and you have an Italian Beef Sandwich at Al’s #1 Beef, then you think “I could really go for some BBQ at Smoque, wonder how I get there?”  A few clicks and you’ve got the directions! Don’t forget the napkins!

Filed in categories: Miscellaneous, News

Tagged: Google

How to Get Great Public Transportation Directions originally appeared on The Gadgeteer on August 31, 2010 at 11:00 am.

As if many of us needed another reason to ditch your landline (mine is gone), Google announced on Wednesday that customers will now be able to make phone calls through their G-Mail accounts!  If you have a G-Mail account you will now be able to make free calls domestically and to Canada using their computers built in speaker and microphone, or alternatively with a headset.  Google continues to position itself as your all in one communications tool.

I imagine this will drive some folks to stick their landline phones up in the attic, but may also challenge other online services such as Vonage and Skype.

Filed in categories: Miscellaneous, News

Tagged: Google

Ditch The Landline! originally appeared on The Gadgeteer on August 26, 2010 at 8:37 pm.

Despite their stronghold in the world of email, mapping, photo-sharing, etc., Google has decided to up the ante and delve into the craze that is social-networking. Enter Google Buzz. Rather than operating as a stand-alone website, Buzz is streamlined into Gmail’s web interface.  Status updates, Picasa albums, Google Reader pages, and links to sites like Twitter and Flickr are streamed (or “buzzed”) to selected contacts in real-time.  Think of it as a marriage between Twitter and Facebook, built directly into the Gmail interface.  Could Google Buzz be a hit or are the folks from Mountain View a little late to the party?  Will you try it?

Filed in categories: Miscellaneous, News

Tagged: Google, Social Networking

The Next Step in Global Domination: Google Buzz originally appeared on The Gadgeteer on February 9, 2010 at 9:43 pm.

According to a story on CNNMoney, Google announced – two days before Apple announced the iPad – they are also entering the tablet arena.  Google has announced they are working on a proprietary, open-source operating system.  The Chrome OS will focus on netbooks, but will probably also work for a variety of other devices, including tablets.  As with the Android system, it seems that Google will provide the operating system and others will provide the hardware to run it.  Chrome OS should be released late 2010, and concept designs for the table showed multiple open windows.  Read the story on CNNMoney for more details.

Filed in categories: Handheld PCs / Ultra Portables, News

Tagged: Chrome OS, Google, Tablet

Will There Be a Google Tablet? originally appeared on The Gadgeteer on February 4, 2010 at 9:19 pm.

Once I had completed my week with the Blackberry Storm, I asked everyone for some advice on which phone they thought I should choose for my next review. After a few days, the overwhelming choice was the Android G1 Smartphone otherwise known as the Google phone. I’m going to try it out for the next 7 days and let you know my experiences.

The G1 was originally released by T-mobile and locked to their network. Since I’m an AT&T customer and we don’t even have T-mobile coverage in my area, I figured I’d have to wait until unlocked versions of this phone showed up on eBay before I’d be able to get my hands on one.

But now it’s even easier to get an unlocked G1… You just sign up as a developer at the Android Market. Don’t worry, you don’t have to prove that you can write a Hello World program in C++ or anything like that. You just login, sign-up, pay the $25 registration fee and presto, you’re a bona fide G1 developer.  Then you can immediately buy a totally unlocked G1 for $399, which is just what I did.

Day Zero – Hardware Tour

I haven’t included a picture of the box because it’s a totally unbranded, White box. Not exactly exciting…

Specifications

Processor: Qualcomm MSM7201A, 528 MHz
Operating System: Android
Memory: ROM: 256 MB, RAM: 92 MB
Dimensions: (LxWxT) 117.7 mm x 55.7 mm x 17.1 mm (4.60 in x 2.16 in x 0.62 in)
Weight: 158 grams (5.60 ounces) with battery
Display: 3.2-inch TFT-LCD flat touch-sensitive screen with 320 x 480 (HVGA) resolution
Network:
HSPA/WCDMA: Europe: 2100 MHz, US:1700/2100 MHz
Up to 7.2 Mbps down-link (HSDPA) and 2 Mbps up-link (HSUPA) speeds
Quad-band GSM/GPRS/EDGE: 850/900/1800/1900 MHz
Connectivity: Bluetooth 2.0 with Enhanced Data Rate
Wi-Fi: 802.11b/g
Camera: 3.2 megapixel color camera with auto focus
Audio: Built-in microphone and speaker
Ring tone formats: AAC, AAC+, AMR-NB, MIDI, MP3, WMA, WMV
40 polyphonic and standard MIDI format 0 and 1 (SMF)/SP MIDI
Battery: Rechargeable Lithium-ion battery 1150 mAh
Talk time: Up to 350 minutes for WCDMA, Up to 406 minutes for GSM
Standby time: Up to 402 hours for WCDMA, Up to 319 hours for GSM
Expansion Slot: microSD memory card (SD 2.0 compatible)
AC Adapter Voltage range/frequency: 100 ~ 240V AC, 50/60 Hz
DC output: 5V and 1A

Package Contents

G1 Phone
Battery
USB Cable
AC Adapter (not shown)
Earbuds / microphone with earbud covers
Setup Guide

You might be wondering how the developer’s version of the G1 differs from the T-mobile consumer version. For one thing, it has a special bootloader that developers will appreciate. Me, I’m not a developer, so I care not. The obvious difference is the color. The dev phone is dark gray, while the T-mobile G1 is available in Black, White and Bronze. There are some software differences that I’ll get to later on in this series.

When you look at the G1, the words sexy, flashy, chic and cool probably do not pop in your head. This phone is about as far from sexy as a phone can be. It looks like it would be right at home in a soldier’s hand given the military-esqe design it seems to ooze.

The case is plastic, with a matte finish. The front has the 3.2 inch touchscreen display, with a panel of buttons below it.

There is a Menu button at the top, a roller ball in the center and two buttons on either side. The menu button will bring up a menu for whatever application / screen that you happen to be on. The roller ball is a slightly springy hard trackball like cursor mechanism. You can roll it continuously and also press it as a select. The buttons on either side of the roller ball are hard flat back lit buttons. Pressing all the buttons except the roller ball will wake up the phone when it is in standby.

The back of the dev phone has a wild design printed on it along with the little Android mascot. This back cover can be removed (takes some practice) to get to the battery and SIM slot. The cover is made of flexible plastic and feels like it has a very thin layer of grippy rubber on it.

Just to give you a idea of the size of the G1, here we have it next to the original iPhone. The G1 is a bit narrower…

But definitely thicker.

The G1 has an interesting shape. It has a ‘chin’ at the bottom edge. On the Left side there is a slightly raised one piece volume control button.

On the opposite side towards the ‘chin’ is a small camera launch / shutter button. This button is a little awkward to press and doesn’t have very good tactile feedback.

If you take a look at the bottom edge of the G1, you’ll see the microphone and the mini USB connector cover.

The cover is tethered to the phone by a short length of plastic. One annoying thing that I need to mention is that the G1 does not have an earphone jack. The included earphones / mic use the USB connector. Bleh! I hate it when devices don’t have standard ports.

The G1′s screen slides sideways to reveal a backlit QWERTY keyboard.

The sliding mechanism feels pretty robust. It slides open and closed with a strong click.

Click thumbnails to see full size images

The keys are hard plastic and have a matte finish that makes it easy to see the silkscreened letters in almost any light. Even though the keys are small and very flat, I haven’t had any problems typing as they have good tactile feedback.

The microSD slot is hidden in the bottom right corner of the ‘chin’. You have to slide the keyboard open in order to open the slot. Included with the phone is a 1GB card.

In hand, the Android G1 feels solid (like a tank). It doesn’t rattle when you shake it and passes the gadgeteer squeeze test if you don’t count the slight sliding of the screen. Holding the phone to make calls feels pretty comfortable.

You can slide the screen sideways to access the keyboard with one hand. But to type and access the other buttons with the keyboard exposed is pretty difficult. The G1 isn’t a good one-handed phone in that respect. In my opinion, some of the best one handed phones are the Palm Treos and the Centro.  I guess that’s why I continue to go back to them.

That’s it for the hardware tour. I’ll be back with my Day 1 and 2 impressions, which will include:

• Moving my calendar and contact info from my Mac to the fluffy Google cloud
• First impressions of the user interface
• Using the keyboard

Filed in categories: Android related

Tagged: Android, G1, Google, GSM

A Week with the Android G1 Smartphone originally appeared on The Gadgeteer on January 23, 2009 at 9:56 pm.