android – Cubicgarden.com…

Why is Slack storing passwords in plain text on Android devices?

https://mas.to/@cubicgarden/105712244073779967

I posted about Slack’s bug on mastodon. I knew this was going to be a pain the ass changing all those passwords, even with them all sitting in my password manager and most using 2fa.

However some of the users of Mastodon asked the question, why does the Slack app store the passwords on the device at all?

I thought about this and they are right. The app connects to a remote server and should request the user login. Once logged in, it should provide some kind of secure key/cookie/hash on the device not the actual password. On top of this, it certainly shouldn’t be in the form of plaintext.

Mistake, bug or not, this should not happen.

Schedule messages on Android

This slideshow requires JavaScript.

Happy to see Google messages getting schedule messages at long last. Its been a long time in coming after Gmail’s schedule send last year.I have been using the beta and enjoying sending messages at 1am for a quite some time now.

Be great if Signal also added scheduling, although I did buy tasker to solve the scheduling of text and signal but haven’t sat down and played with it yet.

Public Service Internet monthly newsletter (Oct 2020)

We live in incredible times with such possibilities that is clear. Although its easily dismissed seeing the endless press about Bytedance’s tiktok distracting us from the more important developments.

To quote Buckminster Fuller “You never change things by fighting the existing reality. To change something, build a new model that makes the existing model obsolete.”

You are seeing aspects of this happening with people rethinking systems they are using such as Zoom for Education and android without google.

The net of a thousand lie in full

Ian thinks: Cory pretty much covers Surveillance Capitalism but then turns to focus on the problem of monopolies as the heart of the problem. He’s got a real point which he builds very nicely on throughout this free book. I know Cory’s kickstarter for the next little brother book could do with some support too.

The start of a manifesto for digital autonomy?

Ian thinks: This sums up a lot of the issues people have with technology today by seeking to empowering people, focus on privacy by design, increase legibility and avoiding lock-in. Its version 0.1, and can learn more in their talk.

Mozilla CEO urges EU Commission to double down on a better internet

Ian thinks: Mozilla’s interest in Europe is clear to see. The recommendations from Mitch Baker are well reasoned although I haven’t heard much since. One to watch for the future.

Ransomware isn’t just painful its a killer

Ian thinks: Its clear the ransomware wasn’t deliberately sent to kill but the death in Germany does raise a possible scary future. Man slaughter, murder, what would you call this?

The thriving and wilting worlds

Ian thinks: Been recently discovering Anand Giridharadas and this brave talk to the wealthy Aspen Institute criticising them is where his book winner takes all started.

How Tiktok works and how it fits with the splintered internet

Ian thinks: I wasn’t going to talk about Tiktok but I found this Vox video documentary raised much deeper profound questions about the splinternet.

Refreshing look at Citizenship

Ian thinks: Its always refreshing to hear important discussions in different places. Citizenship discussed on the guilty feminists podcast is a mix of fun and deeper conversations. Well worth listening to, always but especially this one.

New open source tool for Tracking Disinformation

Ian thinks: Mozilla are regulars in my public service internet notes and for good reason. The Social Media Analysis Toolkit (SMAT) could be extremely powerful to shine a light on the social dilemma we all face looking at in our timelines. On a related note is data futures lab launch.

Ian thinks: Good Netflix documentary, however I felt like it wasn’t as good as the HBO’s after truth. The family sections make it more tangible but I felt the dilemma was being told the problem by creators and investors of the problems. Problematic? I’m not the only one. Also worth listening to Team Humans writer Douglas Rushkoff’s thoughts too.

Find the archives here

Only 5 months later and face unlock is fixed

Its one of those things which I wasn’t happy about with my Pixel4. Who on earth over looked the fact you could use the face unlock without your eyes open! It doesn’t take a lot to think about the abuses including spouses with trust issues.

Finally over the last few days Google rolled out a fix which requires your eyes open if you enable it! Only 5 moths later

It was the first thing I did when I installed the update. Till that point I’ve been enabling lockdown mode when going through sensitive areas like airport security

/e/OS: The beauty of open source

I was quite impressed with the /e/OS project. I hadn’t really heard of it before but as I’m considering the balanced of google service and data in my life; especially with the plans to move UK citizens data/accounts outside the EU.

Taking the AOSP Android Open Source project and removing all the google parts is quite impressive. A real testament to the power of open source.

The interview with itsfoss is a good read, starting off with the question of what and why

Why did you create this Eelo or /e/ project in the first place?

Gael: In 2017, I realized that using Android and iPhone, Google and many mobile apps was not compatible with my personal privacy.

A later study by a US University confirmed this: using an iPhone or and Android phone sends between 6 to 12 MB of personal data to Google servers, daily! And this doesn’t count mobile apps.

So I looked for reasonable alternatives to iPhone and Android phones but didn’t find any. Either I found options for hobbyists, like Ubuntu Touch, that were not compatible with existing apps and not fully unGoogled either. Or there were alternative ROMs with all the Google fat inside, and no associated basic online services that could be used without tweaking the system.

Therefore, an idea came to mind: why not fork Android, remove all the Google features, even low level, such as connectivity check, DNS…, replace default apps with more virtuous apps, add basic online services, and integrate all this into a consistent form that could be used by Mum and Dad and any people without tech or expert knowledge?

I’d be interesting in what apps run on the operating system, as Google really have embedded Play services into everything now. When I first got my recent e-reader, it came with its own app store till you enable play services. That store was super small but it doesn’t have to be that way if you look at F-droid for example.

If I still had my Nexus 5x, I would likely give /e/os a try. I could run it on my Nexus 5 I guess but the screen is maybe too broken.

I have been thinking, following my use of Firefox multiple account containers use. Maybe something of a mashup of Blackberry’s Android profiles (anyone remember this?) and Firefox containers.

This certainly feels like a design challenge which could be massively beneficial to many, and showcase the beauty of opensource

Do I like my Likebook Mars ebook reader?

I recently bought the Likebook Mars ebook reader to replace my ENERGY SISTEM ebook reader. Why did I do this?

Well I liked my energy sistem as it was my very first android eink reader and fore-filled almost everything I was wishing for in a ereader. Its a great device but I found my reading habits changing. I mainly consume longer media content via audio or video rather than textual. I like text for reference, storage, retrieval and share ability. But my consumption was mainly aural. The Enegry sistem has no audio support at all, meaning I would use my phone for audio and occasionally look at the eink screen.

If I could have a ereader with audio too, that would be great for syncing and keep a track of things. Hence when I saw the Likebook (yeah I think its a silly name too) I consider it and bought it a few months later. Of course I’m selling my old ereader on ebay if interested.

After my research I knew I could do everything my previous one could do but also with the updated Android 6 operating system and more power might be able to run some apps which didn’t install or run previously. Its a very good device and the audio is spot on with my bluetooth headphones and a fallback analogue audio jack. At first I had some difficulty getting the google play store working but before I checked out the tutorials, I stumbled on the right settings, logged in and that was that.

The next problem wasn’t to do with the ereader but wallabag, which returned a error every time I synced. Finally after exporting then deleting a lot of archived pieces. This took a long time to diagnose and get sorted hence the long silence during the start of December on this blog.

Google play store on the likebook

Finally its all running correctly and I have almost everything on it.

I really like the fact there is now a lock screen because the previous one didn’t and I had to restrict a lot of its operations just incase. For example I disabled Gmail & Gdrive on it just incase. I know some of you will scream its running Android 6, so its game over anyway. But the previous one was running Android 4! I have taken care with the likebook but feel better about drivebys (as such). The amount of internal memory really helps as I can now stick ebooks and audiobooks on the same drive. Theres also a SD slot if more memory is ever needed. I can even put my VPN apps on it which is fantastic news.

Its a good device and now its settling down to its weeks of battery life after all the wallabag syncing.

IMG_20191220_191755

The only thing I miss really is the size of the device is 7.8 inches instead of 7 inches which makes it too big for my pockets including my jacket pocket. Weirdly enough, it almost fits in my headphones pouch, providing some protection from scratches in my laptop bag.

I like it so far… not quite over the mars about it but its growing on me.

A unscientific test: 90hz displays does it matter

I found this from Android Authority pretty good, I turned off 90hz display on my Google Pixel 4 ages from day one to help with the battery life. Its likely my good eyes would tell the difference but is it worth more than the battery life of the phone?

I think not… of course the comments begs to differ…

Google Stadia early reviews

There’s been a rash of reviews about Google Stadia but I found Android Authority one of the best video reviews. The verge have good coverage if you prefer to read.

I found data usage quite surprising…

When playing Stadia on my Windows PC through the Chrome browser at 720p, Stadia used between 12 and 20Mbps. In contrast, a Netflix stream used about the same amount, but Netflix can buffer content to stop streaming constantly. Because Stadia is always pulling data and can’t buffer, it will use a lot more data.

You could technically use Stadia connected to a mobile hotspot, but I’d strongly advise against it if you have a limited data plan. Playing Stadia at 720p used about 7GB per hour.

Don’t expect to be playing Stadia at your local coffee shop without some comments or a lot of lag. I wonder if most of the cheap routers can sustain bandwidth like that anyway?

Could a hybrid smartwatch be a replacement for the pebble?

I was reading about the Fossil hybrid HR smartwatch recently, and on the face of it (pun intended) it looks like a good smartwatch with all the features I would be after to replace my pebble smartwatch.

What’s the difference between a hybrid smartwatch and a regular smartwatch? In the hybrid category, Fossil’s Hybrid HR mixes physical watch hands with an always-on display that shows information and notifications. It almost feels like an old-school Pebble watch fused with an everyday analog-style watch.

I always swear by eink for these type of things, and I’m happy to hear its using eink too.

Keeping a smartwatch charged is incredibly annoying. Fossil’s newest line of hybrid smartwatches may have found an answer, and it’s E Ink. The Hybrid HR’s added display feels less like a screen and more of an extension of the watch, the sort of basic readouts that you might expect on a digital watch. Or, like what Google’s Wear OS watches offer, but in E Ink. To be clear, though, this isn’t Wear OS. It almost reminds me of what the TicWatch Pro tried for by layering an always-on display on top of a feature-packed smartwatch, but the Hybrid HR looks a lot nicer.

Earlier this year, Google reportedly paid $40 million for Fossil smartwatch technology that could enable hybrid watches. The Hybrid HR looks like it is, indeed, the watch tech that earlier reports thought Google was interested in… and it’s here now.

I will be keeping en eye on this category, because although I like the Hybrid HR, I’m not so keen on round faces and I’d need to get a sense if theres sleep tracking support? Or more so if theres going to be a standard for watch apps like WearOS and the Pebble OS.

Pebble 2 smartwatch won’t re-connect after Android 10

I like many Google Pixel users recently got the Android 10 upgrade. It was smooth and everything was in order except there was a notification that the Pebble/Rebble smartwatch software may need to be upgraded as it might be incompatible with the Android 10.

What follows was a long painful process trying to pair the Pebble 2 with my Pixel 2 phone. It took forever and ended up with me unpairing both rebooting both and repairing the whole lot again. Nothing was lost in the process but its a real painful process and I thought, once its done, its done forever.

However I was wrong. It seems like this happens every few weeks? Others have suggested it happens when the Pixel doesn’t see the pebble for a little while. Someone started a bug issue with Google, thankfully and I added my own comment to the growing list.

If you are having similar issues, do add a comment to show Google there is a problem and maybe the Bluetooth LE stack might be at fault? Although I’ve not had a problem with my Motiv Ring yet?

Google takeout to the rescue?

So recently I’ve gone into Quantified Self overload with my new Motiv Ring, added to my Pebble smartwatch for sleep tracking.

The ring is very good, but the app isn’t the best, its seems to work but isn’t very clear when its not syncing with the ring. Also I knew the 2 day battery was going to be a pain but to date I’ve been charging it every 2 days and never got to the point where its gotten below 44%.

As the app is pretty rubbish, I have sent everything to Google fit. I pretty much have everything synced with Google fit now.

The first time I noticed it was all working, was when I looked at sleep as android which I use with my pebble smartwatch and noticed my heart rate over the top of my sleep data.

Sleep data with heart rate — I warn you the sleep is a mess due to my flu I currently have… also why I’ve not blogged those great conferences I’ve been to recently.

Likewise I recently hooked up my Withings/Nokia iot scale to Google fit. The scale has its own app which isn’t bad but frankly its not great. It suffers from the similar problems as most of the quantified apps attached to a device or service; they want to be the centre of the world. Reminds me of my Fitbit which import everything but export little.

I understand Google fit is mining the heck out of my quantified data but with Google takeout, I can get the raw numbers in one place. Everyone wants to sync with Google fit and the dashboard view is far better than what everyone else right now.

I’ve also set it up to send me an update every 2 months. Now that’s pretty neat. Would I pay for a service to do this? Yes I would, how much is the question…

Google Titan key security problem?

I was sure I tooted/tweet a thank you to the Google team in Berlin’s Re:publica conference. But it looks like it never quite happened due to connectivity issues with the wifi at certain points of the day.

So first of all I want to say thanks for giving me a titan security key for spending time listening to what changes Google had made to their security as announced in Google IO 2019.

I was surprised to see Google there with all the ill feeling about the 5 stacks, their monopoly and business practice.

But before I could get home try the key/system, I saw a bunch of problems with the key.

Google Titan Bluetooth Security Key Can Be Used to Hack Paired Devices

Titan-ic disaster: Bluetooth blunder sinks Google’s 2FA keys, free replacements offered

Obviously I was a little concerned, although I had not added the titan key to my google 2 factor auth yet.

After a bunch of reading, it seems its not completely flawed. The Google security blog confirms my research.

The problem is with the Bluetooth fob which to be honest is super convenient wasn’t the most secure idea in the world. The bluetooth stack is limited in its range but because of that, its not got as much security as most things on the net.

Due to a misconfiguration in the Titan Security Keys’ Bluetooth pairing protocols, it is possible for an attacker who is physically close to you at the moment you use your security key — within approximately 30 feet — to (a) communicate with your security key, or (b) communicate with the device to which your key is paired. In order for the misconfiguration to be exploited, an attacker would have to align a series of events in close coordination:

When you’re trying to sign into an account on your device, you are normally asked to press the button on your BLE security key to activate it. An attacker in close physical proximity at that moment in time can potentially connect their own device to your affected security key before your own device connects. In this set of circumstances, the attacker could sign into your account using their own device if the attacker somehow already obtained your username and password and could time these events exactly.

Before you can use your security key, it must be paired to your device. Once paired, an attacker in close physical proximity to you could use their device to masquerade as your affected security key and connect to your device at the moment you are asked to press the button on your key. After that, they could attempt to change their device to appear as a Bluetooth keyboard or mouse and potentially take actions on your device.

This all being a big mistake, Google has offered a replacement key. However because my key hasn’t been added to my account yet, I get a message saying no action is required but a email to override this. However after double checking my key is a type T3 meaning it wasn’t effected.

Good work Google…

If you are using whatsapp… update now and consider swapping to Signal!

Whatsapp, never used it never will. But I know many many of my friends do – please do update! Or even better dump it and use Signal messenger.

A security flaw in WhatsApp can be, and has been, exploited to inject spyware into victims’ smartphones: all a snoop needs to do is make a booby-trapped voice call to a target’s number, and they’re in. The victim doesn’t need to do a thing other than leave their phone on.

The Facebook-owned software suffers from a classic buffer overflow weakness. This means a successful hacker can hijack the application to run malicious code that pores over encrypted chats, eavesdrops on calls, turns on the microphone and camera, accesses photos, contacts, and other information on a handheld, and potentially further compromises the device. Call logs can be altered, too, to hide the method of infection.

The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

I bought a Chromebook

https://www.youtube.com/watch?v=YDIhZZJQWRw

The other day my work Dell XPS 13 which has been running Ubuntu 16.04.1 asked me to upgrade. This message has been coming up for a while but I decided it was time for a upgrade, 18.04 was running well on my server and well it was time.

However the upgrade broke and I was left with Ubuntu 18.04 with Busybox. I had backups but as it was a BBC R&D build of Ubuntu, I needed to go to work for them to reinstall it. All of this was just before I went away to Mydata 2018 in Helsinki. On top of that my ubuntu server also had a problem.

Ubuntu server down again, really need to switch to newer hardware 😣

— Ian Forrester (@cubicgarden) August 3, 2018

Double wammy!

It was clear I could reinstall Ubuntu quickly but I would need to do a bunch of configuration and that takes time. I have a task to create a live CD with a bunch of configurations just for me, incase similar happens again.

I’d been looking at Chromebooks since I bought one for my parents ages ago and seen how ChromeOS has matured. I’m not the only one. It was the ability to run Android and Linux apps which pushed to get one.

Google Makes it Easier to Run Linux Apps on Chromebooks

So I bought the Asus chromebook flip c302, and I’m quite impressed with it. The size is good and the performance is good. As a backup laptop its ideal. It also kinda a solution to my lack of a decent tablet now my Nexus 7 is pretty much dead. I was tempted with the Google Pixelbook but it seemed too close to what the Dell XPS 13 is for.

I did consider getting a second hand XPS and sticking ChromeOS on it myself actually.

How I listen to podcasts in 2018

I had quite a bit of time to read and listen to podcasts during my holiday in Portugal and Spain. One of the posts I read was Adrian talking about current his tech stack.

But I thought it might be good to talk about how I finally sorted out my podcast setup as it includes many parts of my current tech stack.

I listen to podcasts and audiobooks quite a lot. If I was still using last.fm I could likely quantify exactly how much but through my setup I’ll reveal a rough number at the end.

Listening devices

I listen to podcasts in the morning via Xbian running on Raspberry Pi 2 (considering switching to rasplex but Yaste remote supports Plex and Xbian as a audio endpoint/upnp renderer) which I bought a long while ago. This is setup in my room via ethernet and connected to a small amp and stereo speakers, one in my bedroom and one wired into the bathroom. I decided to do this after trying Bluetooth and FM speakers but they were just too quiet or unclear. Nothing beats a dedicated non-battery device. The wiring could do with a clean up. The Raspberry Pi is also connected to a audio splitter with one going to a FM transmitter.

This broadcasts to my little micro-hifi in the kitchen which I got from ebay over 10 years ago; its handy for multi-room synced audio without messing around (although I considered using a Chromecast audio and other things). The small amp in my room is connected to a TpLink HS100 smart switch meaning I can turn it off when leaving easily and quickly. I have only set it up for local wifi access not remote access, because frankly why would I need to this?

When not at home I use Google Pixel 2, I decided to get the 128gig version because I had enough of dealing with space issues. I have plex client installed and I have a plex pass (life time subscription), so can sync podcasts and audiobooks with ease. I do have it on my Nexus 7 and 5x too, but don’t carry them around much. I find Plex client is pretty good and doesn’t eat too much battery. Syncing seems seamless but with offline support sync support and 12gig of mobile 4G data. Because its using Plex at the backend, plex will save position no matter what device, as I’m logged in using the same account.

I also have Chrome Plex client on my laptop, meaning I can keep on listening when at work. Yes I listen to podcasts and audiobooks while working. I know many find this unthinkable but it works for me.

Plex Media Server

I’ve had Plex mediaserver running for quite a long time now and the advantages of having a gigabit internet connection and decent vpn (zerotier) means I can stream, sync or download podcasts and audiobooks without any fuss to my own devices. Plex media server keeps the position and checks for updates to the server filesystem.
Plex indexes the podcasts and audiobooks as audio and with some tweaking works quite well, although it can get confused when podcasts numbering and dates. It would be great if it had a audiobook and podcast indexer to pull much more metadata.

Podcatching

Unfortunately Plex media server doesn’t actually support podcasts which would be great if it did but its a pain to get working and not worth it for me. Especially because I have a complete Ubuntu stack its running on.
Because of this I use to download the podcasts from the web using a native ubuntu app. I tried Gpodder and Rhythmbox but they were resource hungry when downloading 30+ podcasts. Then tried VLC but it seemed over kill just to download podcasts. So tried some command line programs including Podfox and podcatcher. In the end I used Podget then setup a cron to trigger it every 2-4 hours. I also have Podget clean up the podcasts every 3 months.

One of the biggest things which drove me nuts was adding and updating rss feeds. Someone says you listen to the guilty feminist podcast, and would have to update server configs, etc. But using my Tiny tiny RSS install, I now have all the podcasts added to the master subscription list and generate a custom RSS feed aggregated for podcasts. I add the generated feed to Podget and the next time its updated, it will automatically add new items.

Because its done via TTRSS, it means I can add & remove the feed via any TTRSS client including the one my phone or using the web interface via my VPN (I only expose the web interface that way).

Small pieces loosely joined

It sounds like a lot of work but honestly it works well and means I can remove a part of it and it will still work. Remove Podget, could be replaced with anything including VLC, etc. Plex could be replaced with Emby or another mediaserver. TTRSS could be anything self-hosted. Using Plexpy to log is under my own terms and the data is only shared and useable by me.

I do wish I could get to this type of space with so much more of the services I use. Right now, I’m quite impressed with how smooth everything works.

Looking forward

I’m looking at a way to tag and generate a feed out of the tags in TTRSS, instead of adding it to a hierarchy. Sometimes a feed could fit between two or more places. I’d also like to improve plex’s indexing around podcasts and audiobooks. Podget generates a m3u playlist file but not found much use for these yet. I also wish the plex input for kodi was less heavy.

I just added the Recode podcast while writing this post and I looking at my plex client on my Pixel 2. Podget downloaded all the episodes over my gigabit connection in about 6mins flat, the podget won’t remove them till a few months old but I can easily remove them via plex or directly from the file system over the VPN.

As promised, looking at Tautulli (what use to be PlexPy). Over the last 3 weeks I had 83 plays or 22 hrs 14 mins of playback. The last podcast I listened to while on the Madrid Metro to the airport at 7:30am was Rob Reid’s Always on podcast – Episode 23: Rodney Brooks | Robotics & AI – Their Present & Future

Not enough detail?

If you are interested in any detail, just comment or tweet me for more info.