Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Wednesday, 14 May 2014

MomoLondon: Cloud Computing & Mobile

A new venue tonight — up on the 9th floor of Google’s Central St Giles office. They even provided good food for the hungry mobile mondayers…

The evening’s focus was on Cloud Computing and Mobile, and the questions seemed to focus mainly on the cloud with not much discussion about how it related to mobile. The chair, Camille, kept the discussion moving along briskly, but we didn’t really get into any depth on any of the subjects. Maybe the audience could smell the food!

The panel

  • Chair: Camille Mendler @cmendler
    • Principal Analyst at Informa
  • Rob Easton @Cloud_Easton
    • Head of Google Cloud Platform UK & Ireland
    • Eurovision app used App Engine for back-end
  • Dr Janko Mrsic-Flogel
    • CEO of Private Planet — personal cloud
    • 7 out of 10 carriers are providing a personal cloud solution
  • Caroline Van Den Bergh @GoldenGekko
    • Golden Gekko mobile agency
    • 85% of apps we build are based on Google App Engine
  • Jonathan Raper @MadProf

outages & availability

  • JR: best service providers are those that communicate well when things go wrong
    • one provider went down and didn’t tell us anything for an hour

looking forward

  • RE: google datacentres include a new one in Taiwan at 15 hectares
    • green computing
    • Google can provide very low latency
    • enables reaching out to new business areas such as the film industry
  • JR: still talking quite aggregated performance measures
    • can’t ask for X many transactions for Y pounds
    • not that detailed
    • next step may be platform products
  • CVDB: mobile enterprise software saving two days a week
    • managing remote teams
  • JR: sometimes blame is shifted between telcos & cloud
    • would like to have better tracing
  • JMF: Private Planet have a totally green datacentre in Telecity in Holland for T-Mobile

internet of things

  • JR: the problem is trading information
    • automatically discovering different feeds & blending them
    • spend 3 weeks integrating code and 3 months arguing over terms & conditions
  • CVDB: best successes have been smaller ones
  • CM: find my yak in nepal
    • the yak’s don’t talk back — so there’s no privacy issues!
  • RE: getting electricity usage feeds every 10 minutes
  • CVDB: there has been scaremongering around Google capturing data
  • JR: all our data is royalty-free downstream
    • makes it much easier to deal with
  • CM: Copenhagen have bike devices to share traffic information
    • provide individual exercise info
    • but also shared with municipality
  • JR: Waze has lots of complicated terms & conditions
    • data is available but locked up

the next generation

  • CM: has been proved conclusively that 3D gaming improves your cognitive ability
  • JR: …minecraft
  • JR: it’s still a bit like early 2000 — mobile operator walled gardens
    • want to take down the barriers and bring the data silos together
  • CVDB: working with Saga
    • older people have more time, want to delve deeper
    • tablets more popular than mobile phones

data scientists

  • CM: shouldn’t we moving towards everyone manipulating their own data
  • JR: digital literacy is very shallow, especially in highest decision-making tiers

security issue — data protection

  • safe harbour in tatters
  • can’t use the cloud at all if we have any secure data
  • JMF: Private Planet always has data centre in the specific country
    • but are governments the biggest problem? what about the corporates?
  • JR: if you need to do it, in-country encrypted solutions are available
  • RE: sure, there are some workloads that Google can’t take on
    • e.g. we won’t let you audit our data centre
    • so can’t work under FCA regulations
    • over time, some of these regulations are going to change
  • JR: all have to do as much as we can to help the government make the right decisions
  • JR: sometimes the safest place to do something is in the cloud — e.g. running Windows
    • we don’t allow it on any of our machines
    • but it’s great in the cloud!

what if cloud provider company goes bankrupt?

  • JR: escrow
  • JMF: most agreements done via a channel partner — so that partner will continue the service
    • single party relationship is much more complicated
  • RE: cloud business could be bigger than ads for Google
    • SLA penalties are often a percentage of what you pay
    • but if you pay less and less, the SLA means less and less…

is it becoming like supermarket wars?

  • RE: Google reduced prices — and if you use an instance more than 25% per month then get a discount
    • terabyte of storage is $26/month
  • CM: just like a loyalty card…
    • who will be Lidl and who will be Waitrose?

will we still be waiting in several years?

  • JR: overestimate change in the short term and underestimate in the long term — change is stepped
    • sometimes have to wait for the step change in technology or regulation
  • CVDB: business are going to grow up quickly
    • first digital generation CEOs will be around in the next few years

third party dependencies

  • JR: Apple reviews can be capricious
    • if Apple fall out of love with Dropbox, then that could cause a problem for lots of apps
  • JMF: was a huge debate on mobile medical health a while ago
    • then suddenly there was an app that just works
    • and the issues can just disappear
    • gadget-led terms and conditions…?

speed & access?

  • RE: check out server density review
    • blog by someone who reviewed lots of providers and switched to Google
  • CVDB: Golden Gekko mandate that all backends must be on Google App Engine
    • mainly so that clients can scale

new innovations in infrastructure?

  • RE: Google build our own servers
    • apparently they would be the 3rd biggest manufacturers in the world
    • they value new innovation

where is the next growth to make it easier?

  • RE: focused on the developer
  • JMF: If This Then That
    • making cloud development open to the consumer
    • certain mobile operators are understanding this and joining up devices in the home
  • CVDB: finding that parse.com doesn’t suit
    • one size doesn’t quite fit all
    • prefer google’s flexibility

inviting consumers to get more involved

  • CVDB: user testing
    • avoiding ivory tower
    • developed O2 Priority Moments
    • built packaged solutions based on it
    • incentivized behaviour also used in enterprise apps
  • JR: designed a first location bank
    • your own location storage — that you can choose to share
    • (Ed. see also fireeagle)
    • next generation have a different approach to privacy
  • RE: snapchat is a massive google customer
  • audience: teenagers using technology completely differently
    • using snapchat to have a whole conversation
  • RE: snapchat consumes more IT than any banking industry
    • JDI has 10 petabytes on Google cloud
    • consumers of IT will be well away from the enterprise
    • can have failure at a much cheaper cost — can learn more

what financial services are possible in the cloud?

  • RE: restricted by FCA regulations, but other options possible
    • e.g. datasift to search across twitter
    • big challenge to attract IT talent in financial services as there are so many restrictions

skills

  • JR: right now it’s hard to hire — ruby on rails developers are hard to find
    • constraint on development right now
  • CVDB: couldn’t agree more — mobile skills are in short supply

tools for analytics & loyalty/crm

  • looking at how data can be analysed
  • wanting to drive revenue per user
  • wanting to get the right tools in place to complete the feedback loop
  • CVDB: iris solutions company
  • JR: “build it in the cloud, but just don’t tell IT”
  • RE: tableau, BIME, etc. working on top of Google Big Query
    • now a lot cheaper

After the panel discussion

As often happens with Mobile Monday, the discussion after the panel was richer than the panel itself. Some discussion points that came up when I was talking to people afterwards included:

  • How do you balance keeping data on the device and in the cloud, to deal with intermittent network availability?
  • Will the banks get clobbered by more agile personal finance companies that don’t have to worry about so many regulations?
  • Why has it taken Google since 2008 to move from basic App Engine web apps to a full cloud platform?
  • How will Google make more money from Cloud Computing than from Ads? There’s a big market, but the price is dropping…
  • …and on a completely different note, several people were interested in setting up Code Clubs in their local primary schools, but were stretched for time — perhaps they could work together and contribute part-time?

Tuesday, 29 October 2013

Droidcon 2013: Authentication for Droids

Tim Messerschmidt, PayPal @SeraAndroid

Presentation available on slideshare

OAuth2 client libs

Identity

OpenID
  • developed 2005
  • 2012: discovered you can hijack it
  • considered dead :-(
BrowserID & Persona
  • from Mozilla
  • great idea, but nobody really uses it apart from them…
OpenID Connect
  • layer on top of OAuth2
  • http://openid.net/connect
  • still a draft but looks really good
  • has a whole section on session management (i.e. stop allowing that app)

Providers

  • 80-90% via Google, Facebook & Twitter
  • all have their own SDKs that handle the OAuth for you
  • PayPal added a new identity provider
    • provides verified information
  • needs to be best practice to show which information will be shared at each time
  • Blue Inc 2011: Consumer Perceptions of Online Registration and Social Sign-In
    • 45% admit to leaving a website instead of resetting their password or answering security questions
    • 66% think that social sign-in is desirable alternative

Q&A

  • on mobile, app can fake a web view and capture identity
    • this is why facebook goes via app
  • think about different social providers for different countries
    • e.g. baidu for China, yandex for Russia
  • see also Google Authenticator libraries for two factor auth

Thursday, 24 January 2013

MomoLondon: Demo Night 2013

Another fun demo night from Mobile Monday London. Some new ideas and some old — you never know which ones are going to stick!

My bets are on Vyclone and Critical Arc…

Blue Badge Style

Fiona Jarvis & Kishan Gupta @bluebadgestyle

  • a guide for the discerning less able
  • app available for iOS: Blue Badge Style
  • graduated from the Mobile Monday & UCL Mobile Academy
    • (it’s really great! sign up now! :-))
  • social media advisor suggested:
    • video of app to attract people to download
    • RSS feed in app
  • added TTS (but not voiceover?)
  • got 1000 downloads in Nov (PR & press) + 300/month afterwards

Boss Level - Scavengers

Nick Brown @boss_level

http://playscavengers.com

  • game based solely in HTML5
  • aimed at PC, mobiles, tablets & smart TVs
  • want same control system across everything
    • up down left right & select - lowest common denominator
    • fixed 720x720 resolution at the moment (will need to change for different devices)
  • closed alpha at the moment
  • aiming for Kickstarter to raise profile
  • cross between xcom & worms
  • freemium business model with in-game purchases
  • also thinking about a store for game assets
    • there’s a game editor that allows you to completely customise levels and characters
  • would rather not have in-game adverts, but depends on the eyeballs
  • currently two developers

Connecthings

http://www.connecthings.com/

  • NFC tags for street furniture
  • 1500 tags displayed in Strasbourg
  • real-time transport info
  • integrated with cycle info too
  • also has event & POI database
  • POI tags show POI info first, transport tags show transport info first
  • tags have QR codes too
  • license the platform to municipalities
    • though not sure how well it would go down with councils that already have their own portals….

Critical Arc

http://www.criticalarc.com/

  • previous company led security & surveillance for Olympics
  • security & safety in large open spaces
    • e.g. universities
  • define SafeZones where there is a response team available
  • security team have an app to see a situational view of the campus
  • free app to call for help & get notified
  • have created a platform for sharing location and situational information
  • universities are first market
  • no tracking in the background for general public
  • security officers are tracked in the background
  • Wi-Fi positioning covers off GPS issues
  • can report on security staff location — heatmaps etc, can be used to actively plan response

Decibel Analytics

http://www.decibeltechnology.com/analytics/ @decibelanalytic

  • actionable analytics
  • object maps, which integrate with elements on page, to show which are actually being clicked
  • attention maps — shows which areas of page are actually viewed
    • i.e. where is the fold for all your customers…?
  • which content is contributing most to goals & revenue generation
  • can filter by device and by incoming source
  • adding A/B testing soon

Men’s Fitness UK iPad app

Paul Cooper, Design Director, Dennis Publishing @dmfcoops

iPad app: Men’s Fitness UK

  • COPE — create once, publish everywhere
  • Drupal CMS with responsive design & native elements
  • started with The Week (iPhone & iPad)
    • takes one person one day to lay out
    • less than 100Mb an issue
  • now done a monthly magazine — more content
  • Drupal 7 & responsive is a complex thing
  • Adobe DPS takes over a week to lay out an issue of EVO
  • content producers (photogs etc) struggled a little with responsive design, but get training
  • can preview the issue before generating the app
  • looking at licensing the system to other parties
  • developing a system like InDesign that outputs responsive HTML

GO!Enterprise

Globo plc - Enterprise Mobility in a BYOD world

http://goenterpriseserver.com

  • deploy access to back office systems in a secure manner
  • no need for mobile device managment
  • client app available from standard app stores
  • three products:
    • office — point and go
    • mobilizer — development for custom enterprise apps (cross-platform)
    • reach — make apps for customers

Trademob - mobile click fraud protection

Adrienne Gauldie @adriennegauldie (ag@trademob.com)

http://www.trademob.com/

  • did a study in june (6m clicks)
    • 22% accidental (< 0.1%)
    • 10% botnet & hijacked clients
    • 8% server-side fraud
  • can see it from data…
    • e.g. in-app clicks from non-mobile user agents
  • don’t get fraudulent clicks from publishers with real customers
  • building a blacklist of dodgy publishers
  • 100 people in company

Vyclone

http://vyclone.com/ @vyclone

Download the app for iPhone

  • wouldn’t it be amazing if we could make a single video from all the angles at a rock concert…?
  • combine multiple vids in one
    • had 200 people filming a Jason Mraz concert
    • 150 people at Ed Sheeran in Hammersmith Apollo
  • business model:
    • lots of interest from music industry
    • want to get footage and release it to fans for behind the scenes
  • copyright: music industry recognise that this is already happening
    • now they get access to video, so a win-win
    • customers can choose to keep video private, or share with everyone
  • app is winning lots of awards!

AudioSnaps

Marc Sallent, We Choose Fun

http://audiosnaps.com

  • record 5 secs of ambient sound while taking a picture
  • JPEG + MP3 = JPEG! (plus extensions)
    • all devices can still show it
    • web site can play audio with just one line of javascript
  • why not just take a short video?
    • want to capture a moment, not tell a story

Chirp

Geraint, Animal Systems

http://chirp.io

Download the app for iPhone

  • send small amounts of data using sound
  • want to release an API for third parties
  • have an arduino that can chirp
  • teach the machines to sing!

Catch-up with last year’s demos

Two of last year’s Demo Night presenters returned to give us an update. See my notes from last year.

Ko-Su

http://ko-su.com @kosumobile

mobile learning for everyone

  • demoed last year, one month pre-release
  • been accepted into BBC Worldwide Labs
  • material created in lots of countries around the world
  • now “officially out of pre-revenue” (?)

Six-Three

https://six3.tv/

Simon Frost, CTO @spli

  • started out as a private closed network — a messaging thing
  • sports stars started using it to keep in touch with their public, but also to communicate with their private street marketing teams
  • made it onto WAYRA Telefonica business incubator

Tuesday, 4 October 2011

Over The Air 2011: Stolen and lost phones - can mobile phone applications help with the problem?

Detective Sergeant Andy Williams

  • National Mobile Crime Unit – based in Notting Hill
  • Criminals stealing to order
  • Cops are not the most technologically advanced people – when Andy wants something done, he asks his children…
  • in 2001, 45% street crime linked to mobiles
    • this was from the British Crime Survey – not reported crime, but surveyed
  • current stats:
    • 9.7% of all UK crime accounted for by theft of a handset
    • 60% of mobile phones stolen in personal robberies are iPhones or BlackBerrys
      • not just the phone is high value, but the data on the phones
    • avg 8,000 phones stolen every month in london

what happens to stolen phones?

  • used until blocked (by IMEI)
    • IMEI blocking works across UK, 60% of Europe, plus North & South America coming in soon
    • but main export markets are North Africa (mainly Algeria) & Romania
  • some handsets are vulnerable to having their IMEI changed (so can be unblocked)
  • phones used for parts (broken screens, etc)
  • phones used for non-phone functions – mp3 player, etc
  • blocking:
    • operator will block SIM
    • will also request IMEI to be blocked
  • individual can install a theft tracking app, but police would need a signed warrant
    • police can’t monitor 8,000 phones a month
  • IMEIs are personal data in Germany
  • phones offered on eBay, shown as blocked or no signal

immobilise – national property register

http://immobilise.com

  • if device is registered with immobilise, police don’t need to go through RIPA
  • can put anything with a serial number on there
  • can check on people’s phones when stop people on the street
  • private company set up and operated in conjunction with the police

formation of NMPCU

  • initially front line - reducing robbery
  • expanded to all acquisitive crime
  • working at all levels of crime - local through to organised
  • now an offence to offer to reprogram a phone (change the IMEI)

Police Central eCrime Unit

  • trying to combat cyber-criminals
  • looking at denial of service attacks, etc
  • front line police notoriously poor at dealing with cyber crime
  • but no law enforcement agency that specialises in all areas of cyber crime
  • most expertise is in the forensic area
  • judicial system is not set up to deal with cyber crime
  • judicial boundaries don’t help – if online connections are not in UK…
  • recently starting up new kind of officer: Covert Internet Investigator
  • not very many across the country

Case study: organised criminals targeting music events

  • following same bands the whole time
    • bands with mosh pits…
  • Download 2010: 3 people found with 140 phones buried under their tent

Security & new mobile tech

  • Man City gave 20 season ticket holders their tickets on their phone
  • if someone steals your phone, they have access to your wallet, your ticket, your flat…
  • NFC requirements requested by police:
    • PIN required for all payments – not gonna happen!
      • at the moment, 5 payments of £10 until a PIN required
    • capture IMEI during transactions
      • possible but not gonna happen
    • compulsory registration with financial institution
      • may happen

key areas

  • registration at point of sale
  • carphone warehouse register 25,000 phones a day at Xmas
  • only 4 in 10 PIN lock their phone
    • significant barrier
  • locating devices post theft
    • works ok, but not great – won’t work if someone goes into a block of flats
  • identification of a SIM change post theft

checkMEND

http://www.recipero.com/checkmend

  • can find out if an IMEI is stolen
  • some operators run this service for free
  • but otherwise may cost £1 a shot

Monday, 26 October 2009

BarCampLondon7: Social Manipulation on the web and in person

Tim Nash

Social Engineering is still just as valid as ever…

  • If asked for photo ID, people will give it up willingly
  • given a photo ID with details, you can call up somewhere and say you’ve forgotten your ID
  • often the front desk will give you a new ID…
  • people are more likely to buy when there’s an official badge…
    • doesn’t really matter what the badge is
    • virtually no-one who clicks on the badge actually purchases
    • but buy rate will increase anyway
  • paypal did an experiment about a year ago
    • to see if it made a difference to not use the word PayPal on their “paypal verified” badges
    • made no difference to sales conversions
    • click-through rate to paypal went down
  • certain colours affect buying moods
    • brain doesn’t like bright colours
    • big red “buy now” button does not attract people — your eyes will avoid it
    • instead have a big grey “buy now” button with two red arrows on either side
    • eye tracking study shows people look for price and “buy now” button
    • sales rates go up when the price is just above the buy now button
  • best place for comments on a blog:
    • new comment box just under post
    • other comments can be down the side
  • use the word “reply” rather than “submit” comment
  • scienceforseo blog
    • highlight a part of the text and the comment will appear alongside