GMail can be key to your digital life

Matt Honan (Wired) has this heart wrenching story of his digital life being erased. The door to this tragedy was his gmail account.
http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/

You have heard this story from many channels (twitter, facebook, email forwards etc). So I won't repeat it.

But I do recommend enabling two factor authentication on your gmail account.  It is additional inconvenience that is necessary to safeguard your gmail account and potentially your intertwined digital life.

If you have a smartphone such as iphone or android, do not forget to review the section on Google Authenticator.


Perform the following steps:
1) Log into your gmail account.
2) Go to settings via
https://support.google.com/accounts/bin/answer.py?hl=en&answer=180744&topic=1056283&rd=1
3) Now start the two step process by giving a phone number (such as mobile).
4) Get the code via sms or voice.  Activate your account.
5) Two step authentication is enabled for your gmail account.  You may want to set "trust the computer" you are using.

Now for each additional device such as iphone or android or ipad you use to get email addresses, you can generate application specific passwords.
https://accounts.google.com/IssuedAuthSubTokens#accesscodes

This is one time setup for each device.  Hopefully, you should change this quarterly.

Google Authenticator (Smartphone Users)

Instead of using a call from Google each time you login from an unknown location or device, you can use the "Google Authenticator" mobile app available in the iphone app store and Android Market.

1) Download "Google Authenticator" from your app store.
2) Log into gmail account.
3) https://accounts.google.com/b/0/SmsAuthConfig
4) Start the Authenticator App.
5) Press the + button.  Then press the "Scan the barcode" button.
6) Scan the barcode on the computer using your phone.
7) Once the barcode is scanned, you will get a code displayed on the app.
8) Enter the code into the computer screen in the text box.
9) Click Verify.

PicketLink and Salesforce/Google Apps Integration

Marek Posolda from the GateIn team has created an excellent article on integrating salesforce or google apps with JBoss.  It is done via project PicketLink.

The article is at https://docs.jboss.org/author/display/PLINK/3rd+party+integration

Marek also talks about GateIn integration with Salesforce and Google Apps using PicketLink at https://community.jboss.org/wiki/GateInSSOIntegrationWithSalesforceAndGoogleApps

References

GateIn SAML Integration Wiki

LinkedIn has a wake up call

All the IPO fun news - soaring personal assets - increasing cash pile must have gone a bit sour at LinkedIn now. They have probably started living on earth now, like the rest of us. I am referring to http://blog.linkedin.com/2012/06/09/an-update-on-taking-steps-to-protect-our-members/  and http://www.nytimes.com/2012/06/11/technology/linkedin-breach-exposes-light-security-even-at-data-companies.html

I have been a LinkedIn member since inception. It feels like close to decade+. I respect and utilize their services on a daily basis. Their advances in technology primarily big data analytics impresses me.

But when customers/users provide you their information, then it is of utmost importance to safeguard it. LinkedIn failed to do that. But they are not alone. Everyday, we hear some data breach. The fundamental problem is that there is no easy way to secure anything. Passwords are useful to achieve the minimum level of security, with minimum set up. But they are not the best forms of security. Working toward preventing data breaches should be part of a daily routine.

The blog post from Vicente is very assuring. In the next few years, LinkedIn will probably have fewer news reports about data breaches. Hopefully, Ganesh Krishnan (from my alma mater, BMSCE) can shine.

What LinkedIn needs to do is take their advances in big data analytics into security intelligence. Salting/Hashing passwords is just the first step. You should incorporate device registration as well as use security analytics to thwart future breaches. Please be the first to show us the way with big data security analytics.

Good Luck to LinkedIn!

(Now can we please do something about the "Who viewed your profile?" leaks on LinkedIn on mobile apps?).