Links

Two major secure e-mail service providers on Thursday took the extraordinary step of shutting down service.

A Texas-based company called Lavabit, which was reportedly used by Edward J. Snowden, announced its suspension Thursday afternoon, citing concerns about secret government court orders.

By evening, Silent Circle, a Maryland-based firm that counts heads of state among its customers, said it was following Lavabit’s lead and shutting its e-mail service as a protective measure.

The only way to protect your communication is to not trust the service, but instead use something like PGP or pinned X509 certificates to encrypt the contents before it is sent.

Twitter entered the two-factor authentication (2FA) game earlier this year when they released the de-facto implementation, time based OTP over SMS. It has been working fine even though it had its shortcomings, including the inability to view app passwords created for apps without support for 2FA. Not to mention the lack of carrier support for most operators in Sweden.

Twitter have just superseded their recently implemented 2FA with a new scheme called “login verification”, which uses your mobile Twitter client as an authentication token, which means that they no longer have to rely on carriers to support their service.

The new two-factor system works like this. A user enrolls using the mobile app, which generates a 2048-bit RSA keypair. The private key lives on the phone itself, and the public key is uploaded to Twitter’s server.

When Twitter receives a new login request with a username and password, the server sends a challenge based on a 190-bit, 32 character random nonce, to the mobile app – along with a notification that gives the user the time, location, and browser information associated with the login request. The user can then opt to approve or deny this login request. If approved, the app replies to a challenge with its private key, relays that information back to the server. The server compares that challenge with a request ID, and if it authenticates, the user is automatically logged in.

A very creative solution to the problem, and since the approval is completely out of band with the authentication, clients do not even need to be aware of the secondary authentication procedure.

The downside is naturally that your phone is ever more important to keep track of, even though they seem to have support on standby in case you lose access to your phone.

Facebook uses a similar strategy in case you have enabled login verification for your account, but instead of relying on RSA cryptography, any logged in client may approve a new computer. The upside compared to the Twitter solution is that the approvals are not locked to one particular device, and the downside is the exact opposite – any logged in client may approve a new client.

When enabling login verifications, you are presented with a backup code, which can be used to access your account in case you lost your phone. I make it a habit of always writing the recovery codes into the current site’s entry in 1Password. That way, you can use any computer with 1Password installed to retrieve it when needed.

David Allen gives an introduction to the principles behind Getting Things Done and stress-free productivity, and the importance of keeping a clear head.

View embedded content

[Source]

When Google Reader was shut down, Feedly was one of the more popular free RSS services available at the time. While the free service remains for now, there is now a pro version available with better search and Evernote integration.

feedly pro will be generally available this fall for $5 per month (or $45 per year). To help kick-start the program, we are offering a limited lifetime edition [for $99] which gives you early access to feedly pro and grants you a lifetime membership.

One of the premium features is https support, which immediately raises my warning flags. Why would they voluntarily settle for bad security when they obviously have the infrastructure to handle it properly? Shouldn’t security be the top most priority considering all recent events?

Evernote followed this exact model many years ago, where you pay extra for security. Let’s just say that they learned from their mistake, and security is no longer considered a premium feature. Now all Evernote users benefit from secure connections.

When scanning a document, one would assume that what goes in on one end will look the same as what comes out of the other. That does not seem to be the case for Xerox scanners, which are using the JBIG2 compression algorithm, meaning that the document is split up into small patches, and similar ones are grouped together and stored only once.

An interesting way to approach email while on holiday. Instead of just letting it pile up in the inbox while on vacation, save yourself of the guilt and burden of going through each email by simply deleting it.

The [email] interface is designed to put you on a hamster wheel, rarely ever succeeding at letting you reach empty. You feel accomplished when you get to inbox zero. And then you sleep and it’s all back to haunt you. For this reason, I recommend taking an email sabbatical.

It would perhaps be wise to instead of deleting the email, just direct it to a specific holiday folder, or set it to auto-archive instead. That way, you would still get the same peace of mind, but still have the email for the “in case stuff happen” moments.

Stop to think, and you’re dead. When you have the time and energy to actually do something, you should have already thought out what to do, to no lose momentum.

This is a takeout from a lecture with John Cleese, where he describes the process of creativity, and the tools which will help you get to that mental state. I really recommend taking the 13 minutes it takes to watch this presentation. There you will hear things like:

It’s easier to do trivial things that are urgent, than to do important things that are not urgent, like thinking.

and

Don’t decide until you absolutely have to. Give the mind as long as possible to come up with an original idea.

David Allen gives a rare glimpse inside his own office, demonstrating how he processes his paper inbox. You’ll see real examples transforming stuff into clarified actions and reference.

An interesting video where David empties his own physical in-basket using eProductivity for Lotus Notes and Evernote for reference material. It seems he struggles like everyone else with certain gray-zone items, and that he is also using Evernote for reference just like me.

We’re building a message app where no one can listen in, not even us. We would rather close down the service before letting anyone in.

This seems like a noble and well-worth effort, but I can’t help to think that even though the guys at heml.is create a secure messaging application, how do you know that you are downloading the exact version from the AppStore that they created, and not a modified version with a backdoor?

Just when I was speaking of using IFTTT together with Evernote, this pops up in my feed. It seems there is a new iPhone app for IFTTT available which lets you to all the automation you are used to, but tie it together with resources in the iPhone, such as triggers when adding photos, reminders and contacts.

Aaron Francis uses an interesting workflow to having Evernote be the central hub for just about everything, using a Doxie scanner and IFTTT. I especially love the concept of the “My Life” notebook, where anything from invitations and birthday cards to photo IDs go.

A couple of screenshots of the upcoming OmniFocus 2 has been released, and it has been heavily inspired by the iPad app. It looks great, but I really hope that it will be easier to navigate than the iPad version, which can be a bit tedious if you have many projects and folder levels.

The new Forecast moded shows you a summary of your upcoming time-based commitments at a glance in the sidebar. You can leave the forecast collapsed to see the next several days (as in the screenshot), or expand the forecast to see an entire month in your sidebar. From the forecast, you can select any combination of days to see a detailed schedule includes scheduled tasks from OmniFocus integrated with events from your calendar.

I hope that the Forecast view will support adding calendar events in addition to viewing them. That would mean it can be a full replacement for iCal.

We call this new feature the “OmniFocus Mail Drop”. Unlike previous mail-processing features, we wanted a method that wouldn’t require any of your devices to be present in order to add items to OmniFocus, we wanted to add the much-requested better attachment support, and we wanted to reduce the amount of extra work you had to do in order to get your items into OmniFocus as much as possible.

This has the potential to completely change how we deal with the inbox in Omnifocus. There is more information in the official thread, including instructions for signing up for the service.

Looking forward to trying the new navigation on my way home from work. Could this become a competitor to Waze?

A new major version of 1Password for iOS has just been released, and it is a major overhaul of not only the application design, but new features such as a tab for favorites and an improved browser. Get it now for more than 50% off.

This is what printers are used for these days.

An interesting watch nonetheless.

Marco Arment went to a Microsoft Store to try the new Surface. It is quite an interesting read, especially if you have been to an Apple Store.

I have slowly switched over to Sublime Text, a very comprehensible and extendable editor for most platforms. This link provides some tips and tricks on things in Sublime which are perhaps not inherently understandable. Being able to commit in Mercurial right within the editor is a huge time-saver!