PSA: Just because a site says it's "secure" it doesn't mean it actually is

As you browse the web these days, it's quite common to find sites that will help you to post content to various blogging/social networking/aggregation services. One of the ways that you may encounter is through a service called AddThis, through which site owners can add a single button that will allow posting/linking all over the place.

I was going to try use this service to post an article to my blog and when I clicked the AddThis button and selected Blogger as my target, I was given the screen shown here. You'll see that it wants me to log into my Blogger account so that AddThis can create a new post with the article that I was reading. Sounds good so far.

What bothered me, though, was the reassurance that AddThis is providing regarding information safety: "Absolutely. This page is secure (HTTPS)". They reenforce this message by prominently showing a picture of a shield on the screen below the sign-in button, again to show how secure the site is. However, if you take a look at the URL, AddThis is definitely NOT using an HTTPS connection. And according to the browsers status bar, there is no lock icon indicating the use of HTTPS/SSL.

So basically AddThis is just lying. They figure they can just tell you that the page is secure, show you a picture of a shield, and users will gladly enter their private user information.

This post is not intended to bash AddThis (although my confidence in their service is lacking right now) but as a warning to pay attention to site security. All major browsers include a lock icon somewhere in the status bar that indicates if you are on a secure connection. It's also very easy to look at the site url and verify that you are, in fact, visiting a secure site with an https:// url instead of http://.

So practice safe surfing and just because you see a picture of a shield don't assume you're actually on a secure site.

Should we rely on the cloud?

I've been playing with the new Live Mesh service from Microsoft and like what I see so far. Live Mesh is an synchronization, collaboration, cloud-based storage service that allows you to access files (and even the computers themselves) from any other mesh-connected computer (or Windows Mobile phone) or via the Mesh web-based desktop. Apparently Microsoft is going to be opening up the Mesh environment to application developers, so it's only a matter of time until we start to see third party applications designed to run on the mesh platform.

For now, this seems great. Microsoft is giving away 5 GB of online storage that can be configured to sync up with any number of computers so that you always have access to the most current copy of your files - even if you're not actually on one of your computers. It also has some very nice collaboration features that allow you to define readers and contributors to your shared folders.

However, how much should we rely on Microsoft to keep this service perpetually in operation? I have used numerous other sites that were supposed to accomplish this very concept - although none of them did it quite as impressively as Live Mesh.

Take, for instance, AOL's XDrive utility. XDrive accomplished a lot of the same functions that Live Mesh does - shared storage across multiple computers with the ability to share your files with others. They even built client side apps that would mount your XDrive cloud-based storage as a drive on your computer.

However, take a look at the email to the right, which I just received from AOL today. [note: I removed the non-pertinent paragraphs from the screenshot]

The XDrive service, which AOL billed as a place to "Back up your valuable files" and to "Conveniently access all your files from anywhere", will be dead as of 1/12/09. According to AOL, "It is never an easy decision to shut down a feature, especially one like Xdrive that some of our members have used for a long time. But we have to look carefully at all of the products supported by AOL to ensure we’re providing as much value to our customers as possible."

So in typical business speak, they're trying to make it sound like they are doing their best to provide value to their customers while reducing the value that they are providing to their customers. Amazing, huh? Apparently they never realized that giving away 5GB of free disk space to anyone that wanted it could get really, really expensive. Now that the economy is in the can, they're trying to cut costs by eliminating this free service.

So, does this bode well for the Live Mesh service? Is Microsoft more reliable than AOL to continuously support their applications? I would think so, however, see another email that I just got recently - this time from Microsoft.

"As a valued MSN Groups or MSN Communities Web Folders customer, we want to notify you that the MSN Groups service will close on February 21, 2009"

Hmm....so Microsoft isn't above shutting down their online storage / collaboration environments either! MSN Groups is (was) another service that provides a lot of the same functionality of Live Mesh - online storage and collaboration. Granted, MSN Groups was painfully lacking in shared storage (3 MB or so...), so as a document repository, it was practically worthless. However, as Microsoft pushes users to rely on cloud-based storage, and soon cloud-based operating systems, we have to consider how much we can rely on these companies to maintain and preserve the cloud that they are asking us to trust with our valuable files.

Google's keeping us safe

During a recent visit to Chili's restaurant for Fajita-Rita Monday, I tried Google'ing the Chili's menu from my phone to check on something that I had ordered.

I was surprised to find that Google was blocking the chilis.com domain as malware!

A search for Chili's would result in the following Google results:
(Notice the subtitle of the result pages)



And clicking on one of the links would bring you to Google's standard "You-shouldn't-go-there" page:



I can appreciate that Google is trying to keep us safe, but blocking Chili's website? Are they trying to keep us from getting Salmonella via the web?

According to Google's explanation,

"Of the 48 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 07/28/2008, and the last time suspicious content was found on this site was on 07/26/2008.

Malicious software is hosted on 3 domain(s), including bce8.ru, iroe.ru, kpo3.ru."

So apparently this is not Google trying to protect us from web-based food poisoning, but simply a case of Russian hackers somehow inserting malicious links into the Chili's website.

Free PC>Land Line calls

If anyone needs to make calls from their computer to a landline and doesn't want to pay for SkypeOut or other pay per minute computer>land line VoIP service, check out the free EarthCaller service.

I just used EarthCaller for the first time to call an 800 number that always has a half hour wait - I really didn't want to burn up my cell phone minutes, and my client hasn't been nice enough to put a phone in my office at their location.

Using the EarthCaller site is extremely easy, just visit the website and dial. It needs to install their ActiveX control (IE only), but after that, you're all set to go. The sound quality on my 30 minute call was excellent (using an old headset that Ross gave me). I noticed some minor sporadic distortion, but for the most part, talking through EarthCaller was just as clear as talking on my cell phone.

Who knows how long this site will be available and/or free, but it's nice while it lasts