Now, this post is more rambling and observations. There’s a new trend I’ve been noticing. I use LowEndBox from time to time because well, the offers are the site suggests are low end and I don’t need a 32-cores server as much as I’d love to have that power at my disposal. 

This trend is about the new hosting service providers that have been spawning out from LowEndBox. How they buy, rebrand, and offer the same servers when things go down. It’s business, right? A crappy service provider will give you subpar services. With LowEndBox, it’s usually a person, or two, or three running the hosting business. 

Then it hit me… who doesn’t like getting 16 cores (mind you, not dedicated cores, but vcores running at a really low gigahertz) tremendously cheap? It’s perfect… perhaps too good. You sell cheap services… people buy in, they get fed up after six months and leave. Now, what happens to the data? How do you know they haven’t been taking snapshots of your virtual machine? Even if you were to delete your data how are you trusting your data with in the first place?

At the very core a client leaves, and a normal hosting service will just wipe out the data. But, most of those who promotes themselves over LowEndBox are not your standard businesses. They probably create the business overnight, and say they have been in the business since 2011 but in truth they just acquired the domain in 2018 and Archive.org shows proof that between 2011 to 2017 there wasn’t anything in there. 

So, what I’m suggesting. Or just, simply rambling about because like I said. This is rambling. I am not accusing anyone or any entity. Most of these new hosting providers, behind them, are Chinese, or Koreans. Simply put, they are unreachable to face any real consequence if things go south. 

Now, imagine all the data waiting to be harvested. It’s just sitting there, waiting to be harvested. It’s the real deal here, because if you go with the wrong hosting services I can think of a thing or two that could go down. 

• Client area logging password when you log-in, you don’t know what’s under the hood of a login area, usually nobody but the creators do. Password re-use becoming a real threat to users who participate in this activity. 
• Risking all your users data and be held liable for choosing a hosting service that incurs in this practice of harvesting your data. 
• All users could become targets in brute forcing, credential stuffing, have their mailing address and phone exposed. 
• Some service providers ask for driver licenses. I would say under no circumstance you should consider ever handing your social security number if asked. 

In conclusion, it’s really scary when you sit and think about choosing a hosting service provider. You don’t know what’s behind each company. I don’t think many people ever sit down and think about this stuff, at least not big businesses or medium companies. But small business owners or entrepreneurs who don’t want to spend much and need that exposure for their service fast. 

As for me, I live on the edge on this one. You can see me promoting some cheap services like ArubaCloud. I don’t have anything of importance nor do I have client data so to be honest all I have is this blog. But, were I to load data from a client, it wouldn’t be service offers from LowEndBox or ArubaCloud. It would be with a reputable hosting service provider. The problem is, how do we identify a hosting provider with integrity? You simply cannot. You are paying someone to rent those servers because you don’t want to deal with all the administration behind it. These days you can simply save a snapshot of a virtual machine, redeploy, and call it a day. 

I don’t think anyone in the industry would ever be ready to accept major players like Amazon, Microsoft, Google scanning and perhaps mining the data being stored in their servers.

I wasn’t sure how to open this blog post tonight. It’s a subject that has been on my mind for a long while and I’ll do my best to explain it. There’s probably a better term or word for this. 

Apple is a trendsetter. I think at this point we shouldn’t question that. Even if Apple isn’t innovating they are still doing iterations of their product every year. As long as there are diehard loyalists Apple will be fine. 

I’m not here to question what Apple has become or what it will become. Rather, observing a certain trend on the latest smartphone flagships.

Over one thousand reasons to say no

These days new flagships are not only having the courage the drop the headphone jack, for no legit reason whatsoever, but are becoming a luxury with the new prices. $1,000+ for a phone. What an insane price! 

Let me toss you an idea. It’s a very silly one, and I’ll probably sound like a conspiracy theorist at best… but what if we have reached the stage of stagnation where upgrading doesn’t make sense? 

If you buy the flagship from 2017 or this year, you are set for the next two or three years because it has gotten to the point that the hardware is just good enough. It’s not becoming that disposable device that needed to be kept replaced every year because the CPU was still crap back then. But from 2017 and on, I’m finding very little reason to upgrade. 

Have you seen the performance on a Pixel XL 2? Sure, it doesn’t beat the benchmark of a Galaxy Note 9 or a iPhone X…. but it’s incredibly smooth. It’s a phone I feel like can last for me until 2020, maybe 2021 until I start feeling that CPU degradation, or battery degradation.

So what’s in the price? I don’t think we are paying $1,000 because the technology behind it is the cutting edge. We are paying $1,000 because you are basically paying the two years you will skip upgrading because your new 2018 phone is powerful enough to last for a couple of years. That’s not good for business in any way. I think the new prices are future-proofing the losses of people not upgrading. 

I high doubt that Apple, or Samsung are paying $500 bucks to make those phones. At best they are probably paying $200-$300 per unit. Sadly, I don’t think there will be ever proof of what I just said so… I’ll take my tin foil hat off and let you folks be. 

Until next time.

As a rather “casual” paranoid person security is always something I obsess about to the point I have to take a break from obsessing about it because it just eats me alive. I feel like once you start focusing about security there are so many rabbit holes left open that you never stop closing them.

Whether that’s good or bad, it’s not really a healthy obsession.

I spent two (maybe three) weeks with LastPass and 1Password. Troy Hunt, a security-minded individual I follow and the owner and creator of HaveIBeenPwned has said it best: A secure password is the best you can’t remember. At first I had some real issues with that thinking, I’m used to memorizing long, unique passwords, and I also realized that there were issues with what I was doing. Password entropy being an important subject on all of this, and sadly still a subject that it’s hard to explain to people outside the field. I think xkdc explains it best

Another issue is password reuse, something I ended up doing because when you have accounts on over 40+ sites it’s impossible to remember all the unique passwords. I’m guilty, but at the same time I never reused a password on important sites (banks, paypal, etc).

Whether the comics comes off as arrogant or presumptuous it doesn’t eliminate the fact that having a good bits of entropy and avoiding password reuse are one of the most important issues. Password managers like 1Password gives you the ability to just “set it and forget it”. You’ll have a secret key and a master password, when combined it will derive a key to unlock your vault.

I started my journey with LastPass and it was an incredibly rough one to the point I was blatantly ignored when asking for a refund.

LastPass is great if your only focus is to just generate passwords and save them in your vault. Where LastPass falls, besides being plagued with security issues (you can make time for yourself to read their wikipedia entry), is that it immensely sucks in the storage area. I couldn’t for the life of me store a simple document of 2MB. It was nigh impossible, you just kept getting “Sorry, request taking longer than normal” to the point of needing to upload again.

I got fed up. I wanted to store my important documents in case I needed them “on demand”. I contacted support, requesting a refund and they proceeded to ignore my request to troubleshoot the issue. I actually played along because I didn’t have anything to lose but time… turns out uninstalling and installing the client doesn’t fix the issue. So I placed the request of refund AGAIN to be asked to record a video on how I’m doing the things. I refused to do so because I’m not comfortable of doing so.

In the end, I told them they can keep the money and shared that I had a very bad experience with them.

In waves of frustrations I discovered 1Password. I learned that 1Password had a very strong commitment to security and they were sponsoring Troy Hunt (which is how I discovered it).

The first things I noticed of using 1Password were the following:

• The user interface is fast unlike LastPass
• I could upload any big file with no timeouts or problems
• The integration with OSX is lovely
• iPad and Android support is superb
• Had an additional secret key it generated per vault + your master password

Using 1Password has been a delight. I redid all my reused passwords from different sites that weren’t of importance, maintaining a healthy level of entropy in each generation.

1Password also features Watchtower which is an additional service that you aren’t forced to use. It checks how many times you have reused a password, match your password against Troy Hunt’s HaveIBeenPwned, match your email against Troy Hunt’s service. I think my favorite is matching your password against HaveIBeenPwned because THEN you know if your password has been truly been leaked and brute forced/cracked. 

Between HaveIBeenPwned and 1Password? Honestly, I feel secure and confident that my accounts aren’t going to be compromised. But, the thing with security is that you never have that certainty that you are secure. It’s a process of continuous improvement and continuous monitoring.

Beyond 1Password? I have been using multi-factor authentication as an additional layer and I’m currently researching Yubikeys to leverage an additional security layer on top of the services I use.

If you have any questions let me know, the comment section is below and if you want to contact me directly check my Contact page.