Microsoft is urging users to abandon telephone-based multi-factor authentication (MFA) solutions like one-time codes sent via Short Message Service (SMS) and voice calls and instead replace them with newer MFA technologies, like app-based authenticators and security keys.

The warning comes from Alex Weinert, Director of Identity Security at Microsoft. For the past year, Weinert has been advocating on Microsoft's behalf, urging users to embrace and enable MFA for their online accounts.

In a blog post last year, citing internal Microsoft statistics, Weinert said that users who enabled multi-factor authentication (MFA) ended up blocking around 99.9% of automated attacks against their Microsoft accounts.

But in a follow-up blog post, Weinert says that if users have to choose between multiple MFA solutions, they should stay away from telephone-based MFA.

The Microsoft exec cites several known security issues, not with MFA, but with today's state of the telephone networks.

Weinert says that both SMS and voice calls are transmitted in cleartext and can be easily intercepted by determined attackers, using techniques and tools like software-defined-radios, FEMTO cells, or SS7 intercept services.

SMS-based one-time codes are also phishable via open source and readily-available phishing tools like Modlishka, CredSniper, or Evilginx.

Further, phone network employees can be tricked into transferring phone numbers to a threat actor's SIM card – in attacks known as SIM swapping – allowing attackers to receive MFA one-time codes on behalf of their victims.

On top of these, phone networks are also exposed to changing regulations, downtimes, and performance issues, all of which impact the availability of the MFA mechanism overall, which, in turn, prevents users from authenticating on their account in moments of urgency.

SMS and voice calls are the least secure MFA method today.

All of these make SMS and call-based MFA "the least secure of the MFA methods available today," according to Weinert.

The Microsoft exec believes that this gap between SMS & voice-based MFA "will only widen" in the future.
As MFA adoption increases overall, with more users adopting MFA for their accounts, attackers will also become more interested in breaking MFA methods, with SMS and voice-based MFA naturally becoming their primary target due to its extensive adoption.

Weinert says that users should enable a more robust MFA mechanism for their accounts, if available, recommending Microsoft's Authenticator MFA app as a good starting point.

But if users want the best, they should go with hardware security keys, which Weinert ranked as the best MFA solution in a blog post he published last year.
​
This preference for app or security key alternatives for MFA shouldn't mean that users should disable SMS or voice-based MFA for their accounts without substituting another MFA approach. SMS MFA is still way better than no MFA at all.

Zoom calls will now come with the option of live captions, in a move that’s likely to make life easier for remote workers whose attention spans suffer steep declines during online meetings.

In March 2018, we published in issue 4-39 an article “Transcribe Your Meetings in Real Time” introducing you to Otter.ai, a Los Altos, CA start-up. Now the company is expanding its technology to enable speakers on a Zoom call to see their words turned into accurate captions in real-time. This should put an end to the unfortunate miscommunications frequently caused by remote collaboration tools.

So, there should be no more excuses for misreporting the numbers presented by your sales team or missing the list of targets put forward by your manager.

Captions will appear directly within the call, with a couple of seconds of lag. Presumably, they will be accurate enough for crucial information to come out in plain text consistently. 

The new feature will be incredibly helpful to users with accessibility needs and non-native English speakers struggling to make out the meaning of a sentence. Otter.ai currently only supports the English language but can handle a variety of accents, including southern American, Indian, British, Scottish, Chinese, and various European accents.

Two years ago, Otter.ai launched its popular speech-to-text software. Available as a mobile app or as a web-based tool, the technology soon started supporting online conferences, offering users the option to turn Zoom cloud recordings into written conversations to keep a record of their virtual meetings. 

Earlier this year, Otter.ai launched Live Notes – a new feature that enables users to open a live transcript of the call during a video conference in a separate shared file, which transcribes what is being said in real-time.  
Based on a sophisticated algorithm, Live Notes can separate human voices to identify different speakers and includes their name in the transcript to indicate that a given participant has started intervening. Users can then go back to the file to check a detail if they have missed a sentence or jumped late into the call.

Therefore, the new announcement builds on top of Live Notes, integrating the transcribed quotes directly into Zoom’s platform during a virtual meeting. In a demo call showcasing the technology, Otter.ai’s founder Sam Liang said, “Now, you will have Live Notes still going on in the background, but then you will also have the captions put down in the call. And there’s a pretty broad range of people that this will be helpful too.”

“It’s definitely a great help for people with a hearing disability, but also for international, distributed workforces who don’t speak English as their native language. And education as well: online classes could benefit from captions, on top of the Live Notes that they can go back to, to facilitate learning.”

The transcription is not precisely pitch-perfect: some sentences don’t make sense, and words occasionally come up deformed. Overall, however, Otter.ai’s algorithm, especially given the tool’s ease of use and accessibility, appears to be pretty accurate – an assessment echoed by most online reviews and user experiences.

Liang is confident that the technology’s accuracy is only improving as more users get on board, providing more training data for the speech-to-text algorithm and helping the AI work its way through background noise and strong accents.

By considering the context of an entire sentence, rather than working on a word-by-word basis, the AI can make more accurate decisions. 

Similar methods have sparked the interest of the industry’s most prominent players, with IBM now offering a cloud-based, highly accurate speech-to-text platform as part of Watson’s services. In contrast, Amazon Transcribe provides an API for automatic speech recognition.

However, Otter.ai is arguably the most consumer-facing technology out there. Liang confirmed that the company is now working on a smoother integration with platforms like Microsoft Teams, Google Meet, or Cisco Webex to open up access to the transcription and live-captions features.
​
In Zoom, live captions are available now for Otter customers paying for a Business plan, as well as for Zoom Pro customers.

Students will have to “learn how to learn” instead of focusing on skills and specific tools. Most content will become obsolete within two years, said Dr. Simon See, head of computing giant NVIDIA’s artificial intelligence (AI) technology center.

“Technology is moving so fast, and you have to keep adopting new skills. What you have to learn is the methodology of learning new things. You must learn how to learn new things,” he said.

Dr. See spoke in a panel discussion at the launch of Nanyang Technological University’s (NTU) Deep Learning Week (DLW) recently.

Minister-in-Charge of the Smart Nation Initiative Vivian Balakrishnan was the guest of honor.

In a video call to students, staff, alumni, and members of the public, Dr. Balakrishnan emphasized the need for university students to develop “deep technical skills” in areas such as data analytics, machine learning (ML), and artificial intelligence (AI).

“You are the dynamos that will drive our transformation and push the boundaries of how we can leverage technology to transform our economy and make a real difference,” he said.

This is the second edition of NTU’s DLW, organized by the Machine Learning and Data Analytics Lab at the NTU School of Electrical and Electronic Engineering (EEE).

During the DLW, there were AI-related workshops as well as a virtual AI career fair for students, ending with a machine learning hackathon themed “AI in business and economics,” said NTU in a statement.

Along with Dr. See, the other panelists included Mr. Sim Kai, deputy director of the national AI office, Dr. Laurence Liew, director for AI industry innovation at AI Singapore, Ms. Jane Shen, chief scientist and managing director at Pensees, Dr. Pan Yaozhang, head of data science at Shopee, and Dr. Yap Kim Hui, associate professor at NTU’s School of EEE.

Distinguished panel members included Ms. Jane Shen, Dr. Laurence Liew, Dr. Pan Yaozhang, NTU EEE chair Tan Yap Peng, Dr. Simon See, NTU EEE student committee president Duan Jiafei, Mr. Sim Kai, Dr. Yap Kim Hui, and moderator Dr. Wesley Tan.

Moderated by Dr. Wesley Tan, senior lecturer at NTU’s School of EEE, the panel discussed the Covid-19 pandemic’s impacts on the economy and digital transformation.

Panel members concurred that while Covid-19 had forced companies to speed up digital transformation, most trends were already in motion since last year.

The panel also believed that passion was more important than academic background when pursuing a career in AI.

Dr. Liew said that computer scientists were a minority among the applicants in his organization’s AI apprenticeship program, with social scientists and many from other disciplines who had also applied and were doing well.

“A lot of the most successful tech people in the world do not come from a computer science background,” he noted.
​
“It doesn’t really matter what your first degree is in. As long as you are passionate, you can get into AI.”

If ever there was a decade that announced itself so defiantly in the first year, it’s the 2020s. With so much change and volatility already, 2020 has proven this decade will be dramatically different than the one before it. IT and business leaders must prepare for ten years, unlike any others. 

For IT and business leaders, success in the 2010s meant capitalizing on innovative commercial IT (think cloud and mobile). As the decade went on, many of those firms began leveraging the same commercial platforms, looking and feeling very similar to their customers. Forward-thinking organizations began examining how digital differentiation could give them a leg up and then – wham! – 2020 came in with a bang.

In only a few months, business models were flipped on their heads. The coronavirus pandemic, economic downturns, the rise of values-based consumers, and increasing climate issues forced most businesses to pivot to new, mostly digital, models quickly this year. 

In case it’s not clear by now: What worked in the 2010s will not work in the 2020s as we see business shift from global toward hyperlocal operations. So, what will work? 

For starters, every business role must incorporate systemic risk into long-term planning. For future-fit IT leaders, the risks aren’t limited to the data center or network outages. Today’s threats include rapidly changing consumer trends that require digital pivots, increasingly complex security concerns, the ethical use of AI, and the increasing impacts of climate change. 

Feeling overwhelmed? The good news is that several emerging technologies can help your organization identify and address these risks and create a competitive advantage through disruptive innovation. A few examples include: 

• Employee privacy software that leverages the downpour of employee data without infringing on employee trust 
• AI that is learning how to code enterprise software and changing firms’ organizational structures 
• Cloud-native technology that helps you innovate with software everywhere, especially at the edge 
• Software dedicated to analyzing climate risk to evaluate your individual organization’s risk 
• Robotic process automation that can scale back-office processes for increased resiliency 

Aligning your tech stack to address your organization’s highest risks and pursue the right innovations will be the differentiator for future-fit firms in the 2020s. One of my prime reference sources is Forrester Research. They practice what they preach. Here are some of the steps they are taking to move productively into the 2020’s:

• Leveraging new technology platforms and models to deliver our research and insights to clients more efficiently in formats that let you decide how you want to learn from us. For example, each of the links above will take you to a short-form story explaining an important technology trend in video and text. Each further provides direction on the most critical emerging technologies to invest in, along with a link to our research to learn more. 
• We are moving from an annual trends and technologies report cadence to twice a year in the spirit of more insight faster, with new trends and emerging tech updates published in between.    
• Lastly, to start planning your roadmap for the decade ahead, our upcoming event, Technology & Innovation Global, will dive deep into many of these trends in a keynote panel I will be hosting. We will also feature several breakout sessions from our top analysts. At that event, we’ll demonstrate our next generation of emerging technology and trends research tools, so please join us!   

My post on 7/5/20 took up the topic of better passwords and mentioned a free password generator called xkpasswd.

I received a follow-up from one reader, Adam Roger, who said that xkpasswd did a good job overall, but he had found another tool to be a better alternative and it’s free as well. It’s called Password Meter by Safety Detectives.
​
The user types in a word or words and then clicks on a button and the software will change the starting input into a much stronger password (rated from 1 to 100.) For example, the word "benediction" (score of 12) can be transformed into “b=nedicT10n” (score of 91) – still easy to remember but hard to decypher.
​
Thanks, Adam, for the feedback.

There are a lot of encrypted USB flash drives out there. You plug them in, and either there's an on-screen popup that asks for your passcode, or some sort of physical keypad that is used to gain access.

But what about transferring the unlocking mechanism to a mobile device – such as a smartphone or your Apple Watch?

This is precisely what the iStorage datAshur BT hardware-encrypted USB flash drive does.

Visually, the iStorage datAshur BT looks like any other USB flash drive. It has a tough epoxy-like exterior that gives the drive a water- and dust-resistant rating of IP57 (protected against damage from dust ingress, and water resistant to 1 meter).

The datAshur BT comes in capacities from 16GB to 128GB.

Data on the datAshur BT is fully encrypted using AES-XTS 256-bit hardware encryption, which is FIPS 140-2 Level 3 compliant design and technology. Brute force is defended against by a built-in data wipe if there are too many wrong attempts made.

Everything is protected by a 7-15-character password or a biometric unlock such as Face ID/Facial recognition, Touch ID/Fingerprint, or IRIS scanning from a smartphone or tablet. The drive communicates using Bluetooth to any smartphone/tablet (iOS/Android) or Apple Watch. The Bluetooth channel is secured by a FIPS validated encryption layer and is only used for connection purposes. There is also support for 2FA using SMS.

The drive itself is completely host independent, so it will work with Windows, Mac, Linux, Chrome, and so on, VDIs such as Citrix and VMWare, and also with embedded systems such as medical devices, TVs, drones, printers, scanners, or pretty much anything with a USB port.
​
Prices for the iStorage datAshur BT range from $103 to $181, depending on the capacity.

Microsoft has disrupted a massive hacking operation that it said could have indirectly affected election infrastructure if allowed to continue. 

Last Monday, the company said it took down the servers behind Trickbot, a massive malware network that criminals were using to launch other cyberattacks, including a strain of highly potent ransomware. 

Microsoft said it obtained a federal court order to disable the IP addresses associated with Trickbot's servers and worked with telecom providers worldwide to stamp out the network. According to The Washington Post, the action coincides with an offensive by US Cyber Command to disrupt the cybercriminals, at least temporarily.

Microsoft acknowledged that the attackers are likely to adapt and seek to revive their operations eventually. Microsoft said the company's efforts reflect a "new legal approach" that may help authorities fight the network going forward.

Trickbot allowed hackers to sell what Microsoft said was a service to other hackers – offering them the capability to inject vulnerable computers, routers, and other devices with other malware. 

That includes ransomware, which Microsoft and US officials have warned could pose a risk to websites that display election information or third-party software vendors that provide services to election officials.

"Adversaries can use ransomware to infect a computer system used to maintain voter rolls or report on election-night results, seizing those systems at a prescribed hour optimized to sow chaos and distrust," Microsoft VP of security Tom Burt wrote in a blog post.

Ransomware seizes control of target computers and freezes them until victims pay up – though experts urge those affected by ransomware not to encourage hackers by complying with their demands. The Treasury Department has warned that paying ransoms could violate US sanctions policy.

He added: "We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems."

A separate technical report by Microsoft said Trickbot had been used to spread the Ryuk ransomware. Security experts say Ryuk has been attacking 20 organizations per week.

But Trickbot has also been used to spread false and malicious emails containing malware that tried to lure victims in with messaging surrounding Black Lives Matter and Covid-19, Microsoft said.

Microsoft said Trickbot had infected more than 1 million computing devices globally since 2016 and that its operators have acted on behalf of both governments and criminal organizations, but their exact identity remains ambiguous.

Taking down Trickbot follows a series of attacks that became highly publicized in recent weeks: One targeting Tyler Technologies, a software vendor used by numerous local governments, and Universal Health Services, one of the nation's largest hospital companies. A statement on Tyler Technologies' website has said the company does not directly make election software. The software it produces that is used by election officials to display voting information is separate from its internal systems affected by the attack.
​
Ransomware could pose a risk to the election process if systems designed to support voting are brought down, according to Check Point threat analyst Lotem Finkelstein. Still, so far, experts regard it as "mainly a hypothetical threat right now."

Companies are tracking what you do online. You know this. But it can be a challenge to see the extent because the methods are hidden on purpose. At least 87% of the world’s most-popular Web domains engage in some form of digital tracking without you ever signing in, according to investigative journalism nonprofit the Markup.

To investigate the pervasiveness of online tracking, The Markup researchers spent 18 months building a one-of-a-kind free public tool that can be used to inspect websites for potential privacy violations in real time. Blacklight reveals the trackers loading on any site—including methods created to thwart privacy-protection tools or watch your every scroll and click.

In one study, scanning more than 80,000 of the most popular websites using the Blacklight software, found more than 5,000 were “fingerprinting” users, identifying them even if they block third-party cookies.

The study also found more than 12,000 websites loaded scripts that watch and record all user interactions on a page – including scrolls and mouse movements. It’s called “session recording,” and the study found a higher prevalence of it than researchers had documented before.

74% of sites loaded Google tracking technology, and 33% loaded Facebook trackers. It’s staggering to see the reach of those two Silicon Valley giants – it’s easy to forget they track you even when you’re not using their websites or apps.

Try it out here. Just enter a URL, and you’ll see a real-time count of the ad trackers, third-party cookies, cookie evaders, and keystroke recorders on any given site.

What you find might surprise you. Pet food-maker Purina notched almost every possible kind of tracking Blacklight detects, which Purina can use to learn about the demographics and interests of people, their brand loyalty and even to understand how they use their website. It had 16 ad trackers, 34 third-party cookies, fingerprinting, and monitoring of keystrokes and mouse clicks.

Joe Biden’s website as of Thursday used fewer third-party cookies, 7, than President Trump’s website, 38, according to Blacklight.
​
Microsoft had 50 third-party cookies. Apple had zero – in fact, it uses no tracking tech at all, according to Blacklight.

Ever since the pandemic began, many knowledge workers have continued their employment responsibilities from their homes. But now, with many employers extending the remote-work timeframe well into 2021, it may be time to consider working from a residence that’s in a far more pleasant location.

If you are a remote worker tired of sitting all day at your principal residence or working in grey cubicles at a remote office, here’s a group of exotic locations that offer you not only a stunning change of scenery but also dependable internet speeds and infrastructure necessary for remote work. From pristine beaches to tropical rainforests and paradise islands, there’s something in this list that is sure to make you want to book your ticket now and even consider these locations for a leased or purchased second home.

Galapagos Islands. West of continental Ecuador lies the isles made famous by Darwin’s studies of the natural world that would result in the Theory of Evolution. A natural paradise filled with stunning vistas, pristine beaches, and some of the most exotic wildlife in the world, the Galapagos Islands are a real paradise on earth. 

Galapagos has a population of only 25,000 people, setting the standard for the word remote. Nevertheless, they offer a reliable infrastructure for remote workers, with most hotels offering free Wi-Fi and most housing areas, including a good connection as well. While Galapagos is by far not the cheapest option on the list, you can expect prices similar or slightly less expensive than living in the continental USA.

Costa Rica. Costa Rica, the country with the most amazing biodiversity on the entire planet, has long been espoused as a real paradise for ex-pats. Not only does the Central American country offer dense tropical rainforests, volcanoes, and tropical climate, but also some of the best beaches in the world – featuring crystal clear water and pristine sand.

Santa Teresa is one of such beaches and is one of the most visited by tourists for many a reason. Not only does Santa Teresa have some of the best surf you will find in the world, but it also features a large town and tightknit community that offers plenty of yoga retreats, delicious food, thriving nightlife, and fantastic weather you could expect.

You will come for the surf and natural beauty, but you will stay for the people – a collection of ex-pats from around the world and locals that live the “Pura Vida” (Pure Life) lifestyle and always boast a smile on their face.

Morocco. Located not be too far off the coast of its northern neighbors in Spain, Morocco might as well be a galaxy apart. This diverse land containing four different mountain ranges, deserts, and Mediterranean beaches has been the setting for many iconic movies throughout the years, including Lawrence of Arabia, The Man Who Knew Too Much, Gladiator, and even Star Wars.

But what truly makes Morocco so special, and attracts millions of tourists each year, is its perfectly preserved culture and traditional architecture. The market town-turned-city of Marrakesh has been a crossroads for culture and trade for close to ten centuries. Featuring gorgeous oriental architecture and thousands of captivating smells and colors, the streets through the bazar hold plenty of secrets within them – from delicious honey drizzled pastries to sensual belly dancers.

A very low cost of living country, Morocco has been evolving technologically at a breakneck pace in the last few years and has plenty of co-working spaces available for digital nomads, as well as surprisingly fast internet connections for rental homes.

Bali, Indonesia. Another location famous for its beaches and surf, the Island of Bali, is often touted as a real heaven on earth. Boasting mind-blowing beaches, volcanoes, mountains, coral reefs, and overall nature, Bali can easily compete with any location on this list and come out ahead on most aspects.

In Ubud, the cultural center of the island and home of the ex-pat community, you will find the spiritual hippies and yogi types. In contrast, in the southern Bukit Peninsula, you will find the perfect location to surf in legendary breaks like Padang Padang, Dreamland, and Uluwatu.

What few people know about Bali, however, is that it has been building a burgeoning startup ecosystem with all kinds of entrepreneurs, initiatives, tech talent, and startups springing up all over the island. To satisfy this demand, Bali has seen a large number of co-working spaces pop up across the island, each one providing more than adequate commodities for digital nomads, who are not only attracted to the island’s legendary beauty but also its low cost of living and housing.

Ho Chi Minh City, Vietnam. Touted as one of the best cities for remote workers around the world, Ho Chi Minh City is a colorful, vibrant, and creative metropolis in the south of Vietnam that has plenty to offer for digital nomads, tourists, and ex-pats alike.

A highly developed city bursting with cafés that offer fantastic coffee and an even better internet connection, the former Saigon is filled with culture, commerce, art, and plenty of beautiful natural and human-made sites to behold.
​
Visit the Ben Thanh Market and its iconic clock tower to buy all sorts of goods ranging from clothes to electronics to groceries for excellent prices, provided you are willing to haggle a little. The food is absolutely delicious and incredibly cheap, with Vietnam having one of the lowest costs of living in this entire list.
For those who prefer to work in office environments, Ho Chi Minh City has plenty to offer, including the fantastic Dreamplex co-working space, which features the fastest and most reliable internet in the city, as well as excellent ergonomic chairs.

Wireless engineers, automakers, and governments have spent years preparing for a future where autonomous cars will communicate with each other and sophisticated transportation networks – an initiative known as “cellular vehicle to everything,” commonly abbreviated C-V2X. Recently, the 5G Automotive Association (5GAA) offered a roadmap for mass deployments of automotive communications technologies, and its timeline includes several interesting dates that aren’t as far off as some people might have guessed.

Based on the current pace of cellular industry standards organization 3GPP’s 5G releases, global 5G deployments, and the state of the automotive communications supply chain, the 5GAA expects three C-V2X stages over the next decade:

1. From 2020 through 2023, automakers will rely on 4G LTE-V2X technology to enable basic safety features, such as left-turn assistance and emergency electronic brake light features, to improve traffic efficiency. They’ll augment primary local hazard and traffic information that’s already being shared over cellular networks.
2. Starting in 2024, the 5GAA predicts a “large-scale introduction” of 5G-enabled automated driving technologies that rely on communications between vehicles and infrastructure. For example, 5G-V2X will be used to park cars in parking garages automatically – a car-to-private infrastructure use case Bosch is already testing in German and U.S. locations – followed by “more complex environments and scenarios” including public roads. Tele-operated driving will also be possible.
3. In 2026, 5GAA expects all new autonomous vehicles will include 5G-V2X, kicking off an age where cars cooperate by sharing high-definition sensor data. Some of C-V2X’s most widely anticipated autonomous functionality, such as cars being able to share their upcoming intentions with each other and the network, as well as combining video and depth information for real-time cooperative perception, will be in pilot test stages at this point. Urban and highway pilot programs for dynamic intersection management and cooperative traffic flows could take until 2029.

5GAA expects that the 3GPP will continue to evolve the 5G standard from current Release 16 through 2023’s Release 18, enhancing industry support and specifications for 5G-V2X as carriers continue building out their 5G infrastructures. As nice as it would be if autonomous vehicles could just start relying on 5G today, the reality is that 5G infrastructure isn’t yet built out enough around the world. There are technological and legal practicalities to consider, as well.
​
Allocating wireless spectrum to vehicles will be critical to 5G-V2X deployments, the 5GAA notes, ideally harmonized internationally at 5.9GHz, as well as low band spectrum for use in rural driving, and mid-band spectrum in urban environments. The group expects basic safety to require 10 to 20MHz of spectrum for direct 4G communications, plus 40MHz or more for advanced 5G driving.