Daniel Lange's blog (Entries tagged as security)

Google GMail dominating the email market

nospam@example.com (Daniel Lange) — Thu, 28 May 2009 23:55:00 +0200

Google's GMail was launched in April 2004 and only in February 2007 Google dropped its invite system to open up to the general public acc. to Wikipedia's history of GMail. That's some five years of operations up to now.

It kind of amazed me how many people I know have GMail as their primary mail provider. So I took the chance today to get a bit of statistics to check my gut feelings:

A friend of mine selected some (mostly American) bloggers that have indicated specific interests in a topic related to his Doctoral thesis. This sample ended up to be 1,375 people. These folks have 295 different email domains. Only.

A whooping 46% of the (rather random) sample use GMail, 12% Yahoo, 8% Hotmail and about 3% AOL. While Yahoo has some foreign domains in the sample (yahoo.co.uk, yahoo.ca, see mostly American bloggers above), these add up to around 0.1% of the sample so it's not really significant.

This data is in no way representative, but still wow. Google basically has a monopoly on search and now seems to have a close-to-majority footprint in personal email.

I guess the dominance is currently larger in the States than in Europe or Asia as GMail has only gradually learned languages beyond English.
Large local providers should also have some foothold in these markets. Similar to the Comcast and SBC customers still significant in sample depicted above. Just the local providers in Europe and Asia will be somewhat stronger (for now). Google is also aggressively targeting corporations with hosted email and apps now so one can expect further and accelerated growth in that area. Quite a number of companies are considering using hosted email instead of the conventional mail system they have operated on site for many years now.

So while Gina Trapani recommends "Break Google's Monopoly on Your Data: Switch to Yahoo Search", may I humbly point out: It's becoming quite impossible to just keep your emails between the recipient and the addressee these days.

Even if you personally do not use GMail, Google can (technically) still profile you because a huge chunk of people you communicate with send from GMail and receive and store your emails there.

Nearly all email that is sent also passes spam filters before delivery. Google bought the Postini spam filter in 2007. That anti-spam service is used by many enterprises and even city governments, see here.

So time to consider (unencrypted) email as what it has always been: The digital equivalent of a postcard.
Just now Google has become the postmen. All of them, every second shift. You should hope they're not nosey. Or send letters.

Disabling a group policy'd screensaver on Windows

nospam@example.com (Daniel Lange) — Wed, 13 Aug 2008 21:33:05 +0200

I guess many people know the issue of having a screen saver forced active after a some time through a group policy in a corporate environment. This is usually done to make sure systems are locked during breaks if people forget to press Win+L (or Ctrl+Alt+Del and then Enter). While that may well help IT security, it turns problematic when giving presentations for extended periods of time. Having to move the mouse through the presentation pointer every few minutes or dash back to the PC once the screen saver has kicked in, again, is simply annoying. On your company's systems you may be able to get the system admins to allow configuration of the interval or allow for disabling the screen saver, but on foreign systems you're often lost. But...

Continue reading "Disabling a group policy'd screensaver on Windows"

Remote keyless entry system Keeloq broken by security researchers

nospam@example.com (Daniel Lange) — Tue, 01 Apr 2008 00:45:00 +0200

The remote keyless entry system KeeLoq is being used by Chrysler, Daewoo, Fiat, General Motors, Honda/Infiniti, Jaguar, Toyota/Lexus, Volvo and Volkswagen. A number of garage door opening systems and the like also use this technology. It is based on a secret cipher that has now been compromised by an international IT security research team. Two intercepted messages are deemed sufficient to clone a KeeLoq RFID tag as there are general keys inserted by the manufacterer and the key structure is partially determined by make and model. A stronger KeeLoq implementation (still) needs physical access to the key but only for a few minutes. It's also possible to permanently lock the legitimate owner out of his car or building and render his KeeLoq RFID useless. Details can be found at the researchers site and the folks at Wikipedia have also amended their KeeLoq article.