Here’s an excerpt that I just loved:

Quite simply put, if you you think you need your employee’s password, it means you do not have the appropriate level of access to your business information systems. You should never need another user’s password. If you think you do for some reason, you need to contact your IT support provider to arrange for the appropriate levels of access. If you need to run a program on an employee’s computer, you should not need to be logged on as that user – you should be able to run all programs as yourself.

Usually the reason an employer or manager will cite for wanting employee passwords is because they want to read their employees’ emails. The best way to do this is to have an email archiving program in place, which catches all incoming and outgoing messages. If you are checking up on employees by just looking at their inbox, you are not seeing the whole picture. For instance, messages stored in other folders, or ones that have been deleted, will not show up in the inbox. Only a comprehensive archiving and retention program will preserve every email.

So why is having their password so bad? First off, if your company policy does not explicitly state that this sort of action may be performed, you’re opening yourself and your company to a privacy violation lawsuit. (If you haven’t, check out the US Constitution’s Fourth Amendment for an interesting read.) Second, you could accidentally modify the contents of the employee’s email upon doing so. There’s nothing like saying “big brother is watching” by accidentally deleting or marking a message as “read” and then having your staff find out when they check their mail.

Finally, by knowing and using your employee’s passwords, you are making it more difficult, if not impossible, to terminate their employment with cause. If you have an employee’s password and they do something funky, you have no recourse when they say that you are the one who did something funky while posing as them!

Are you in possession of your staff’s passwords? Maybe now’s a good time to rethink that approach and have a good password policy which helps you manage without exposing you to additional liability.

Note: I am not a lawyer and I don’t offer legal advice.

Below is an email that was sent to all Evernote users, informing them of the event, and steps Evernote took to safeguard their users’ data.

The difference is that, once transformed, Agents were nice enough to overtly draw their guns and try to kill you. Most malware these days is much more insidious, and gives you little or no warning. Often, by the time you get a pop-up message or your anti-virus detects it, it’s too late.

So what to do? Make sure you desktop malware protection is current, and actively scanning for threats. Block all suspicious traffic at your firewall with an intrusion prevention system. Use a web proxy to filter out bad stuff, too. Don’t run with administrative rights on your PC for your own good. And most of all, limit Internet access on systems where you do anything important to the bare minimum required; if you don’t have a strong business need, don’t go there.

Update: Microsoft was apparently hacked by the same watering-hole attack.

Insanely Great Products

Price: $35.00 US

I was recently sent a a demo unit of The Norm from Insanely Great Products.

The Norm is a simple vent-mount iPhone 4 holder. It uses a standard binder clip to clamp on to the vent, and is shaped to perfectly hold an iPhone 4 (or 4S).

The Norm ships with two binder clips with which to mount it to your car’s vents. One has a foam liner and the other is a standard, small binder clip like you’d use to clamp a stack of papers together. In my testing, the Norm held better than other vent-mounts that I’ve tried in the past. Also, the Norm lies right against the vents, unlike another mount I used, which held the iPhone sticking about 2 inches out from the dashboard, making it easily jostled and knocked around. The Norm’s low profile prevented this, and it held in place nicely during my testing.

Although the Norm is not designed to be used with a case, I did have a slim case on my iPhone 4S. This kept the phone from fitting properly into the Norm until I removed the case. Despite this, even with the case keeping my phone from completely slipping into the mount, the Norm was able to securely grip my iPhone 4S, so I did not need to regularly remove and replace the case. The charging cable easily fit in the space for it at the bottom of the case.

The only thing I wish the Norm did better was provide a way to deflect heat from the car’s vents away from the iPhone, which heats up enough on its own and doesn’t need the extra BTUs during the winter months.

One plus which should not be overlooked is that Insanely Great Products is based in California, and the Norm is designed and manufactured in the USA — a plus, for those who want to buy American-made.

You can do this in the Macintosh version of Skype by clicking the File menu and choosing Change Password…

From the Windows version of Skype, click the Skype menu, and click Change Password…

Or, from any web browser, simply go to Skype.com, sign in, and click the “Change Password” link on the bottom left of the screen.

Genius LuxePad 9100 Bluetooth Keyboard

I was recently sent a LuxePad 9100 Bluetooth Keyboard by Genius to review. In a nutshell, if you’re going to use a physical keyboard with your iOS (or other) device, this is a decent unit. However, there are shortcomings, not necessarily of the hardware, that you should be aware of.

The LuxePad 9100 is about the size of a regular notebook keyboard, and the keys are laid out intelligently. I was able to use standard keyboard shortcuts and touch type immediately without having to spend time learning an unintuitive configuration, although I did often hit the right Shift key repeatedly when attempting to hit the tiny up arrow key. Standard PC and Mac keyboard shortcuts for highlight, copy, paste, and navigation shortcuts like next word, previous, etc., are all supported.

The LuxePad 9100 includes a carrying case which doubles as a stand. It works well, but I prefer using the Smart Cover as a stand. I only used the LuxePad 9100′s cover as a case.

Typing on the LuxePad is so much more enjoyable than the on screen keyboard — it’s like comparing apples to Volkswagens. Gone are the annoying autocorrect fiascos and soft keyboard blunders, like my frequent inability to hit the Space bar, always getting an ‘m’ instead. iOS automatically detects the LuxePad and does not show you the on-screen keyboard when paired, so you don’t need to hide it from view, giving back all of your screen real estate.

While the LuxePad 9100 pairs quickly and easily with my iPad 2, leaving a Bluetooth device connected causes serious battery drain on my iPad, even more so than usual after upgrading to iOS 6. If you are a listener to the Pocket Sized Podcast, you know what a joke battery life can be these days, and having a Bluetooth device connected constantly makes it drain nearly twice as fast! You must be sure to turn off the keyboard (which will preserve both devices’ batteries) or disable Bluetooth on your iOS device when not in use. Failing to do so will suck your iPad batteries dry in a very short time. I do not know that this is a problem with the keyboard itself, but perhaps it could go to sleep after a minute or so of inactivity to preserve battery life. If it’s supposed to do that on its own, it doesn’t seem to.

One benefit of the LuxePad 9100′s apparent insomniac behavior is the fact that the keyboard was always responsive when I used it. I never had to tap the keys or re-connect it in settings during a session, thanks to it keeping the connection alive all the time, but I’d happily pay this small price to eek out every bit of battery life that I could.

Another complaint, again, not the fault of the keyboard, is that iOS is still primarily a touch-screen interface, even with a hardware keyboard connected. That means you still need to frequently tap the screen to switch between apps, pull down menus, or do most functions where a tap would be required. Genius does include keyboard shortcuts to go to the Home screen, Search screen, and audio controls, including Play, Pause, Next and Previous tracks, and volume controls. Still, the need to tap is just an annoyance. Messages is a great example, as, unlike on a PC, when typing a message, I had to take my hands off the keyboard at the end of each message I wanted to send and tap the Send button, as pressing Enter simply added a new line to the message. I was unable to find a keyboard shortcut to streamline this process.

A final drawback is that, by toting the keyboard and its case/stand around, it and my iPad 2 now take up more space than my MacBook Air, power supply and cord not included. If you don’t have a MacBook Air, then this comparison is pointless, but for me, it makes a lot more sense to take a fully-functional PC with me than a tablet if I am doing anything resembling real work. If, however, you can accomplish all you want with an iPad, but will appreciate the ability to touch-type at close to normal speeds, then the Genius LuxePad 9100 is worth a look.

What about when this happens next time? Now your business is offline during prime-time, and you’re losing money. How much are you losing? The costs of downtime are something you should also be able to calculate for your own business, but it’s probably safe to say that it’s more expensive than having a secondary connection would cost you.

What can be done about this outage? Not much. If Comcast is down, your connection through them is down as well, and no amount of complaining will fix this. However, you could have a secondary connection from FairPoint, Charter, RCN, or any number of smaller providers in your area. To take full advantage of a secondary connection, you need to have the appropriate network hardware that supports this feature, such as the Sophos UTM – a product we have carried for several years and use for our own connectivity and protection. If you have redundant connections and properly-configured network hardware, your systems may be down for less than a minute, as the hardware automatically switches to the backup connection without your even knowing there’s a problem, allowing you and your employees to continue to work without significant downtime.

Interested in how you can increase your productivity and reduce downtime? Click “Home” then “Get Info” at the top of the page, and we’ll tell you how we can help.

As expected, the response to this breach is typical, when the CEO stated that the tapes are “at the bottom of a landfill,” and “they’re not retrievable.” Unfortunately, we can’t be certain of this, as proving that the tapes are not at the bottom of a landfill, and in in someone else’s hands, is proving a negative, which cannot be done.

What could VSECU have done to prevent this? In addition to more stringent policies and procedures and security awareness training for those individuals handling the tapes, the contents of the tapes themselves could have been encrypted so that, should the tapes fall out of the chain of custody of the organization, it would be nearly impossible for anyone else to retrieve the information kept on them, and 80,000 credit union members’ information would be more secure.

Fortunately, this solution is even cheaper, as there is no up-front cost, but first, the problem we’re addressing.

In August, Oracle’s Java was found to have a critical zero-day vulnerability which could allow a remote attacker to compromise any PC that ran its code. The only fix for some time was to disable Java, or avoid surfing the Internet. While this may be more practical than you’d think, after some consideration, this is not always the case. Another mitigation step was to disable Java within the web browser. Most of our clients do not require Java support in their browsers, so it can be disabled. You can still run Java apps, just not from a browser.

Then, last week, Microsoft’s Internet Explorer itself was found to have a critical zero-day vulnerability. Again, for some time, the only fix was “don’t use Internet Explorer.” To many people, that is synonymous with “don’t use the Internet,” but this need not be the case. There are several alternative web browsers to Internet Explorer. Having a second browser to use for general web surfing, and another used for business, is not an uncommon practice. It does require a little training for end users, e.g., double-click this icon to get to your online banking app, and this icon to get to everything else. The most popular (non-IE) browsers are Google Chrome and Mozilla Firefox, and there is no harm in having multiple browsers installed on your system, but you do need to keep them updated. Both can be configured to work in an enterprise setting, meaning they can be controlled, locked down, updated, and secured in a similar manner to Internet Explorer. While this does require extra effort on the part of IT, or end users, when they are allowed to manage their own software deployments, it gives you added protection and an alternative when IE is under a known attack.

Note that this is not a panacea, as Chrome and Firefox have had their own share of vulnerabilities and attacks, but it does mean that you at least have a somewhat more secure alternative when faced with a critical, unpatched vulnerability in your main browser.

Check with your IT staff before you go casually installing a new browser on your system, and see if it makes sense for you. Then, take comfort in knowing you have a way to get your work done, even if IE is under attack.