The Mess with Cellphone Security Updates
My then 2 1/2 year old Google Nexus 5 stopped getting security updates last October (2016), but it was not until the recent Broadcom Wi-Fi chipset vulnerability that I got serious about getting a new phone that gets security updates. I am frustrated that I’m replacing functioning hardware because the manufacturer’s (Google) security update policy has made it unsafe to continue to use the device.
In looking for a new phone, I decided that there were a few key requirements:
- Monthly or immediate upon discovery security patches supported by a published policy.
- A price to security update life of less than $150/year.
- Availability of an email client that supports S/MIME for IMAP/SMTP email accounts.
- Availability of an end-to-end encrypted messaging app that is widely used. My preference is Signal, but there are others that meet this requirement.
- Supports Google Authenticator or another authenticator that provides two-factor authentication for Joomla-based web sites.
I ended up getting an iPhone SE, but my research and observations follow.
Alternative Firmware for Nexus 5
There are alternative firmwares available for some Android phones; although the Cyanogen project has collapsed, the follow-on LineageOS project is alive and well, and supports the Nexus 5. I’m comfortable flashing devices, but I do not want to do this for my primary phone. I will flash the Nexus 5, but will only use it as a backup device.
New Phones
I looked at new Android, iPhone and Windows devices; a summary of my research follows.
iPhone
Apple has a very clear hardware support policy and a history of providing security updates for about four years. Assuming three years, most Apple devices get ruled out by the $150/year cost limit that I have imposed, but the smallest (32G) iPhone SE does meet my annual cost requirement and the other requirements. Apple has the best S/MIME support of any vendor by a huge margin, and Signal is available on the iPhone. Two-factor authenticators are available.
Lumia Phones by Microsoft
Microsoft has a clear phone security update policy, and there are several Lumia models that meet my cost requirements. There are secure messaging apps available. Unfortunately, I could not find an S/MIME application. The default email application will do S/MIME when connected to a Microsoft Exchange server, but not for IMAP/SMTP servers. It looks like the Microsoft Authenticator App follows the same standard as the Google Authenticator, but I did not research this conclusively.
I was really frustrated by the lack of an S/MIME email app, as I really like the Windows 10 phone user interface. For most users looking for an inexpensive secure phone, I would strongly consider the inexpensive Lumia models. My requirement for S/MIME was the primary thing that prevented me from getting a Windows phone.
Android Phones
All Android devices meet my requirements for availability of an S/MIME client, secure messaging and Google Authenticator. For Android devices, the manufacter’s security policy and cost were the primary considerations.
Google Pixel
Google has a published security policy and I could probably expect no more than three years of updates, so at $649, the Pixel does not meet my annual cost requirement. There are third-party S/MIME clients available in the Google Play Store and Signal is available on Android.
Motorola G4 and G5
I looked at the Motorola G4 and G5 at Best Buy (which had about 15 unlocked phones), and both had Android 7.0 installed with the December 1, 2016 and January 1, 2017 security updates installed respectively. At $180 and $230, both devices met my cost, S/MIME and messaging requirements. Unfortunately, Motorola does not have a published security update policy that I could find, and does not have a good reputation for security update timeliness.
LG X Power
The LG X Power meets my price and function requirements, but I could not find a published security update policy.
Samsung Phones
Samsung has a published security update policy. Samsung’s flagship S series gets monthly security updates and meets my functional requirements, but it does not meet my $150/year cost requirements. The J series only gets quarterly updates and the J1 at Best Buy was only running Android 5.1.
Phone Security is a Mess
The lack of security awareness of phone manufacturers other than Apple, Google and Microsoft is absolutely disgraceful, especially for low-end devices. For Android devices, you need to pay about $225/year in order to get security updates, and as far as I am concerned, that is too high. My biggest frustration in this research exercise was the difficulty of finding a manufacturer’s security update policy.
If there were a clear security update policy for two or three years for the Motorola G4, that would have been my first choice. If there were a clear security update policy for the LG X Power, it would easily have been my second choice.
- Details
- Written by Bruce Moore
- Hits: 2547
SSL Changes in Chrome 56–March, 2017
In Google Chrome Release 56, Google appears to have revoked ALL certificates issued by StartSSL and WoSign rather than just those certificates issued after October 21, 2016. If you have not already replaced otherwise valid StartSSL certificates, you should do so now. While StartSSL was for a long time the best source for free domain verification certificates, Let’s Encrypt and Cpanel are now the perferred approach for most webmasters.
Viewing a Certificate in Chrome 56
To streamline the user interface for non-technical users that do not know what a cerficate is, Google has removed the ability to view a certificate from the normal user interface; you must now go to the developer tools via F12 and the Security tab to look at the certificate characteristics.
- Details
- Written by Bruce Moore
- Hits: 2697
Using R to Analyze Google Analytics Data
Website operators and digital marketing analysts frequently use Google Analytics and Piwik to monitor and analyze site traffic, but neither of these tools allow the user to add data from external sources. This course will show you how to combine Google Analytics with data from external sources including content management systems, Google Trends, Google Search Console and other sources to better understand what makes for successful pages and successful user experiences.
The class will cover the following:
- Installing and getting started with R
- Google Analytics, Google Trends and Google Search Console Terms and Conditions with respect to data use
- Retrieving and loading Google Analytics data with R
- Retrieving and loading Wordpress and Joomla content data with R
- Retrieving Google Trends and Google Search Console data with R
- Combining web analytics data
- Using R to prepare both static and interactive graphics of web analytics data
- Using R to prepare correlations and predictive models of web analytics behavior
- Setting up batch jobs to maintain historical data
Prerequisites
The course assumes previous use of a programming language such as Visual Basic, Excel Macro language, C/C++, Java, Perl, Python, SAS or PHP, though the course does not assume that the student is an active programmer. Knowledge of statistical concepts (mean, median, standard deviation) is helpful but not required.
- Details
- Written by Bruce Moore
- Hits: 2696
Mismatched Regulation
A couple of weeks ago, the Independent Bankers Association of Texas (IBAT) asked members for stories on regulation problems that the Association’s leadership could use in lobbying efforts to support the passage of the TAILOR act and other efforts to roll back some of the provisions of Dodd-Frank. I decided to write an article on the subject rather than just a letter, to at least get some search engine optimization value for the time spent.
Strategic Planning Surrendered
My primary product, a loan rate sheet profit optimization tool, has not sold. People with quantitative backgrounds are very excited about what I am doing, but bankers are not. The primary reason for this is my poor sales ability, but when I speak to bankers, they clearly understand what I am doing and then state “but that isn’t how we do business.” At the 2014 IBAT Convention, the exhibit hall was poorly arranged and few bankers were hanging out with the vendors who were exhibiting, so I had a chance to have some extended conversations with several accountants and other vendors with no bankers present. I got some disheartening, but ultimately very helpful comments:
- “This makes a lot of sense, but they (bankers) won’t do this unless the regulators tell them to.”
- “They (bankers) have surrendered all strategic planning to the regulators.”
How did this happen? In today’s banking world, you can still see the vestiges of the pre-1980 era when interest rates were regulated and banks competed strictly on customer service and personal relationships; community bankers today overwhelming come up through the loan sales ranks rather than operational or financial career paths. The sales career path is how they do business. This vestige of the pre-1980 era manifests itself with bankers who do not have strong quantitative skills by the standards of current business practice, and are less prepared to recognize, adapt or adopt new technologies than are managers in other industries. Until someone with a strong quantitative background gets to C-level at a bank, the prospects are not good for quantitative approaches like mine. As one person said of my business prospects, “waiting for someone to die is not a good business strategy.”
After the passage of Dodd-Frank, Community Bankers have been overwhelmed with the volume of regulation and regulatory change. While I am not an expert on the specific changes, I have heard of numerous examples of regulations that clearly address abusive practices at high-volume too-big-to-fail banks, but which make no sense for low-volume small banks where loan officers have very visible and personal responsibility for the loans they sell. I have commented that bankers are so consumed with regulatory change that the building could be burning down and they would not notice.
Interest rate regulations from a generation ago did not require bankers with quantitative skills and have constrained the current pool of executives to those without strong quantitative backgrounds; current regulations, and regulatory churn require executives with legal and compliance skills but not the analytical and quantitative skills that are used by executives in virtually all other industries. Current regulations will constrain the executive pool for the next generation to executives with legal, but not quantitative skills. This will continue to make it difficult for banks to even think about the future even when forward-thinking leadership is in place. For vendors like me, this means that getting traction will be difficult until the succession of past regulated-rate era executives is complete and the analytics-era executives are not tied up with regulatory spaghetti.
Fair Lending and Disparate Impact
In recent years, Fair Lending regulation has focused on disparate impact where a bank can be penalized for policies or procedures that have disparate impact for different racial and ethnic groups even when there was no intent to discriminate. While I have not met any bankers that I believe were racist, I think that unintentional racially disparate pricing is probably far more common than anyone would like to admit; read the discussion in How a Bank Can Get in Trouble with Fair Lending Statistical Analysis for an understanding of why price discrimination is probably common for minority borrowers even without intentional discrimination on the part of bankers.
Some bank lobbyists hope to require that regulators show that the bank intended to discriminate against minorities in order to trigger a Fair Lending violation. I think this approach is wrong and short-sighted. The problem with the current regulatory approach stems not from being laborious; the problem is that current methods will not readily identify banks that do have price discrimination problems and sometimes falsely identify a bank as having a Fair Lending problem. Changing the regulatory standards to require “intent” for a violation will not improve the accuracy of identifying instances where discrimination is occurring, nor will it reduce the labor required for analysis. Requiring intent for a violation would probably increase the labor required for both regulators and bankers without improving the situation for borrowers who have experienced race-related price discrimination.
Banks will make much more progress in reducing the regulatory burden and the fights over regulation by admitting that minorities do face unintentional discriminatory pricing and then working to eliminate the causes of discriminatory pricing. About 20 years ago, the Wall Street Journal published an article about different approaches taken by medical professional societies to reducing malpractice insurance (if you do not have a WSJ subscription, How Anesthesiologists Reduced Medical Errors provides a summary). The association with the highest premiums, anesthesiologists, took the approach of studying anesthesia-related deaths and changing practice to reduce deaths. All other associations took the approach of pursuing legal limits on malpractice insurance. Anesthesiologists ultimately ended up with the lowest insurance rates. Bankers should take the same approach; admit the problem and fix it.
The current approach depends upon an error-prone estimate of a borrower’s race and ethnicity; the current surname and geographic race estimation method is especially error-prone for blacks descended from slaves. The errors effectively hide discriminatory pricing when it occurs.
One possible approach would be to offer a safe-harbor for loan products where no rate negotiation is allowed; compliance could then be measured by auditing applications for accurate pricing classification. When a pricing classification error is noted, two things would occur:
- Determine the race and ethnicity of the borrower by contacting the borrower directly, and then look for patterns within the pricing classification errors.
- Increase the size of the audit pool to improve the power of the statistical analysis.
Banks need to recognize that there are problems and address them, or plan for additional generations of fighting related regulatory oversight.
Fair Lending, and Indirect Lending
Indirect lending is perhaps the highest risk area for Fair Lending violations, but it is one where current regulatory practices will not identify a dealer that is intentionally discriminating against minorities; a discriminatory dealer’s loans are diluted with loans from non-discriminating dealers so that analysis at the bank level will not identify the problem dealer (unless the dealer decides to intentionally create problems for a bank). Analysis of loans at the dealer level must occur to fix this problem.
- Details
- Written by Bruce Moore
- Hits: 2826
Introduction to R
The explosion of data collection on the Internet and in all business processes has resulted in a dramatic increase in demand for data analysis and data science professionals. This course is designed to help both programmers who need to learn data analysis tools and data science professionals who know SAS or other tools and need to learn R. Examples and homework assignments will use digital marketing, economic, police/fire, and geographic data t illustrate techniques for preparing, cleaning, visualizing and analyzing the various data types and formats using the R statistical programming language.
The class will cover the following:
- Installing and getting started with R
- Understanding the strengths and limitations of R
- Data exploration and data preparation
- Common R functions and scripts
- Reading and writing data with R
- Programming efficiently in R
- Curve Fitting, prediction and interpolation
- Geostatistics, geocoding and mapping
- Advanced graphics building and communicating your case in graphics
- Using Shiny for simple interactive visualizations
- Advanced tools and packages and developing predictive models with R
Prerequisites
The course assumes previous use of a programming language such as C/C++, Java, Perl, Python, SAS or PHP. The course also assumes knowledge of basic statistical concepts such as median, mean, standard deviation, and linear regression.
- Details
- Written by Bruce Moore
- Hits: 2445