Month: January 2013

The mobile security app, Lookout Mobile for Android, updated with a new feature called Lock Cam. If activated, Lock Cam will snap a photo using the front camera on your phone if your passcode has been incorrectly accessed 3 times in a row.

Lookout Mobile features free and paid options. Free users will get basic protection from viruses; but you’ll have to pick up a subscription if you want remote locking/wiping, more comprehensive backups, and automatic blocking of phishing and malicious sites. Both free and paid users will be getting the Lock Cam feature.

To enable this feature, go into your Lookout settings, scroll all the way down, and check the box for Lock Cam. Now when someone gets your lock screen passcode incorrect 3 times in a row, you’ll receive an email with a photo and map pinpointing where your device is. While this doesn’t guarantee that you’ll get your device back, it does provide more clues and evidence to help you attempt to retrieve your device.

Lookout also updated with the ability send Lock Screen messages to your missing device, something Apple’s Find my iPhone has had for a while. Users will have a 300 character limit to write a short message that will be displayed on their device when it has been locked remotely. This is a premium-only feature.

Check out our full review of Lookout Mobile Security here.

Twitter updated their embedded tweets today to include more useful information like videos, photos, and summaries. Before, embedded tweets only provided a permalink to the tweet with options to retweet, reply and favorite.

Twitter already featured something similar in its mobile apps where an expanded tweet would show different types of media. Now this functionality works with embedded links on all websites. This is great as it allows readers to provide media rich tweets. News outlets will be able to include a short summary of the article as well as a thumbnail. This is a much better and more transparent implementation as users will not have to click on random short links to be taken to an article that they may or may not want to read.

To try out the new embedded tweets yourself, just head over to the Twitter page of your choice, click the “More” button, and choose “Embed this tweet.” A preview will pop of up of how your tweet will look.

Mega launched on Saturday, giving away 50GB of free space to users and claiming tougher security over its predecessor, Megaupload. Since then, there have been reports that Mega’s security isn’t exactly as safe as it claims to be. Mega touts something called User Controlled Encryption (UCE), which is a fancy way of saying that all files stored on Mega’s services are automatically encrypted with 2048-bit RSA encryption.

The problem with this encryption is that it encrypts and decrypts files using the same encryption key. If someone can gain access to that key, they can decrypt all of your files. Another problem with Mega’s encryption implementation is that user specific encryption keys are generated and tied to your account.

This means you can’t change your password and if you ever forget your password, you’ll lose the ability to decrypt your files. A hash of the password used to sign up for the account is included with the confirmation code sent from Mega when a user registers for the service, giving hackers a method of obtaining his or her encryption keys.

Mega also uses keyboard and mouse movements to introduce entropy while generating users pairs of private and public keys. While this sounds very secure, Mega still uses the math.random Javascript to create random numbers, which doesn’t generate the most random numbers. Mega most likely chose to use the Javascript to generate random numbers as it can be run within any modern browser and can be updated easily.

While these are legitimate security concerns, the level of security that Mega offers is good. The biggest issue that Mega needs to address is the inability to change your password and encryption keys. Mega’s encryption is open source, which the company hopes will allow the security community to help develop further.

Sources: Ars Technica and BetaNews