SSL Certs: Which One is the Best Fit for You?

4GHadmin | 03 September 2019
Reading Time: 5 minutes

Shopping online is pretty much a ubiquitous activity for people all over the world these days, and – not surprisingly – so much so that it’s now the preferred means of shopping for many people. Especially for certain goods, and not only do these people want selection, good prices, and the like, but they also want to be able to enter their credit card information and not have to worry about it being exposed.

Offering that peace of mind is absolutely essential if you’re in the e-commerce world, and nothing is more important in this regard as having your online transactions guarded by an SSL certificate. Even if you may not know exactly what these are, you’ve probably seen the ’##-Bit Encryption’ tag prominently on display once you get to the checkout when you’re shopping online.

Here at 4GoodHosting, not only do we offer very competitive prices on highest-quality SSL Certificates but like any good Canadian web hosting provider we have plenty of customers who are trusting our web hosting to ensure they’re ‘open’ for business 24/7 and all day, everyday.

Probably safe to say that there’s few if any of those folks who don’t already have their SSL Certs in place, but for those of you who are new to your business online then we thought we’d dedicate one post here to discussing SSL certificates and what you need to know to choose one for yourself.

Overview

There is a plethora of certificate types, and several categories and plenty of CAs. In advance of highlighting the different SSL certificates and how to choose the right one, we’ll first discuss why an SSL certificate is so important nowadays.

The reach and strength of cyber crimes has grown rapidly over recent years. So much so in fact that cybersecurity has become the #1 concern issue for both web users and website admins. The truth of it all is that cybercriminals can cost online businesses millions. The worldwide economy loses unimaginable amounts of money every year due to cybercriminal activity.

What SSL certificates do to protect agains this is that they enforce a secure connection between a server and its web users. They don’t only protect the sensitive information that is transmitted between a web user and a web server, but also boost ranking, improves brand credibility and go along way to boosting conversion rates.

Choosing the Best SSL Certificate

Knowing what SSL will be best for your online storefront can be a challenge. They’re generally categorized according to their validation level, warranty, technical support and domains support.

So what factors do you need to consider? These ones:

  1. Validation Level

Nearly all SSL certificates provide data encryption and session security services for websites. The validation level of each is where the primary differences between them are established. The validation level will determine how much information about a company will be shown in browsers or to the web users. The three main levels of validation are Low / Medium / High

Domain Validation (DV) SSL certificate – Low

These ones are also referred to as a low assurance, and are commonly used to protect standard websites, single domains, and blogs. The simplest form of validation is done where the website registration and administration approval are confirmed to issue the certificate. Processing time is anywhere from a few minutes to a few hours.

These certificates are suitable for low traffic websites or informative sites where financial transactions are not conducted. If you’re selling online, this type of cert will be insufficient for you.

Organization Validation (OV) SSL certificate – Medium

With medium certificate validation, an authorized agent verifies the domain ownership and company’s identity. This includes verifying the company name, city, state, and country. Web owners must submit some additional business-related documents for verification. As you’d expect, there’s more of a delay to all of this compared to a domain certificate.

Medium certificates provide appropriate security for medium-sized businesses that conduct standard (-$500 o/a) financial transactions and wants to provide assurances for customers that they can shop entirely safely within the site.

Extended Validation (EV) – High

These ones offer the highest level of security for websites, with a more rigorous validation process that verifies the ownership of the server and the legitimacy of its owner. Generally, the CA verifies the legal, physical and operational existence of the company, official government records, and databases, and confirms that only the genuine company is authorized to be in ownership of the extended-validation SSL certificate.

What you’ll see with these ones is the browser will show a green address bar with a verified name of the organization. The EV certificate is used by major players, like Amazon and Flipkart for example

Further, having an EV SSL really legitimizes the domain name.

  1. Domain Support

Next up you’ll want to determine how many domains you want covered with a single certificate. There’s three categories here:

Single Domain Certificates
Fine for protecting a single domain with its all subpages. Example:

www.mydomain.com/

www.mydomain.com/register

www.mydomain.com/about

www.mydomain.com/contactus

mydomain.com

Wildcard Certificates

The wildcard certificate allows its users to protect all the first level of sub-domains under an FQDN. It supports only DV or OV. The best instances are:

www.mydomain.com

info.mydomain.com

mail.mydomain.com

payment.mydomain.com

Multi-Domain Certificates
Also referred to as SAN or UCC certificates. They allow users to protect multiple FQDN domains along with multiple sub-domains. This choice will be ideal for you if you’re running multiple websites with single or multiple company names. All DV, OV, EV support this category.

www.mydomain.com

info.mydomain.co.uk

payment.mydomain.co.ru

  1. Warranty

The warranty attached to your SSL certificate should also be a consideration – it shows your customers how serious you are about protecting customer information. An EV Cert provides a a more extensive and better warranty, with coverage between $1,0000-$1,000,000 being possible within the warranty.

  1. Technical Support

The more expensive the Cert, the more technical support you will receive from an SSL provider. Free certificates generally never have technical support. However, with an EV or OV technical support is provided while installing and validating the certificate. Make sure the support is available via different sources like email, live chat, contact us page, phone, social media resources, etc.

  1. Price

It’s not uncommon for web admins to think they should invest big bucks even with the option to get a free certificate – the ‘you get what you pay for mentality’. That’s solid thinking most of the time. Free certificates are valid only for a few days, and then after that you must renew them. If not, the browser will show your users that the website is insecure. The price of paid SSL certificates start at $10 and can go up to $350, depending on the type of SSL certificate.

  1. Vendor

Different vendors provide different price ranges and security elements for each certificate. Before choosing any SSL vendor you should verify that they have a good reputation. Do that by watching their reviews and consumer’s feedback on their website.

0

Overcoming Issues with Most Recent Windows 10 Update

4GHadmin | 19 August 2019
Reading Time: 3 minutes

A while back we had discussed some of the particulars with of the latest revisions available to people running desktop and notebook running Windows 10. Needless to say that encompasses a great many of them purring away at any given time all around the world, and it’s for that reason that some frequent undesirable occurrences seen with the most recent Windows 10 update are sufficiently noteworthy to the point that it makes sense for us to write about them in this week’s blog.

Here at 4GoodHosting, a part of what makes us a leading Canadian web hosting provider is the way in which we’re proactive in sharing information that’s easily identified as having value to our customer base. Given how ubiquitous the Windows OS is for personal computer users and the reality that’s unlikely to change, we’re going to discuss more than a few problematic issues that users are encountering quite frequently with the most recent Windows 10 update.

Reason enough to have less faith in the OS? That’s for you to decide.

The Issues

Where there’s smoke there is fire. While there had been rumblings about shortcomings with the latest Windows 10 update for a while, the way it is in the biz is that you don’t really take heed of these sorts of things until these sort of expressions of dissatisfaction become a little more numerous than just a few people here and there.

That’s the case now, and the consensus is that the latest update for Windows 10 is causing a string of issues for users. The update comes with patches against two critical vulnerabilities, but it seems they’re leading to problems. Among them are random reboots and inexplainable installation failures.

The update was made available on Tuesday of last week, and was created as a defense against a pair of remote code execution vulnerabilities which were deemed ‘wormable,’ – which means they are able to jump from one infected computer to another. Microsoft owned up to these vulnerabilities and informed users about the patches in a blog post, with users being encouraged to update their operating systems without delay.

Primary Problem 1, with Fix

Some users, however, have encountered difficulties when trying to apply the latest update,. To their credit, Microsoft has acknowledged that there ‘known issues’ with the update do exist.

Most notable among them:

A small number of devices may deliver a black screen on start up during the first logon after installing updates, and that this would be disconcerting for users.

The good news is there is a very simple fix for this;

  • Using Ctrl + Alt + Delete on the black screen and then using the Power button in the bottom right of the screen to select Restart. This should prompt the PC to boot normally.

Primary Problem 2, and NO Fix (Yet?)

The other significant problem with the update is the way it seems to be able to break some Visual Basic applications. More than a few users have reported that after installing this update, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) are seemingly no longer responding to basic requests and coming with them is a ‘invalid procedure call error.’ As the header there suggests, at this point at least there is no fix for this problem.

Similar feedback shared via a number of online discussion spots have also talked about repeated instances where the update causes random reboots to their systems. Others still are having problems downloading and installing the update itself. Microsoft reports that it is working on a solution for these issues, and those solutions should be rolled out in a future update.

What You Can Do

If you’ve gone with this recent Windows 10 update and are encountering one or all of these issues then the advice from the source is to update your operating system, and do so even if you’re worried about update issues with the security vulnerability being patched in the way it has been. It’s good advice, but be forewarned that you might see some issues with the update process.

If avoiding the update issues altogether is preferable for you – and you haven’t taken the update yet -, plus you’re okay with some risk, then there’s also this option; pause Windows updates until Microsoft announces a fix to this one.

0

40+ Different Device Drivers Found to Have Malware Security Flaw

4GHadmin | 12 August 2019
Reading Time: 3 minutes

The scope and extensiveness of malware risks for computing devices is more pronounced than ever before, and that’s pretty much the story from one month to the next these days. At a recent security conference in Las Vegas, the Eclypsium security research team announced they had dug up some serious security flaws in at least 40 device drivers from 20 different vendors. These vulnerabilities could increase the likelihood of devices being infected by malware.

While this type of development in itself is nothing out of the ordinary, what makes it noteworthy is the sheer number of different drivers that may be affected. Here at 4GoodHosting, we’re like any other reputable Canadian web hosting provider in that we strive to make our customers aware of risks to their digital security when they arise. When one is as potentially far reaching as this one, we’re almost always going to make some sort of announcement regarding it.

The Latest

The research team’s report is stating that this malware targets system BIOS or system components for the purposes of updating firmware, running diagnostics, or customizing options on the component. By doing so what the attackers have done is take the same tools used to manage a system and then turn them into powerful threats that can escalate quickly on the host.

Once the driver is infected it then provides the attacker with optimized access for means of launching malicious actions within all versions of Windows, and Windows Kernel most notably.

Do note that all these affected drivers are ones certified by Microsoft:

  • American Megatrends International (AMI)
  • ASRock
  • ASUSTeK Computer
  • ATI Technologies (AMD)
  • Biostar
  • EVGA
  • Getac
  • GIGABYTE
  • Huawei
  • Insyde
  • Intel
  • Micro-Star International (MSI)
  • NVIDIA
  • Phoenix Technologies
  • Realtek Semiconductor
  • SuperMicro
  • Toshiba

The Why

All of this is related to a specific design flaw in Windows device drivers. They have a functionality that can be taken advantage of to perform a read/write of sensitive resources without being restricted by Microsoft. Some are suggesting that bad coding practices are to blame for this, and while that can’t be substantiated it is true that there is a more pressing need for better ones these days and older work can be suspect.

At present, the understanding is that Microsoft will be using its HVCI (Hypervisor-enforced Code Integrity) capability to create a blacklist of drivers that are reported to them. The only problem there is that the HVCI feature is only available with 7th gen Intel CPUs along with newer processors only. The situation for older operating systems would be the need for manual installation, and this would also be true for newer ones where HVCI can’t be enabled.

Microsoft is now recommending that its users work with Windows Defender Application Control or turn on memory integrity for supported devices in Windows Security. This should block malware in software and drivers.

The Motivation for Developing Malware

Many people ask what exactly is in it for these malware developers to spend as much time as they do creating this infections and releasing them onto the world. Not sure there’s a clear answer to that, but it’s a good question. After all, people will assume that there’s nothing really to be gained by creating malware other than perhaps an individual sense of deranged satisfaction in messing with people and businesses.

This would be an incorrect assumption, however. The truth is that these people go to the effort to make malware because there’s money in it. For example, a botnet; a network of thousands – or even hundreds of thousands – of computers belonging to everyday people that have been infected with software that usually work to send out LOTS of spam.

Once a botnet network is established then it can be rented by individuals and organizations who want to send out spam promoting whatever it is they want promoted. Botnet owners make money, and same goes for keyloggers – they capture usernames and passwords and sell this information to whoever would like it and for whatever purpose.

These are just 2 examples of many. Long story short, the reason there’s people working to make malware is because – strangely enough – it’s profitable in one way or another.

0

Understanding Smart Contracts, and Their Relation to Blockchain & Bitcoin

4GHadmin | 30 July 2019
Reading Time: 4 minutes

It seems Bitcoin and all the hubbub about cryptocurrency is ‘back on’ now, and there’s a renewed general interest in mining for digital currency. The one takeaway anyone who’s developing an interest in this should take is that this is not a way to get rich quick, and that bitcoin mining is much more labour-intensive than you think. Blockchain technology is integrally important to managing cryptocurrencies, so f you’re still not dissuaded and you’d like to start amassing cryptocurrency for yourself then you’re encouraged to read on.

Here at 4GoodHosting, we join every other Canadian web hosting provider in understanding the way many of our customers have real interest in taking advantage of everything that’s there for discovery in the digital world. It’s likely more than a few are taking more than a passing interest in cryptocurrency mining, so today we’ll share some information these folks are going to find valuable.

Smart contracts have the potential to be one of the most useful tools associated with blockchain, and it’s almost certain that they’re going to take off right along the cryptocurrencies they’re designed to manage. So what exactly are smart contracts then?

No Administration Required

Smart contracts are self-executing, business automation applications that run on a decentralized network, such as blockchain. The appeal of them is specifically in the way they’re able to remove administrative overhead. Indeed, smart contracts are one of most attractive features associated with blockchain technology. Blockchain functions as a database, and confirms that transactions have taken place, while smart contracts execute pre-determined conditions at the same time. They’re not unlike a when a computer executes on “if/then,” or conditional, in programming.

The way all of this works is once certain conditions of a smart contract are met – and related to our discussion here that’ll be two parties agreeing to an exchange in cryptocurrency – they can automate the transfer of bitcoin, fiat money, or the receipt of a shipment of goods that makes it possible for them to continue on their journey.

The workings of that will reveal a blockchain ledger that stores the state of the smart contract.

Tokens and Smart Contracts

The different applications for smart contracts are pretty much endless. Let’s take the insurance industry; an insurance company could use smart contracts to automate the release of claim money paid out for events like large-scale floods, hurricanes or droughts. Another example would be when a cargo shipment enters a port and IoT sensors inside the container relay a confirmation that the contents have been unopened and stored properly along the entirety of the journey.

This means a bill of lading can then be issued without any manual – and time consuming – inspection of the goods being required.

As mentioned, smart contracts are also now creating the basis for the transferring of cryptocurrency and digital tokens. Which function as a representation of a physical asset or utility. The best-known example these days is Ethereum blockchain’s ERC-20 and ERC-721 tokens. Both are smart contracts.

However, don’t think all smart contracts are tokens. It’s possible to have smart contracts running on Ethereum that trigger an action based on a condition without an ERC-20 or ERC-721 being involved.

How Smart Contracts Mimic Business Rules

For all intents and purposes, smart contracts are business rules translated into software. If you compare them to business rules automation software or stored procedures, smart contracts can support automating processes stretching across corporate boundaries and involving multiple organizations in ways the automation software can’t.

The major functional difference is that rules can be applied not only within the corporation that coded the smart contract, but to other business partners approved to be on the blockchain.

Importance of Good Data, and ‘Oracles’ in Smart Contracts

Smart contracts are great, but each one is only as good as the rules that dictate its automating processes. Quality programming is crucial, as is the accuracy of the data fed into a smart contract. The nature of smart contract rules make it so that once they’re in place, they can’t be altered in any way. After a contract is written, no on – not even the programmer – can change it.

If it tuns out that the data isn’t true – and being on a blockchain doesn’t necessarily make it so that it is – the smart contract will be unable to work properly.

Why is this? Well, data fed into blockchains and used for smart contract execution is sourced externally, and from data feeds and APIs most notably – a blockchain is not able to ‘fetch’ data directly. Real-time data feeds for blockchains are referred to as oracles.

Little Disputability with Smart Contract Data

Oracles have traditionally transmitted data from a single source, and as such there is no data that’s entirely trustworthy. It can be benignly or maliciously corrupted due to faulty web sites, cheating service providers, or even by unintentional mistakes.

The way regular contracts function today can be problematic. This is because one party may perform a task, but after that the other party may decide not to pay, or there may be assumptions made by one of the parties about complexities of the contract that may not even be true.

The issue here is that those contracts are not rigorously enforceable, but smart contracts are. A smart contract is deterministic, and can absolutely be enforced as long as the events related to its contractual clauses happen.

Edge Computing, IoT and future of Smart Contracts

Within the next 5 to 7 years we should see a massive growth in IoT connected devices spurring greater use of smart contracts. It’s projected that the majority of the estimated 46 billion industrial and enterprise devices connected in 2023 will be dependent on edge computing. Addressing standardization and deployment issues will be crucial.

How smart contracts will benefit here is by offering a standardized method for accelerating data exchange and enabling processes between IoT devices. Essentially they’ll be removing the middleman – the server or cloud service that acts as the central communication spoke for requests and other traffic among IoT devices on a network.

Add this to blockchain ledgers decreasing the time required to complete IoT device information exchange and processing time, and the collective promise between both technologies becoming prominent is something to definitely keep an eye on. With the focus on process efficiency, supply chain and logistics opportunities smart contracts will almost certainly become more ubiquitous in the years ahead.

0

Chrome Users Encouraged to ‘Rat Out’ Deceptive Sites with New Add-On

4GHadmin | 22 July 2019
Reading Time: 3 minutes

Rats have always had a bad rap, and among all the many negative things associated with the rodents is the fact that ‘rat’ is no longer only a noun in the English language. It’s now also a verb. To ‘rat’ out someone or something is to make someone in position of power or authority aware of what that thing or person is doing when they shouldn’t be doing it. An example could be when you were kids and telling the school principal the names of the students you saw scratching their names into the side of the gymnasium.

They’re sure to be punished for it, but only you and the principal will ever know who exactly ‘ratted them out.’

Here at 4GoodHosting, we’re like any quality Canadian web hosting provider in that we don’t need to be prompted to stay on top of interesting developments in the digital world. We do it quite naturally, and we also have an at-least somewhat vested interest in maintaining a functional integrity for the World Wide Web.

All of which makes this recent news entirely newsworthy for our blog here.

Introducing the Suspicious Site Reporter

Google this week started requesting help in identifying suspicious websites, and to that end is making an add-on that lets them ‘rat out’ suspicious URLs through their Chrome browser. They can add the Suspicious Site Reporter, and what they’ll then see is a new flag-style icon on the top bar of the browser. When they come across a URL that’s fishy looking, all they have to do is click on the icon to report unsafe sites to Safe Browsing for further evaluation by the overlords at Google.

Safe Browsing is a ubiquitous term between Chrome, Mozilla’s Firefox, Apple’s Safari, and Android when users are steered away from sites that contain malicious or deceptive content. Google uses robots to scan the web and compile lists of websites that host malware, harmful downloads or deceptive ads and pages. Software developers then have the option of plugging into an API to integrate this list into their own applications.

In honesty, rival browser makers have done this for years, but it’s a fact none have the prestige or visibility that Chrome currently does.

What this ‘see, identify, and click’ results in is a warning that then tells user following in the footsteps of others that the intended destination is shady and proceeding further towards it is inadvisable. With Chrome, you can expect to see an alert reading ‘Deceptive site ahead’ and some explanatory text about why it’s being regarded that way.

So here it is that you don’t need to feel any discomfort about being ‘a rat.’

Different Designations

Some industry experts have stated they find some of the information in the pop-up box deployed after clicking the Suspicious Site Reporter to actually be suspicious on its own. One of them gave the example of visiting a national news organization’s site, and seeing the reason it was flagged as being ‘Haven’t visited site in the last 3 months.’

There’s another good and valuable warning that is issued when the browser is being steered toward a site with a deceptive URL, which is a common trick of hackers and phishers. There’s more than a few people who wouldn’t catch ‘go0gle.com’ instead of ‘google.com’, to use one example. For all these individuals, there will be a warning that helps you get back to safety.

This new feature was launched with Chrome 75, the current version that debuted June 4. As has been the case for a while though, Google commonly rolls out new Chrome features in stages in response to quality control interests.

If for some reason you Chrome 75 doesn’t have it, the Suspicious Site Reporter add-on can be downloaded from the Chrome e-store.

0

Domain Names, and What Makes Them SEO-Friendly – 9 Factors

4GHadmin | 02 July 2019
Reading Time: 4 minutes

It’s not as easy as saying that it’s only those looking to make money who will put a major premium on having good search engine rankings. Being high up on SERPs – or search engine results pages if you’re not familiar with that acronym – will be important for anyone who needs to have reliable visibility for their interests in being online, whatever those interests may be. If you’re one of them then you’re likely putting the bulk of your focus into keyword optimization. That’s the way it should be, and that should continue to be one of your priorities.

Many people aren’t aware of the fact that their domain name also plays a role in how well their website ranks in SERPs. Here at 4GoodHosting, we’re like every quality Canadian web hosting provider in that we know that the success of people with their online ventures is directly beneficial to us as well. It’s for this reason that sharing information on SEO-bosting domains is something we know might well be good for the both of us.

So that’s what we’ll look at here today, and hopefully the information is ideal for anyone who’s about to register a domain name or for others who might want to reconsider their current one based on what they learn here.

Factors Determining a Domain Name’s SEO Value

Everyone’s familiar with Google’s authority when it comes to anything related to the World Wide Web. They’ve stated that there are some 200 different factors that come into play for SEO, and it turns out that domain name is one of the important of them. Choosing the right SEO-Friendly domain name should be one of the crucial decision for your business.

So, without anything more in the way of fluff talk, let’s get right to them.

  1. Make it a Brandable Domain Name if Possible

This one will apply more to companies operating an ecommerce website or one that promotes your business more generally. If you can incorporate your company brand into your domain name, it’s definitely beneficial.

That needs to be mentioned, because some businesses avoid using their company name in the domain name of their website. Considering Google values branding more than keywords, they’re missing the mark if so.

  1. Make it a Unique Domain Name

The best product or brand names are generally going to be unique, and this correlates directly to a more likely availability of the domain name. Not only that, but it will be better received by the users as well, and in a very short period of time this will start boosting your SEO rankings too

  1. Target Keyword

Choose a domain name that contains keywords about your business, products/services, etc. However, if your domain name has natural keywords then it is also beneficial and advisable. And if this is overly challenging, here’s a suggestion that may catch you by surprise, but is actually really effective! Ask your kids to tell you what word they’d most naturally associate with your chosen industry.

  1. Exact Match Domains (EMDs)

Exact Match Domains all target keywords you’d like your website to rank for. If this something you can do, then it’s very helpful and really fast tracks you towards better SEO. Do keep in mind, however, that branding is not included in this method.

  1. Aim for Domain Name ‘Fluency’

Having the domain name of your website communicate the right message is important. People will have a better perception of what your business is all about, and what you’re offering, when you making your domain name have some relevance to the product, service, or overarching industry. Domain name fluency is the name given to this.

  1. Be Conscious of the Length of Your Domain Name

Industry insiders have never really come to a definitive answer to how short or too long a domain name has to be in order to have the length be detrimental to SEO. That said, we’ve spoken to a good many very knowledgeable people about this and the consensus is that you should never have more than 2 separate words in your domain name.

Which leads us to our next point very nicely..

  1. Avoid Hyphens in a Domain Name

Using hyphens in a domain isn’t uncommon, but the plain fact is that you shouldn’t do it. Why? Hyphens are associated with spammy websites. There are plenty of filters out there to banish spam URLs from SERPs, and if your domain name has a hyphen then your website may suffer a similar fate.

  1. No Numbers Either

Numbers are also inadvisable. This is primarily because if someone hears about your domain name and then remembers it later with their phone in hand or in front of the desktop or notebook they may well find themselves thinking if they are enter the digit or spell it out when entering the URL. Try it once and be unsuccessful and they may just decide to give up on it.

  1. Domain Extension

A domain name with an extensions that qualifies as a Top Level Domain (TLD) is very advantageous when it comes to SEO. A .com domain is still the industry standard for TLDs, so if your domain name of choice has that extension available it’s worthy whatever cost there is to acquire it.

It absolutely boost the credibility of your domain as well.

0

Google is Blocking Ad Blockers in Chrome: Paid Web Browsers the Future

4GHadmin | 11 June 2019
Reading Time: 3 minutes

Many people lament the fact that the Internet can’t be an unimpeded digital information source and not have commercial interests to the extent it does. It would be nice if it was a fountain of knowledge that exists for everyone’s own information gathering exclusively, but living in the world we do when there’s a buck to be made somewhere the opportunity will be taken. It’s especially frustrating for people who aren’t big consumers and have never clicked on a link or purchased very little online.

Google has recently moved to limit Chrome’s ad-blocking capabilities, and no doubt many of you using an ad-blocker will have already noticed this. Google also announced that this feature will not apply for Google’s paid G Suite Enterprise subscribers. Here at 4GoodHosting, we’re a Canadian web hosting provider who keeps our thumbs on the pulse of the digital world and the prospect of ad-free internet browsing only via paid web browsers would be a pretty big deal for nearly all of us who source information online.

According to a recent study, as many as 40% of people browsing the web from laptops use an ad blocker. That’s a big group of people that aren’t viewing Google’s ads. So why’s this happening, and what’s the underlying current here?

Beyond Blocked Blockers

It’s been reported in the news how Chrome users – and developers of Chrome-friendly, ad-blocker extensions – are none too pleased with Google’s proposed changes to the Chrome Extensions platform. We have to go back to when Google announced Manifest V3, which constituted a set of proposed changes to Google Chrome’s Extensions platform.

In it, specific changes to Chrome’s webRequest API were proposed with an eye to limiting the blocking version of it and this potentially would remove blocking options from most events and creating them as observational only. Content blockers would now use a different API instead, known as a ‘declarativeNetRequest.’ The Manifest concluded that this new API is “more performant and offers better privacy guarantees to users.”

The reality is though that Google’s Manifest V3 changes will prevent Chrome’s ad-blocker extensions from using the webRequest API as it normally, but it will also force them to use a new API (declarativeNetRequest). One that isn’t compatible with how existing popular adblocker extensions function and making them ineffective.

It’s fairly clear to see that Google is being receptive to the concerns of paying advertisers in ensuring the delivery of their ads to site visitors, and they’re not going to be supportive of ad blockers from now own.

A recent industry publishing had a statement from a spokesperson at Google regarding these changes in Chrome – “Chrome supports the use and development of ad blockers. We’re actively working with the developer community to get feedback and iterate on the design of a privacy-preserving content filtering system that limits the amount of sensitive browser data shared with third parties.”

They then added further, “for managed environments like businesses, we offer administration features at no charge.”

For now, Google is still intending to block ad blockers in Chrome, while people who are subscribed to their G Suite Enterprise-level of services will enjoy ad-free viewing.

Pay to Play Soon?

In the past it was that Chrome could be an ad-free browsing experience at no additional cost. Now it seems you’ll have to subscribe to premium G Suite services, and the highest, most expensive version of it. How much? It’s $25 per user, per month, and that’s no small change for any type of online monthly service.

It’s not difficult to figure out what’s Google’s interest in doing this. They can increase the amount of revenue generated from users viewing ads if non-Enterprise subscribing users, based in large part because most people won’t pay for G Suite and more of them will see ads they’ll click through.

Keep in mind that Google’s competitors like Microsoft Edge and Firefox are still fine with supporting ad blockers, so it’s fair to assume they’ll be people who’ll abandon Chrome for another browser. Even if they think Chrome is superior, as there are many people who simply can’t stand ads and particularly if they’re researching for work or academic purposes and time is of the issue.

Google’s G Suite’s low and mid-tier subscribers will still be seeing ads too, it’s only the 25-a-month subscribers who’ll be enjoying ad-free browsing. G Suite Basic is $6 dollars per user per month and G Suite Business is $12 per user month.

Any of you planning to jump ship if your ad blocker is rendered useless?

0

3 Million Malwares Across Android Last Year in N. America

4GHadmin | 03 June 2019
Reading Time: 4 minutes

Just a few weeks back we were sharing with you how WhatsApp was recommending users reinstall their app because of it being hacked. Hopefully those of you that use it have already done so, and if you have then you’re probably good to go with instant messaging for the foreseeable future. It turns out however that the problem of hacks, infection, malware and more is a lot more extensive than just one app and one operating system.

A quality Canadian web hosting provider is going to be one that appreciates the full extent of just how much digital connectiveness is important to people, and here at 4GoodHosting we have a front row seat to see the way mobile web browsing has pulled away from desktop in as far as being the means of choice for people. It all points to one well-understood reality; we’re turning to our mobile devices for more and more of everything that we do during the day.

A good many of us (myself included) have Android phones, and that’s why recent news from Quick Heal Security Labs is really undeniable when it comes to highlighting the extent of the cyber-attack problem for Android users in nor. And that is that apparently over 3 million malware were detected on Android OS in 2018.

Big Number, Big Problem

We can paint a picture of the severity of this best by sharing some numbers:

  • 3,059 malware infections per day, working out to 2 every minute across the country for Android devices
  • 1,786 adware infections per day, equally 1 per minute
  • 4,670 PUAs per day, and that’s 3 per minute

Yes, there’s an awful lot of smartphones out there, and a good many of them are going to have an Android OS. Those numbers are still fairly staggering though, and it really does put the problem in some perspective. And what’s interesting is that despite the rapid rise in cyberattacks on mobile devices, cyber security experts say device owners aren’t taking this as seriously as they should be.

Serious Business

Experts state that there will be a significant rise in mobile-focused malware and banking trojans, and another major mobile-based threat expected to be coming more to the forefront involves malicious code being introduced into clean-owned applications post update. Further, it would seem that this is more likely to take place once the download count reaches a certain landmark with the Google Play Store, according to the same report from Quick Heal.

Earlier this year a test was performed to check the efficiency of Android antivirus apps from Google Play. 250 apps were tested, and the results weren’t agreeable – more than two thirds failed to come back with a malware-block rate of 30% or better. Also turned out to be true that less than 1 in 10 of the apps tested were not able to defend against all the 2,000 malicious apps.

Not All Antiviruses the Same

There is no shortage of cheap and free antivirus apps accessible for consumers these days, but the reality is that only a few of those provide sufficiently powerful shielding against cyber threats. It’s important to validate the effectiveness of any you might be considering. There’s plenty of information on the web about them and quality reviews from knowledgeable people, so we’ll stay away from that topic here today and look at the most prevalent of these Android malwares being seen.

Top Android Malware for 2018

It seems the most common infection was with one called Android.Agent.GEN14722, which made its way into some 100,000 smartphones around the world last year. That’s just for the year though, overall and looking at it long-term, another two called Android.Agent.A1a92 and Android.Gmobi.A are the most prevalent malware found on mobile devices worldwide.

Other notables:

  • Umpay.GEN14924 at 25% of the total amount
  • MobileTrack.Gen7151 at 10%
  • Smreg.DA at 8%
  • Agent.DC6fb8 at 8%
  • Airpush.J at 7%

There were also function predispositions and focuses seen with these malware. Many aim to attack social media accounts for malicious purposes (like the Spyware bug that WhatsApp had recently), while others are geared to be invisible after installation and then display full-screen ads to users and earn revenue.

There’s also the FakeApp trick, which increases the number of sponsored app download counts and reviews. That’s clearly not as evil, but still something that people won’t be welcoming of in the slightest. Lastly, some activate by means of PDF attachments sent via phishing emails to launch malware on the device.

Be Proactive in Protecting Yourself

As mentioned, the right anti-malware for Android mobile devices is becoming more and more of a necessity, and especially so as it’s unlikely we’re going to see a decrease in the number of these malware threats that are emerging. This is especially true as each Android phone has a camera, speaker and a location tracker that quickly collects data from every place the consumer goes. When users are not aware about having this malware, the way they go about their day-to-day just the same as always puts their online privacy and sensitive data at risk.

AV apps that come from genuine security vendors are your best choice, as they regularly release updated versions to protect the users from the latest threats. These may come at a cost, but if you’ve got an understanding of just how pervasive this problem is then you should be okay with paying a little something for the security of your phone.

And yes, iOS is not immune to these problems either, although it may be true that the numbers attached to it might not be so massive as they seem to be for Android.

0

Choosing the Right IoT Platform

4GHadmin | 27 May 2019
Reading Time: 5 minutes

No doubt the Internet of Things needs no introduction here given how the latest big wrinkle in the application of World Wide Web-based technology has become so integrally involved in both our private and working lives. As it stands currently, working with IoT applies to some businesses more than others, but it’s fair to say that any of them that put a premium on customer accessibility and control will need to be adhering to IoT realities.

Here at 4GoodHosting, we’re a good Canadian web hosting provider like any other in that we prefer to keep our thumbs on the pulse of certain trends in the greater industry more so than others. IoT is definitely one of them, and it continues to be interesting to watch how it reaches further into our digital world every day. Consumers are going to expect more and more ‘smartness’ from their ‘things’ going forward, and businesses of course need to be receptive to that.

This makes choosing the right IoT platform a complex endeavor. The landscape can be confusing for IoT hobbyists, experienced developers, and senior executives alike. Today we’ll give you a quick overview of the IoT platform landscape and how you should evaluate IoT platforms based on your needs.

Defining an IoT Platform

Quite simply, an IoT platform is an integrated service offering what’s needed to bring physical objects online. Supporting millions of simultaneous device connections is the challenge, and your platform needs to allow you to configure your devices for optimized communication between machines. The consensus among developers is that it’s really quite difficult to build a well-functioning IoT product.

IoT Platform Types

End-to-end IoT Platforms

End-to-end IoT platforms provide hardware, software, connectivity, security, and device management tools to handle the massive numbers of concurrent device connections. They also provide all managed integrations needed, which can include OTA firmware updates, device management, cloud connection, cellular modem and more, all of which connect and monitor a fleet of devices online.

Connectivity Management Platforms

These platforms offer low-power and low-cost connectivity management solutions via Wi-Fi and cellular technologies. Connectivity hardware, cellular networks, and data routing features are all part of connectivity management platforms in IoT.

IoT Cloud Platforms

Cloud platforms are very beneficial, serving to get rid of the complexity of building your own complex network stack and offering backend and other services to monitor and track millions of device connections that are occurring simultaneously.

Data Platform

As you’d imagine, every type of IoT platform deals with data in some way. IoT data platforms serve the function of combining many of the tools you need to manage / visualize data analytics and them route them as needed.

IoT Platform Verticals

Placing these IoT platforms into categories is really being too simple with them. The breadth of functionality for each makes it so that they don’t fit into a single category. The most logical way of looking at them is what they offer for different interests and related users:

Hobbyists / Prototyping Solutions / Utilities / Live Search (A.I.) Applications / Development Kits / DIY solutions / Consumer Electronics / Home automation / Wearables / Industrial IoT (IIoT) Solutions / Smart factory warehousing applications / Predictive and remote maintenance / Industrial security systems / Asset tracking and smart logistics/ Transportation monitoring / Energy optimization / Connected logistics / Agriculture Industry / Healthcare Industry / Energy Industry / Smart Cities

What to Look for When Examining Platforms

It’s definitely helpful to know what you should be looking for, based on your intended solution:

  1. Connectivity

How effectively is the vendor’s network coverage fitting your business’ current and future initiatives?

  1. Method of Connectivity

What type of connectivity is needed? Will a Wi-Fi or cellular solution be best for your IoT product? Assess these needs and then determine how the vendor can address them.

  1. Market Longevity

Looking at how long the IoT platform been in business is helpful. The space itself is relatively new, but building has occurred quickly and a lot can and will change in a very short period of time. Aim to find an IoT platform that has been offering services for 4+ years at a minimum.

  1. Type of Service

How does the IoT platform describe and sell themselves? Some will be purely connectivity platforms, some will be end-to-end solutions that offer hardware and software to go along with connectivity. How one will suit you best comes about after assessing your business needs. How will they change over time?

  1. Geographic Coverage

Is an embedded sim with global support provided? Is this IoT platform one that covers the regions your business needs? Looking over all aspects of your global reach needs should be part of the consideration as well.

  1. Data Plan

Is a fair data plan included with the platform? The ability to pause or suspend your data services at any time and the ability to control how much data that is used should be on your checklist.

  1. Security / Privacy

Look into the platform and specifically how they’ve dealt with security and privacy issues and reviewed their security content as needed to date. Evaluate how their platform combats security issues frees you from having to do that yourself.

  1. Managed Integrations / API Access

How does the vendor integrate every complexity required for the IoT connectivity you’re after – cellular modems, carrier / sim cards, device diagnostics, firmware updates, cloud connections, security, application layer, RTOS. The best ones will consolidate all into a simple package that works out to very little of it ending up on your plate.

  1. Data Access

How easy does it look to be to take the data acquired through the IoT platform and then integrate it with your enterprise back ends and current cloud service? How will this data then be used? Does the service match those needs?

  1. IoT Ecosystem

The relationships between the services the IoT platform offers should be clearly understood. This will help you learn how their services can be of assistance in helping you build your product

  1. IoT Roadmap

The expansion of IoT platforms is going to continue ahead at full steam. Does this IoT platform’s roadmap match your organization’s needs, and will expansions into connectivity, data, and hardware be helpful for you?

  1. OTA Firmware Updates

How does the vendor allow you to send updates and fix bugs on your devices remotely? It is a simple process, or a complex one. Obviously, simpler is far preferable.

Good Ones

  • Particle — Particle is an enterprise IoT platform that’s ideal for building an IoT product, from Device to Cloud.
  • Salesforce IoT — Maximizes your business efforts with IoT cloud services.
  • Microsoft IoT Azure — Very popular, and enhances operational productivity and profitability by means of a preconfigured connected factory solution.
  • Artik Cloud — The ARTIK IoT platform is ideal for IoT open data exchange
  • Google Cloud’s IoT Platform — integrated services that get high marks from end users and allow you to easily and securely connect, manage, and internalize IoT data
  • IBM Watson IoT — IBM’s new Watson Internet of Things (IoT) is a cognitive system that picks up on AI and then practicalizes it for use within IoT functionality.
  • Xively Platform — an enterprise IoT platform to help accelerate your connected product or service.

These are just a few of many that seem well-received by developers.

0

Major Security Hack Means It’s Time to Update or Re-Install WhatsApp

4GHadmin | 21 May 2019
Reading Time: 3 minutes

WhatsApp is one of the most ubiquitous and popular instant messenger apps these days, and it’s fair to say that there’s likely hundreds of thousands of people who have it installed on their smartphone and make frequent use of it. Well, no one’s about to tell you should stop doing so if you’re one of them, but it turns out that you may want to update it manually now – or perhaps even better delete and re-install it – due to recent developments that have just now gotten out into the media.

Part of being a good Canadian web hosting provider is giving clients a heads up on such developments, and that describes 4GoodHosting to a tee if we may say so ourselves. Often times these sorts of things aren’t quite ‘newsworthy’ in that sense, but again considering how common WhatsApp is these days we decided to make it our topic for the week.

Right then. So, despite encrypting every conversation and following best security practices, WhatsApp (which is owned by Facebook for those of you who care about those things) it seems has been the victim of a cyber attack.

It recently announced that it found a vulnerability that was allowing shady types to infect WhatsApp users with spyware when they made – or even attempted to make – a call using the app.

No Answer – No Problem

Now most people aren’t ones to take notes of character and number chains, but it would seem this this WhatsApp vulnerability is going by CVE-2019-3568. What makes it especially noteworthy is that it allows attackers to infect the device, and have success doing so even if the user at the other end receiving the call didn’t answer it.

The means by which these nefarious individuals did this was by exploiting a buffer overflow weakness in the app, one that enables them to hack into WhatsApp before doing the same on the device running the app.

When asked about it, the security team at WhatsApp chose to refer to it as an ‘advanced cyber actor’ – a rare but very dangerous type of cyberattack. It is different from other malware attacks that are done with the more standard ‘phishing’ approaches. If it were of a more ordinary version of this type, the phishing nature of it would mean that the individual on the other end would need to answer the call in order for the infection to be complete.

As mentioned, however, attackers can use spyware to exploit the devices – even if the users don’t receive the call.

Right, onto the potential repercussions of any such attack. They can result in cybercriminals gaining access to personal data stored on the phone. Further, it could allow them to modify things or lock the mobile before demanding a ransom from the users.

If you’re reading this and you’ve yet to receive any ransom notes for a unexplainably locked device or any other similar red flag, you’re likely okay but you should go ahead and delete and reinstall WhatsApp. Interestingly enough, I just got a new Android phone the other day and so I was installing WhatsApp quite literally at the same time I was reading this news. So unless you’re in a similar scenario, you should definitely be looking for an available update at the very least (and make sure it’s a very recent one)

These WhatsApp versions were vulnerable to the spyware attack:

  • WhatsApp for Android prior to v2.19.134
  • WhatsApp Business for Android prior to v2.19.44
  • WhatsApp for Windows Phone prior to v2.18.348
  • WhatsApp for iOS prior to v2.19.51
  • WhatsApp Business for iOS prior to v2.19.51
  • WhatsApp for Tizen prior to v2.18.15

Go Get ‘Em

It’s been reported that WhatsApp responded to the attack without delay and said the only became aware of the vulnerability some time earlier this month. Within 10 days of realizing the breach, WhatsApp released a server-side fix to mitigate the attack. It’s understood, however, that many WhatsApp users were already potentially exposed to the attack before the fix was issued.

In addition, WhatsApp is also releasing an update to the mobile app as of today (Monday, May 20th) that should help squash similar cyber attacks for the foreseeable future. Along with the patch they have asked all users to update the app to the latest version while also ensuring their operating system is equally as updated.

Off you go and update your WhatsApp if it’s part of the indispensable array of apps you use on your device day in and out.

0