The old bait and switch: promise you one thing and sell you another. That’s what happened when I signed up for a year of VPN service through NordVPN. Their website said:
“Easiest VPN Ever. To get on NordVPN, just click and go. NordVPN’s secure VPN software takes care of all the hard stuff so you can focus on fun stuff. And work stuff, if you have to.”
Their imagery showed multiple devices running their software, including phones and laptops.
I had read about their service and took the plunge. After I had paid, I found out they do not have an app for Mac OS X or Android. Those apps are supposedly coming soon, but not yet. For now, you have to download a third-party app for each device, download a bunch of configuration files, install said configuration files, configure a bunch of things, remember your username and password for each configuration file, and then figure out what is going on and whether or not you are actually connected.
To be fair, they do have instructions on how to do all of this, but it is far from “Easiest VPN Ever.” Every other VPN app I have used is a simple app you download and click a button to get going with.
I chatted with NordVPN’s technical support guy, “Dave,” who informed me that of their refund policy, which states that unless their product did not work for a fault of their own, I could not get a refund for my money. All he could do was extend my subscription by 3 months.
(01:30:40) David: if the service does not work we will issue a refund. (01:31:17) Visitor 34392357: that is my point – it doesn’t work as you advertise it. it only works through a lengthy process of installing other software.
I would argue that their product does not work as advertised and I am entitled to a refund. In fact, it’s not even their product I am using — I am using something called “Tunnelblick” on my Mac, and an app called OpenVPN on my Android phone to connect to the NordVPN servers.
In summary, the bait was the promise of an easy to use VPN app. The switch was not even having an app for me to use. And no matter what VPN you will choose, be sure to run a speed test so you can see if your VPN is slowing down your internet speed.
We have one network in the world today. Either we build our communications infrastructure for surveillance, or we build it for security. Either everyone gets to spy, or no one gets to spy. That’s our choice, with the Internet, with cell phone networks, with everything.
Update 4.23.15: I received a promotional email (spam) from TrueCar.com today, even after I was assured that they had unsubscribed me! I let them know by responding to their tweet from 3.31. They asked me to DM them about it, and they requested me to forward the email I received so that they could investigate an apparent “bug” in their system. The person on the other end of the twitterator said they I was indeed unsubscribed, so they weren’t sure what was going on. I’ll keep you all posted!
Update 3.31.15: TrueCar tweeted me today, saying that the issue I describe below is a display issue of some sort. They assured me that I was in fact unsubscribed from their email communications.
Thanks for looking into the matter, TrueCar.com!
—————
I run across this sort of thing all the time: companies that violate the rules of the US CAN-SPAM act, the law that is intended to protect consumers from unwanted email. If I have time, I stop to email companies I find violating the law to kindly point out what they are doing wrong. Call it some sort of self-satisfaction, Robin Hood vigilantism, or pure geekish annoyance, but I can’t help myself sometimes. Here’s one I sent today to TrueCar.com.
To: feedback@truecar.com Subject: True Care website feedback
Hi, I noticed that when I go to “Subscriptions” in my profile, there is an issue with unsubscribing from emails.
If I uncheck all subscription options, then check “Unsubscribe from all,” then click the Save Changes button, it says my options have been saved.
However, if I go to another page and return to “Subscriptions,” the “In-stock offers from your dealers” button is checked again. How is that “Unsubscribing from all?”
You guys might want to fix that, as it violates the US CAN-SPAM act.
Thanks,
Will
Sneakily re-subscribing me to a category of emails, after I have specifically opted not to be a part of it anymore, is blatantly in violation of the CAN-SPAM act. Particularly, the part that says, “You may create a menu to allow a recipient to opt out of certain types of messages, but you must include the option to stop all commercial messages from you.”
Yes, they include that option, but it doesn’t seem to fully work.
WordPress as a platform has been a solid, secure application over the years. The few times a vulnerability has been found, the WP team has been super-fast to patch it, publicize it, and take care of business.
That said, there are two major areas where WordPress lacks in security:
1. Plugins
2. Administrators
There are so many plugins for WordPress, which is part of what makes it so great. However, those plugins can also present attack vectors, and we see evidence of this almost every day.
It was just revealed that most WP users have very little understanding of the risk they are lending to their own websites. Not updating plugins, not updating WP itself, and not doing backups, are the most easily fixed things that people tend to not do.
This puts WP websites at risk, lets them get hacked, and gives WordPress as a whole a bad wrap.
The survey of 503 WordPress users, which took place online during February this year, revealed that WordPress users are more exposed to security problems than expected. In total, 54 percent of respondents said they updated WordPress between once a week and every few weeks, and yet only 24 percent back their websites up — and only 23 percent have received training in the use of tools such as backup plugins.
I have quit Facebook for good, in case you came here trying to find out what’s up. Why have I done this?
Facebook made changes to their user agreement on January 30, and I don’t feel OK about them at all. This article, Get Your Loved Ones Off Facebook, factually sums up everything Facebook can do, and does do, with the information it collects about you, and it might give you the same uneasy feeling it gave me.
The information grabbing and sharing Facebook does reaches far and deep, and it’s not limited to what you do while on Facebook itself. Anything you do anywhere on the Internet where a Facebook Like button is present reports your activity back to Facebook. And that means just about everywhere.
“I have nothing to hide”, you say?
The issue here isn’t what we have to hide, it’s maintaining an important right to our freedom — which is the right to privacy, and the right to have a say in how information about us is used. We’ve giving up those rights forever by using Facebook.
I want to quote the part of that article that gave me the biggest heebie-jeebies, because I know most of you won’t actually go read it yourselves. As of 3 days ago:
Facebook is demanding to track what you buy, and your financial information like bank account and credit card numbers. It’s already started sharing data with Mastercard. They’ll use the fact that you stayed on Facebook as “permission” to make deals with all kinds of banks and financial institutions to get your data from them. They’ll call it anonymous, but like they trick your friends to reveal your data to the third-parties with apps, they’ll create loopholes here too.
Facebook is also insisting to track your location via your phone’s GPS, everywhere and all the time. It’ll know extactly who you spend your time with. They’ll know your habits, they’ll know when you call in sick at work, but are really out bowling. “Sal likes 2pm Bowling at Secret Lanes.” They’ll know if you join an addict support group, or go to a psychiatrist, or a psychic, or a mistress. They’ll know how many times you’ve been to the doctor or hospital, and be able to share that with prospective insurers or employers. They’ll know when you’re secretly job hunting, and will sell your endorsement for job sites to your friends and colleagues — you’ll be revealed.
They’ll know everything that can be revealed by your location, and they’ll use it however they want to make a buck.
And — it’ll all be done retrospectively. If you stay on Facebook past January 30th, there’s nothing stopping all of your past location and financial data to get used. They’ll get your past location data from when your friends checked-in with you, and the GPS data stored in photos of you. They’ll pull your old financial records – that embarrasing medicine you bought with your credit card 5 years ago will be added to your profile to be used as Facebook chooses. It will be sold again and again, and likely used against you. It will be shared with governments and be freely available from loads of “third-party” companies who do nothing but sell personal data, and irreversibly eliminate your privacy.
There you have it. You can still find me here and on G+. For now.
Here are some infosec-related resources, tips, and interesting things I’ve come across in the last few days, all of which are related to to cyber security and you. Hope you find this stuff useful.
Adobe spies on readers: EVERY page you turn tracked by the mothership. Another case of anti-piracy efforts turning into anti-privacy overstepping.
Edit: Here’s a late-breaker to add to the list:
Surveillance Self-Defense is the Electronic Frontier Foundation’s guide to defending yourself and your friends from surveillance by using secure technology and developing careful practices.
My banjo buddy Jason Skinner, a phenomenal Don Reno-style picker, has made some updates to his YouTube channel. I’ve had the pleasure of learning from Jason in person over the last few years, and I’m glad to see he’s back at it online. I’ll be hitting the woodshed for the winter to study and learn. If you don’t see me until next spring, you will know why.
I’m not sure anyone will want to read this entire post, but I wanted to share it and document it in case anyone else finds themselves in the same boat.
Charter Communications is a bad, bad company. Charter Communications has terrible customer service. Here is my story.
We bought and moved into a new house in July. We called to have Charter set up a couple of days before we moved in, and their Residential department said they did not service our address because the line was over 1000 feet away. However, there was a Charter box at the end of our driveway, roughly 35 feet from the house, and the people who sold us the house guaranteed that Charter was available. Our new neighbors have Charter Business being served from that box, so Charter was clearly available.
I called Charter Business, and they said they could definitely service us from that box. It’d be a little more money each month, but we knew we needed it, so we jumped in. We were assigned a friendly Business representative who was very helpful in getting us all set up. At this time, we were told we could cancel and get a refund within 30 days.
A couple of weeks into the Business service, I called Residential back, just to see if they could switch us over since we were unhappy with our Business account, and since we clearly had Charter access at our house now. With Business, we were paying more for fewer features, such as a poorer channel lineup, no music channels, and no On Demand. They said they could definitely help us, however, we’d need to have Business cancelled separately since they were “two separate things” in Charter. They said that there was nothing they could do to make a seamless switch, and that they’d have to treat this as a new service being set up.
They sent a Charter Residential technician to come out and set up our new Residential service. He said he had to replace all of our HD boxes and our modem with new ones since this was considered a new setup. I thought that was silly, but he swapped out all the hardware, got us set up, took the old hardware with him, and went on his way.
The next day, I called Business, as instructed by Residential, and asked them to cancel our service. They obliged. Unfortunately, they also sent a guy out who promptly disconnected our service altogether. Apparently, he didn’t know we had switched over to Residential service.
We had to call and schedule an appointment for reconnection. You know how appointments go: they give you a 4 hour window in which you must come home from work early for, only for them to arrive late. It turned out we didn’t even need to be there for the reconnection to occur, but they didn’t tell us that ahead of time. A pain, but they got us reconnected. We went about our lives, thinking this was all over.
Then we got the bill from Charter Business in the mail. They wanted us to pay for the first month of service and three missing HD boxes: the boxes that the Residential technician took with him when he switched over. The bill was about $650.
Here we were with none of the hardware they said we had, thinking we’d actually be getting a refund since we cancelled within 30 days. Instead we got a $650 bill!
I promptly called the Business billing folks to clear up the situation. They filed a lost equipment report of some kind regarding the HD boxes and said they’d let me know the results the next day. Then, they told me that because this was not a “change of service” or a “switch” that we didn’t qualify for the 30 day refund. I told them that when I called to switch from Business to Residential, I was told I couldn’t do a switch, that it had to be two separate transactions. The customer service rep said it didn’t matter. I got off the phone, exasperated.
The next day, they didn’t call me about the missing equipment report as promised. I called them back to find out the status, but there was no record of it on my account, apparently. So they filed another one.
I also asked about the refund again. This time, I got a whole different story. Wait until you hear this. The Billing customer service lady told me that because I didn’t mention the 30 day refund when I cancelled service, I didn’t qualify for it. I asked her how I was supposed to know I had to mention it, and she said I should have known based on commercials or advertisements. That seemed absolutely insane to me. After asking to talk to a manager, which she wouldn’t let me do, she told me I’d need to talk to my original Business sales rep about it since he was the only one who could reverse the charges or do anything about it.
So, I emailed him back and explained the situation. He said that he couldn’t do a thing, and that I’d have to call Billing. I told him that they sent me to him, but he never emailed me back.
At this point, I filed a complaint with the FCC.
Then, I started getting calls from a strange number at all hours of the day. I finally answered and it was an “equipment recovery” company (aka collections agency) attempting to find the missing HD boxes. They were persistent, even thought I told them what happened. Finally, they made a note of it on my account and let me go. I still got a letter from them saying the same thing: that my HD boxes needed to be turned in or I’d owe $125 each.
Charter CEO Thomas Rutledge makes over $2 million a year. I don’t.
I haven’t heard from Charter since the FCC complaint, but I did hear from the collections company again. This time it was about the cable modem from the business account. I told them that the Charter technician took it with him. They guy said he’d make a note of it.
So that is where I am after almost 2 months of this rigmarole. I have yet to see a credit to my account from Charter Business. It would be about $239 I could really don’t think I need to pay since I cancelled within the 30 day trial period. They have since sent me another bill asking me to pay up.
I’ll update this post as I learn more. Maybe Thomas Rutledge, the Charter CEO, will see this and realize how screwed up his company is. One can hope, anyway.
Update January, 2015: I received a phone call from a Charter Business representative not long after this blog post came out. He assured me that he would have an account specialist look into the situation and that I’d soon hear back from him on the status. I never heard anything. I also never got another bill from Charter Business!
Here are some infosec-related resources, tips, and interesting things I’ve come across in the last few days, all of which are related to to cyber security and you. Hope you find this stuff useful.
