Blog

My client forwarded me this scam-solicitation earlier today and I am posting it as a warning to everyone - watch out for this "Web Envy Solutions" based out of Stafford, TX.  

The interesting part about this particular scam is they didn't email it to my client: they FAXED it!  

End-to-end encryption is one of the key features promised by ProtonMail, with a zero-access setup ensuring that not even ProtonMail can see what your messages are about. What’s more, the code and cryptography that ProtonMail is built on open source and available for anyone to see, so there’s no chance of any back doors being hidden away.

On top of the encryption, the service offers other features designed to protect your privacy. You don’t need to provide any personal details when you sign up, for example, and ProtonMail doesn’t keep IP logs of your account access. There’s also the option to set an expiration date for sent email messages, so you can use your email account more like you use Snapchat.

I noticed recently that a handful of sites had broken pagination: clicking through "Page 1 - 2 - 3 - 4" at the bottom of my blog pages, for example, were leading to URL issues where it didn't matter if you clicked on Page 3 or page 4, both pages were linking to /page-2.html or similar.

Deciding whether or not to show the number of or "hits" or "views" that an article has received is easy with Joomla: you toggle them globally, and on a per-article basis. So if you have an blog with relatively low traffic, but you have a popular article where you want to show how a hit counter, it's easy: disable the view count globally and enable it for the individual article.

After a while, this starts to get old, because you generally post an article without the hit counter showing and then if it gets a lot of traffic, you want to turn it on.

General Strategy: Multiple "Wallets"

Your day-to-day wallet will probably be tied to a centralized bitcoin exchange, like a Coinbase account. With Coinbase, you can create multiple wallet addresses under a single account (suppose you have 3 or 4 businesses, each could have their own Wallet Address that gets used for receiving payments). I think of Coinbase as your starting point: you'll most likely be using Coinbase to convert your $USD-based checking account funds into Bitcoin (or whichever cryptocurrency you choose).

Create your free Coinbase account now!
(affiliate link)

Your second wallet should be created manually, not connected with Coinbase. 

Continue reading this article on my blog...

A client recently received this letter with CORRECT domain expiration date and no clear "SOLICITATION" warning. 

In the text I circled the only actual disclaimer stating "This notice is not a bill, it is rather an easy means of payment should you decide to switch your domain name registration to Domain Registry.  

The real scam here is they were trying to charge $50/year for domain registration!  This should be lower, more like $10-20/year depending on whether you have a dot-com or dot-org or something else.  

For anyone wondering if their Twitter feeds are doctored...

Public Service Announcement:
Beware of the latest Craigslist scam, where they attempt to gain access to your Google account by tricking you into sending them the two-factor authentication codes!

While the GDPR laws are written for EU countries, many of my enterprise-level clients have been asking me to add scripts and plugins related to addressing these basic rights:

1. The right to access.
2. The right to be forgotten.
3. The right to data portability.
4. The right to be informed.
5. The right to have information corrected.
6. The right to restrict processing.
7. The right to object.
8. The right to be notified.

(original article)

Ecommerce site’s “blind trust” makes the service a perfect place to dump data.

Hackers are abusing Google Analytics so that they can more covertly siphon stolen credit card data out of infected ecommerce sites, researchers reported on Monday.

Payment card skimming used to refer solely to the practice of infecting point-of-sale machines in brick-and-mortar stores. The malware would extract credit card numbers and other data. Attackers would then use or sell the stolen information so it could be used in payment card fraud.

ZOOM, THE video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings.

With millions of people around the world working from home in order to slow the spread of the coronavirus, business is booming for Zoom, bringing more attention on the company and its privacy practices, including a policy, later updated, that seemed to give the company permission to mine messages and files shared during meetings for the purpose of ad targeting.

We are urging all clients to enable "2FA" (2 factor authentication) for any web-related dashboards:

• Domain registration (e.g. GoDaddy supports it, Network Solutions not yet)
• Hosting control panel (e.g. InMotion, SiteGround)
• CMS control panel (e.g. Joomla, Wordpress, Drupal)
• Newsletter / Subscriber (e.g. Mailchimp supports it, Constant Contact not yet)
• Google (Analytics, Adwords, Adsense, Webmaster Tools, etc.)

A few articles that I want to share:

• SEMrush SEO Writing Assistant - Plugin for Google Docs - checks your content for SEO friendliness on the go
• GDPR, Data Protection, and You: It's not just for the EU and California!  How to create a "compliance plan" when it comes to storing sensitive information, obtaining consent, and managing that data.  
• It's Not About SSL Certificates: Clarifies a common misconception that adding an SSL certificate makes your site more secure.  Incorrect!  It makes the traffic to and from your site more secure, but doesn't help with software / server / plugin vulnerabilities.  
• Multi-Column Editing in Joomla: For any clients who want to be able to edit multi-column content using a clean, responsive, browser-based content editor

Apple and Google are both rolling out significant updates to their respective "Map" apps.  Here is a quick recap:

1. Google Maps will be moving the "Contribute" feature to a more prominent location, making it easier for users to post reviews and other information. Previously, this was hidden in a menu. This implies that Google Reviews that users post for your business will become a much more important factor in local / map / business searches.  (Source)
   
   
2. Apple is releasing a full redesign: Apple started out by incorporating Google Maps into its mobile platform. In 2012, they parted ways when Apple introduced its own Map app.  In case you weren't aware, Apple uses Yelp data for listings and reviews. This means that it's important to have a well-built Yelp business profile, so that anyone on an Apple device who uses the Apple Maps instead of Google Maps is able to find you!  (Source)

Question:
Our site has been up and running with out any problems since for years! Do I really need to patch my Wordpress (Joomla, Drupal) site?

Answer:
I agree! For over 10 years, many people have been getting away without patching their websites, they've been lucky!

Todays' article includes a screenshot of a typical Wordpress site. This person hired someone else to build their Wordpress site, and it was never patched. Their site was built in 2017 and hacked in 2018 & 2019...

Three scary aspects of having your business listing "Suspended" by Google, after personally going through the experience with my wife's house cleaning business:

1. Google will not notify you when your listing gets suspended,
2. Google will not tell you why it was suspended, and
3. Google won't coach you through getting it un-suspended.

You can sign in to your GMB account and submit an "appeal" to have it reviewed by someone at Google (presumably a human being), but that doesn't guarantee anything. If they review your listing and it is still in violation of Google's terms of service, you'll find yourself sitting around for days (weeks?) wondering if your business listing will ever come back online.  The reason that Google won't "coach" you through changing your listing to bring it into compliance is they don't want to directly educate people on how to game the system.

The new tool temporarily block URLs from showing in Google, it shows outdated content and content filtered by SafeSearch.

Google has launched a new removals tool within Google Search Console. This tool does three things (1) lets you temporarily hide URLs from showing in Google search, (2) show you which content is not in Google because it is “outdated content” and (3) shows you which of your URLs were filtered by Google’s SafeSearch adult filter.

Scam Alert!  I just received this earlier this morning from a company who tried to trick me into renewing my domain registration with them and paying extra for search engine registration - two separate items that aren't typically combined:

Subject: Domain Notification for (redacted).com : This is your Final Notice of Domain Listing
Date: Wed, 18 Dec 2019 07:43:56 -0800
From: (redacted).com Support <This email address is being protected from spambots. You need JavaScript enabled to view it.>
To: (redacted)

A few clients have asked about whether they should use the backup system provided by their hosting company to backup their websites.

Specifically they were asking about InMotion Hosting’s new Backup Manager that is rolling out across their servers.  

I'm torn on this. Part of me is saying that you can't have too many backups.

System Preferences -> Software Update -> Advanced -> Uncheck -> "Automatically: Check for Updates"