Thursday, October 04, 2007

ID Theft - asking for trouble?

A few weeks ago at work I placed an order for a bit of equipment for a customer. We don't order very often from this supplier and in fact, this was just the second time. First time round we had to fax a copy of the cheque and present the courier with the cheque (cash on delivery). Fair enough.

Given we wouldn't be buying from them frequently, getting a credit account in place didn't seem worth the effort, so we were quite happy to pay by credit card - nothing unusual there.

They faxed through a form for the credit card details which we had to fax back, so sensible security not asking for the form to be e-mailed back. However, they also wanted a photocopy of my credit card - front and back. To me, this seemed a bit "off", given we're all trying to be so security concious about our personal data and here's a company wanting an exact image of my card.

Now this isn't some little two-bit independent del-boy type trading company, but rather a pan-European company with some 15 years of trading behind it.

Still, I really couldn't fathom why they needed this photocopy and they couldn't really give me a solid explanation. Nor could they convince me that my photocopy would be kept safe. Best they could come up with was "it'll be kept on our server for future use". They also compared it to the fact we faxed a cheque through to them without any problems. My comment that I was sending the physical cheque to them anyway (as that's pretty much how cheques work) and I certainly wouldn't be posting them my credit card didn't sway them from the company line in the slightest.

I could picture a future conversation with the bank though, having perhaps reported some fraudulent transactions on my account. "Do you take all possible precautions to keep your credit card safe? Sure I do, except for all the suppliers I fax a photocopy to, over which I've then got no control".

Needless to say, we cancelled the order and went elsewhere.

This is definitely something to consider though. Any time someone's asking for information that just doesn't seem normal, the alarm bells should start ringing. Even if it's a big company, you've got no idea how good or bad their security is or who that person at the end of the phone really is.

Offline Files Redux

I figured I'd do a revisit to Offline Files (or Client Side Caching), primarily just to clarify what the problems are and the scenarios in which they occur.

Consider the following:

You take your laptop and travel to another branch/division of your organisation. You plug in and immediately your laptop is able to see your server back in your own office over the VPN. So, it pretty much says to itself "OK, operating online, My Documents is located on the server".

It's supposed to do bandwidth analysis and decide that the link is sufficiently slow that it should go offline, but it seldom does. The configuration of what constitutes a slow link is configured in the registry (i.e. bit of brain surgery required) and isn't particularly well documented. I've certainly never been able to get anything sensible to happen from making any changes.

So, the "experience" you get in this scenario is everything you open from your My Documents takes eons to appear, because it gets dragged from the remote server. Worse, any time you save, the save goes back to the remote server (so forget working on that big 50Mb Power Point file). Even worse, applications like Word which autosave, will autosave the work file into the same folder where the document resides - yup, the remote server. That's the start-stop stutter you get right in the middle of your typing.

OK, so you get smart and acquire the Client Side Cache utility (csccmd.exe) and run csccmd /disconnect to force yourself offline. Suddenly My Documents becomes much more sprightly as the files are now being read/written from the copies (client side cache) on your laptop. Life is wonderful again! Open that 50Mb Power Point, add a few words and the save goes back to the laptop.

Now, you realise you need to go grab another picture from your server to add to the presentation. No problem. A quick jump into Network Places, Explorer, mapped drive etc and you can quickly drag it across the VPN? Nope, fraid not. Remember that "csccmd /disconnect" you got smart with above. Well, now the laptop throws a bit of a hissy fit and says "You forced me offline against my wishes and better judgement, so if your My Documents is offline, then so is the whole damned server, so stick that in your pipe and smoke it!".

Well, you're a kick-ass sort of person, so you have "mobsync /synchronise" or "mobsync /logon" up your sleeve to force your laptop back online so you can grab that pesky file. Unfortunately, the laptop still prevails. The conversation sort of goes "OK, you can force me back online if you like, but I'll only allow you to get connected once I've completed a full synchronisation process".

So the laptop proceeds to start checking through all the files to see which ones need to be pushed to the other end. Remember that 50Mb Power Point file - yup, it's got to go the distance to the remote server.

Now that might just about be bearable on a reasonable speed VPN. But imagine you are in a hotel and the VPN is just a touch flaky with all the people in the hotel doing their stuff. Or worse, you've got no broadband or wifi connection, so you've had to resort to the mobile phone over GPRS or GSM, maybe as low as a 9.6k connection". At that stage, you pretty much have to give up and accept the laptop gave you a kicking.

All in, Offline Files is a very frustrating process and that's when you know how it works and what you are doing. Your average business computer user just wants the damned thing to work with the least amount of techno mumbo-jumbo as possible.

That's why Adaptive Backup came to existence.