E*TRADE Security Failure

Opening an E*TRADE account was a Security Disaster

The E*TRADE (part of Morgan Stanley) new account intake process was straightforward if a bit tedious, demanding not only personal information, including phone numbers, but also the uploading of a picture holding a government ID through DocuSign.

An intake process like this should normally complete within 24-48 hours, but it was 5 days before receiving a confirmation email that the account was open and accessible with the Account ID and Password. In the meantime, the webpage and chat always showed red alerts that they were having "technical issues" and to "try again later" (which was anything but reassuring).

But logging in did not bring satisfaction. After being asked for more information that should have been captured at account creation, an attempt to enable 2FA (two-factor authentication) for improved security resulted in a demand for a phone number, despite the fact it had been provided during account creation. Adding insult to injury, the system then rejected that phone number, locking the account, preventing access to any money.

Authentication and Security 

E*TRADE (Morgan Stanley) was apparently adding mobile carrier verification despite having previously accepted both phone numbers and government ID. In addition to being a classic chicken-and-egg problem, mobile carrier verification is not a good way to verify security, because it is so easily hacked or spoofed. In effect they were downgrading password security by asking for a phone number after password login. Bad actors that have the password are already in.

What should have happened during new account intake, in addition to capturing all necessary information, is setting up secure 2FA using a TOTP authenticator app (by Google, Microsoft or others), completely solving authentication. Instead, this kind of 'security' nonsense is comparable to the security lapses in so-called Wired Equivalent Privacy, which turned out to be hackable in minutes.

Three Strikes

1. Technical Problems. Persisting over several days. 
2. Account Lockout. Arbitrary denial of access to any money. 
3. Security Lapses. Redundant use of insecure mobile carrier verification.

You should never entrust money to an online system with such serious issues. 

Why Use Apple/Google Pay

Security and Privacy in addition to Convenience

Most people adopt Apple Pay or Google Pay mobile payment because tapping a phone or smartwatch at checkout is faster and easier than fumbling through a wallet for a payment (credit or debit) card. While that convenience is great, it’s actually not the most important benefit. The best reason to use mobile payments: you don't give your payment card number to the merchant, which keeps you safe from:

1. Card skimmers: Fraudulent readers secretly installed on gas pumps, ATMs, or store terminals to steal and exploit your card info. 
2. Merchant database breaches: Hacks on store servers that expose millions of stored card numbers, expiration dates, and security codes.
3. Unauthorized charges: With saved card info, unscrupulous merchants can charge you for unauthorized goods or services, particularly subscriptions you've forgotten. 
4. Insider theft: Dishonest staff photographing or writing down your card details when taking your card behind a counter. 
5. Cross-merchant tracking: Data brokers using your card number to track your shopping habits across different businesses. 

Mobile Apps: Apple Wallet / Google Wallet. 

How it Works

• Your card number stays local: Your actual 16-digit card number is stored in an encrypted, isolated hardware chip on your device. It is never transmitted to the merchant or stored on cloud servers.
• Merchants get a temporary number: For every transaction, the wallet generates a unique, one-time security code along with a merchant-specific token (Device Account Number). If a merchant’s database gets hacked, the stolen token is completely useless to thieves.
• Real-time charge tracking: You get an immediate push notification the second a transaction occurs, making it simple to spot unauthorized activity instantly rather than waiting for a monthly statement.
• No runaway subscriptions: Because payments rely on controlled tokenized connections, cutting off a merchant or stopping unwanted recurring charges is far easier, and doesn't require canceling your physical credit card and updating every other account.
• Full dispute mechanisms intact: You don't lose consumer protections. Your bank's zero-liability policy, dispute processes, and charge-back rights remain fully active on every transaction.

Smart‑TV 'Privacy'

Smart TV Data Harvesting

“You have zero privacy anyway." —Scott McNealy

There is no privacy on a "smart" TV. The modern television business model isn't about just selling you hardware, it's also based on telemetry, harvesting and selling your personal viewing habits and data. Whenever and whatever you watch, that info is being 'phoned home' to data brokers.

The Solution 

The only real mitigation is to never give the TV access to the Internet. Skip the Wi-Fi setup, leave the Ethernet port empty; instead, use an external streaming box that you control. 

If you want to stream content from a smartphone, tablet or computer, use Wi-Fi Direct instead of a local network:

• Apple: Use Peer-to-Peer AirPlay. Ensure both Wi-Fi and Bluetooth are enabled on your iOS device or Mac, and you can mirror your screen directly to compatible TVs without a router. 
• Android: Use the built-in Cast or Screen Mirroring feature (sometimes labeled Smart View). This utilizes Wi-Fi Direct (Miracast) for direct wireless connection to the TV.
• Windows: Press Win + K to open the Cast menu. This uses Miracast to project your screen direct to the TV without needing a local Wi-Fi network.

Surfshark VPN No Longer Recommended

No to Surfshark VPN

The Problem 

Surfshark was formerly a recommended VPN service, but no longer:

1. Payment Card Abuse. A payment card is a required part of an account, making you vulnerable to unauthorized charges. 
2. Aggressive Upselling. Not content to just provide good service, Surfshark aggressively pushes services you do not need or want, going so far as to create subscriptions with automatic renewals that you never ordered.  
3. Blocked IPs. Abuse by customers of a limited IP pool means that Surfshark connections are increasingly blocked by network providers.  

The Solution

It's surprisingly hard to find a good, low-cost VPN, with ample IP pools, high performance, and solid privacy policies. It's not perfect, but my current top pick is Private Internet Access (PIA).

• No logs
• Open Source 
• Reliable access 
• 10 Gbps servers optimized for speed
• Unlimited devices on one plan from $2.03/mo 
• Every setting can be customized 

See Also

• Navas' Tips: Secure Wi-Fi With VPN
• Navas' Tips: Best Consumer VPN 2025-2026 

Starbucks Tipping Goes Rogue

New Starbucks Tipping

The Problem

Tipping is supposed to be a reward for good service, but Starbucks does not actually provide table service, just counter service, and the brewing of coffee is now fully automated (and mediocre). So the 'barista' (using the term loosely) now just takes your order and pushes a brew button. Is that service worthy of a tip?

If you pay with the app on a smartphone, you already have a tipping option (and notification) should you choose to tip, but now Starbucks hits you again on the new Verifone tipping terminal.

Worse, if you walk away without touching the terminal, it stays wide open to abuse, like a barista reaching over to apply a tip without your consent (which has actually happened, perhaps inadvertently, but still fraudulent).

And the most outrageous thing of all is that the fixed tip amounts—not percentages like at more responsible restaurants—are egregiously high for a lower-cost item like a brewed coffee (as in the picture):

• 30% at $1 tip
• 60% at $2 tip
• 149% at $5 tip

The Solution

Until Starbucks changes course, putting customers back ahead of greed, the solution is to mobile order ahead, thereby avoiding the tipping terminal entirely. You can even select personal cup for the discount and extra stars!

Dump the Un-Carrier!

The Bad News: All 3 major carriers now suck!

Under President John Legere, T-Mobile USA was the customer-focused "un-carrier" that offered great pricing, service and performance. That all changed when he left, and now T-Mobile is just another big evil carrier. 

It was bad enough when T-Mobile first broke Legere's promise to 'never raise your price' but now it has gone full evil by forcing subscribers from great legacy plans to new more expensive plans, along with unbundling taxes and fees for new customers. Worse, it slip-streamed it into the Terms of Service, leaving unhappy customers with little recourse. It's now entirely money-focused.

The Good News 

You can switch to a much better carrier and save a great deal of money without losing great network performance, with much better customer service in the bargain. That escape path leads to US Mobile, an MVNO (Mobile Virtual Network Operator) with access to all three major carrier networks. (It's even possible to switch networks as desired!)

The best part is that you may be able to at least take advantage of the 'Un-Carrier Guarantee' to get your last month of service free when leaving T-Mobile after a price increase. You may have to fight for it, because not all T-Mobile service reps even know it exists, and resist pressure to get you to stay, but you can get it if you persist and act promptly.

One of the best deals that's frequently offered by US Mobile is a full year of Unlimited Starter for only $199 (just $17 per month) all in (no added taxes and fees): Unlimited Talk & Text, 70 GB of High-Speed Data and 10 GB of Hotspot Data on the T-Mobile network, and more. Plus it often has great deals on devices!

Do it, now, and if you use my referral code, you will get a $25 credit! (I get one too.) 

Subscription Creep

Stop Subscription Creep

How to stop subscription charges for good

Vendors love subscriptions because people forget to cancel them (so charges keep going). They can even make it hard to cancel. Part of the problem is that it can be a big hassle to regularly audit all your payment card statements to find the ones you no longer need or want. Another part of the problem is that it can be hard to jump through the necessary hoops to cancel. Fortunately, there is a simple, effective solution.

A related problem is that vendors can record and keep your card numbers for future transactions that you may not actually authorize. 

The "Nuclear" Option 

The simplest, most reliable solution is to force‑expire every payment card once a year. Ask your card issuers to replace your cards with new numbers but without Card Updater Service.*

When that happens, every subscription dies automatically and all saved card numbers are invalidated. You then just need to give your new card numbers to those subscriptions and vendors you want to keep.

The PayPal Option 

A big advantage of PayPal over a payment card is that vendors cannot keep a card on file and make charges without authorization.

• Individual payments must always be expressly authorized by you.
• Recurring (or subscription) payments must be expressly authorized in advance by you, and can be easily managed (e.g., canceled) in your PayPal account.

No need for spreadsheets, audits, “subscription manager” apps.

* Card Updater Service means that your issuers will cheerfully switch your zombie subscriptions to your new card numbers, defeating the Nuclear Option.

ThinkPad Lock on Leave can work

Lock on Leave for the ThinkPad P14s Gen 4 is well hidden!

• Windows Presence Sensing is not supported.
• Instead, Lenovo provides its own Lock on Leave feature.
• Locking may not be reliable in some environments, like noisy cafes!
• Lenovo documentation is not correct! 
• Expanded How To in Lenovo Community.
• Likely applies to T14 Gen 4, P14s Gen 4, T16 Gen 2, P16s Gen 2.
• It may also apply to P14s Gen 5 and P16s Gen 3.

How to enable Lenovo Lock on Leave

1. In BIOS Settings → Security → Intelligent Security → enable User Presence Sensing.
2. In Commercial Vantage (from Microsoft Store) → Device Settings → Smart Assist → enable Zero touch lock.

Windows Settings 

1. Use Default settings in Windows Balanced Power Plan.
2. Set Screen Saver to (None) because it is redundant and possibly counterproductive.

What actually happens

• ~20 seconds of no presence → screen dims
• ~10 seconds later → screen blanks & locks
• No wake‑on‑return, but Windows Hello can activate and unlock on a keypress
• Invisible: no tray icon, no indicator, no tuning

How it works

• Uses speakers to emit ultrasonic pulses
• Uses microphones to read reflections
• Elliptic’s AI model decides “present” vs “absent”
• No dedicated hardware sensor, no FRU

Side effect
Some users can hear the ultrasonic chirps due to:

• speaker distortion
• harmonics
• individual high‑frequency sensitivity

If you hear it, you’re not imagining it.

Guest Network Isolation

Guest Network Isolation

Guest Network Segregation May Be Just Theater

• Guest Network matters.
• Never give your local network credentials (password) to guests. 
• Guest Network must be true isolation,
  not just a 2nd network name (SSID).
• Without isolation:
• The very real threat is credential sharing (which often happens casually).
• Guest network can give the world access to all your networked devices.
• That can facilitate identity theft, accidental or deliberate.
• ASUS gets this right:
• Guests cannot access your local networked devices.
• Guests cannot see each other.
• Guests cannot cross sub-networks.
• If your router does not enforce that, then it does not have a real guest network.

How To Safely Share a Wireless Printer

• Tell your guest to use AirPrint or Wi-Fi Direct.

How to Safely Share a Wireless TV

• Tell your guest to use AirPlay or Miracast. 

How To Test Guest Network Isolation

1. Power on all devices (computers, printers, phones, smart home) on your local network (wired and wireless).
2. Connect to your Guest Network with an Apple or Android smartphone.
3. Install and Run Fing from the appropriate app store (Apple, Google, Microsoft).
4. If you see more than 1 device (your phone) in the Devices tab, the Guest Network is not isolated.

 

Powered Toothbrush Bargain

Li-ion Rechargeable AA Batteries

Li-ion rechargeable AA battery is the secret!

There are many different powered toothbrushes on the market, ranging from inexpensive battery powered to expensive rechargeable models.

In truth, there is no meaningful difference in cleaning action between the best inexpensive battery powered models with fresh batteries and the expensive rechargeable models. The principal difference is the power source.

Inexpensive battery powered toothbrushes typically use disposable AA or AAA batteries, an ongoing cost and waste issue. Worse, as the disposable battery discharges, the voltage drops and the toothbrush slows down.

Oral-B 3D Battery Toothbrush

The solution is to use the latest Li-ion technology in standard AA format, ideally with USB-C recharging!

• Constant battery voltage = constant brushing power 
• High battery power capacity
• Long battery life (1,000 recharges)
• Quick, convenient battery recharging 
• Li-ion tech is superior to older NiMH (and NiCd) tech

Recommended Products

1. Oral-B 3D White Battery Toothbrush 
2. CARDIENS AA USB rechargeable batteries 
3. Toothpaste Worth the Money 

Moral: Why spend $100-$200 instead of only $10-$20?!