E*TRADE Security Failure

Opening an E*TRADE account was a Security Disaster

The E*TRADE (part of Morgan Stanley) new account intake process was straightforward if a bit tedious, demanding not only personal information, including phone numbers, but also the uploading of a picture holding a government ID through DocuSign.

An intake process like this should normally complete within 24-48 hours, but it was 5 days before receiving a confirmation email that the account was open and accessible with the Account ID and Password. In the meantime, the webpage and chat always showed red alerts that they were having "technical issues" and to "try again later" (which was anything but reassuring).

But logging in did not bring satisfaction. After being asked for more information that should have been captured at account creation, an attempt to enable 2FA (two-factor authentication) for improved security resulted in a demand for a phone number, despite the fact it had been provided during account creation. Adding insult to injury, the system then rejected that phone number, locking the account, preventing access to any money.

Authentication and Security 

E*TRADE (Morgan Stanley) was apparently adding mobile carrier verification despite having previously accepted both phone numbers and government ID. In addition to being a classic chicken-and-egg problem, mobile carrier verification is not a good way to verify security, because it is so easily hacked or spoofed. In effect they were downgrading password security by asking for a phone number after password login. Bad actors that have the password are already in.

What should have happened during new account intake, in addition to capturing all necessary information, is setting up secure 2FA using a TOTP authenticator app (by Google, Microsoft or others), completely solving authentication. Instead, this kind of 'security' nonsense is comparable to the security lapses in so-called Wired Equivalent Privacy, which turned out to be hackable in minutes.

Three Strikes

1. Technical Problems. Persisting over several days. 
2. Account Lockout. Arbitrary denial of access to any money. 
3. Security Lapses. Redundant use of insecure mobile carrier verification.

You should never entrust money to an online system with such serious issues. 

Why Use Apple/Google Pay

Security and Privacy in addition to Convenience

Most people adopt Apple Pay or Google Pay mobile payment because tapping a phone or smartwatch at checkout is faster and easier than fumbling through a wallet for a payment (credit or debit) card. While that convenience is great, it’s actually not the most important benefit. The best reason to use mobile payments: you don't give your payment card number to the merchant, which keeps you safe from:

1. Card skimmers: Fraudulent readers secretly installed on gas pumps, ATMs, or store terminals to steal and exploit your card info. 
2. Merchant database breaches: Hacks on store servers that expose millions of stored card numbers, expiration dates, and security codes.
3. Unauthorized charges: With saved card info, unscrupulous merchants can charge you for unauthorized goods or services, particularly subscriptions you've forgotten. 
4. Insider theft: Dishonest staff photographing or writing down your card details when taking your card behind a counter. 
5. Cross-merchant tracking: Data brokers using your card number to track your shopping habits across different businesses. 

Mobile Apps: Apple Wallet / Google Wallet. 

How it Works

• Your card number stays local: Your actual 16-digit card number is stored in an encrypted, isolated hardware chip on your device. It is never transmitted to the merchant or stored on cloud servers.
• Merchants get a temporary number: For every transaction, the wallet generates a unique, one-time security code along with a merchant-specific token (Device Account Number). If a merchant’s database gets hacked, the stolen token is completely useless to thieves.
• Real-time charge tracking: You get an immediate push notification the second a transaction occurs, making it simple to spot unauthorized activity instantly rather than waiting for a monthly statement.
• No runaway subscriptions: Because payments rely on controlled tokenized connections, cutting off a merchant or stopping unwanted recurring charges is far easier, and doesn't require canceling your physical credit card and updating every other account.
• Full dispute mechanisms intact: You don't lose consumer protections. Your bank's zero-liability policy, dispute processes, and charge-back rights remain fully active on every transaction.

Smart‑TV 'Privacy'

Smart TV Data Harvesting

“You have zero privacy anyway." —Scott McNealy

There is no privacy on a "smart" TV. The modern television business model isn't about just selling you hardware, it's also based on telemetry, harvesting and selling your personal viewing habits and data. Whenever and whatever you watch, that info is being 'phoned home' to data brokers.

The Solution 

The only real mitigation is to never give the TV access to the Internet. Skip the Wi-Fi setup, leave the Ethernet port empty; instead, use an external streaming box that you control. 

If you want to stream content from a smartphone, tablet or computer, use Wi-Fi Direct instead of a local network:

• Apple: Use Peer-to-Peer AirPlay. Ensure both Wi-Fi and Bluetooth are enabled on your iOS device or Mac, and you can mirror your screen directly to compatible TVs without a router. 
• Android: Use the built-in Cast or Screen Mirroring feature (sometimes labeled Smart View). This utilizes Wi-Fi Direct (Miracast) for direct wireless connection to the TV.
• Windows: Press Win + K to open the Cast menu. This uses Miracast to project your screen direct to the TV without needing a local Wi-Fi network.

Surfshark VPN No Longer Recommended

No to Surfshark VPN

The Problem 

Surfshark was formerly a recommended VPN service, but no longer:

1. Payment Card Abuse. A payment card is a required part of an account, making you vulnerable to unauthorized charges. 
2. Aggressive Upselling. Not content to just provide good service, Surfshark aggressively pushes services you do not need or want, going so far as to create subscriptions with automatic renewals that you never ordered.  
3. Blocked IPs. Abuse by customers of a limited IP pool means that Surfshark connections are increasingly blocked by network providers.  

The Solution

It's surprisingly hard to find a good, low-cost VPN, with ample IP pools, high performance, and solid privacy policies. It's not perfect, but my current top pick is Private Internet Access (PIA).

• No logs
• Open Source 
• Reliable access 
• 10 Gbps servers optimized for speed
• Unlimited devices on one plan from $2.03/mo 
• Every setting can be customized 

See Also

• Navas' Tips: Secure Wi-Fi With VPN
• Navas' Tips: Best Consumer VPN 2025-2026 

Starbucks Tipping Goes Rogue

New Starbucks Tipping

The Problem

Tipping is supposed to be a reward for good service, but Starbucks does not actually provide table service, just counter service, and the brewing of coffee is now fully automated (and mediocre). So the 'barista' (using the term loosely) now just takes your order and pushes a brew button. Is that service worthy of a tip?

If you pay with the app on a smartphone, you already have a tipping option (and notification) should you choose to tip, but now Starbucks hits you again on the new Verifone tipping terminal.

Worse, if you walk away without touching the terminal, it stays wide open to abuse, like a barista reaching over to apply a tip without your consent (which has actually happened, perhaps inadvertently, but still fraudulent).

And the most outrageous thing of all is that the fixed tip amounts—not percentages like at more responsible restaurants—are egregiously high for a lower-cost item like a brewed coffee (as in the picture):

• 30% at $1 tip
• 60% at $2 tip
• 149% at $5 tip

The Solution

Until Starbucks changes course, putting customers back ahead of greed, the solution is to mobile order ahead, thereby avoiding the tipping terminal entirely. You can even select personal cup for the discount and extra stars!