Hag's Blog by John Haggard

Very Cool… Thank you Rep. Dave Upthegrove (really…. up the grove?)

From: Upthegrove, Rep. Dave [mailto:Dave.Upthegrove@leg.wa.gov]
Sent: Thursday, September 01, 2011 5:23 PM
To: 'john@haggardmail.net'
Subject: RE: Constituent: Washington Discover Pass

Dear John,

Thank you for your message expressing your concern about the inability to transfer the new Discover Pass between vehicles.  I agree that this is an added burden for people visiting our state parks and am hopeful that we can find a workable solution next session.  It was not the intent of the legislation to make people choose between the Prius and the RV (or the car vs. motorcycle, in your case) when they go to the park!

As you may know, the Discover Pass was adopted by the Legislature this year as an alternative to closing state parks and recreational lands in the face of a $5 Billion budget shortfall.  The pass program was developed through a series of meetings with park users, budget writers and state agencies. It is my understanding that the one-vehicle limit was part of their calculations.  If the program is changed to allow some sort of transfer between vehicles (perhaps modeled after the federal pass, as you mentioned), it will likely create a funding gap.  The Legislature is prevented by Tim Eyman’s Initiative 1053 (passed by the voters in 2010) from raising any general taxes to pay for this.  We would have to fill that gap by either closing some parks and recreational lands or creating additional fees to cover the costs. 

I know that the legislators who sponsored the Discover Pass are working this interim to find ways to make it more workable, including looking at the issue of transferability.  I anticipate that legislation will be put forth next session to make various adjustments to the program and I will give them my full consideration.

Again, thanks for taking the time to contact me.  I value the input I receive and hope you will continue to share your views with me.

Sincerely,

Dave Upthegrove

State Representative

33^rd District

Chairman, House Environment Committee

Webpage: http://www.housedemocrats.wa.gov/roster/rep-dave-upthegrove/

Sign up for my E-memo

Legislative Hotline: 1-800-562-6000

Call for Letter to Washington State Legislators for State Park Discover Pass

Below is an email to my legislators regarding being forced to purchase multiple passes to enjoy the park system depending on which vehicle you use. Law was rushed and it shows.

You can find your Washington State Legislators here: http://apps.leg.wa.gov/districtfinder/.

Below is my letter to them, please tell them yourself so enough noise is heard to get some changes. All they have to do is follow what the National Lands Pass has done – that has been used for many years and works beautifully. For example, I have a sticker that goes on my bike and if you have a convertible (i.e. Jeep) you get stickers for that too so your hanging pass doesn’t get ripped off.

Please let them know…..

Below is the message:

The following message was sent to Senator Karen Keiser (D), Representative Tina Orwall (D) and Representative Dave Upthegrove (D) of the 33rd district.

---

TO:
Senator Karen Keiser

CC:
Representative Tina Orwall
Representative Dave Upthegrove

FROM:
Mr. John Haggard

SUBJECT:
Washington Discover Pass

MESSAGE:

Dear Legislators,

Problem: Annual Discover Pass fees attached to cars not people.

Solution: Please follow the lead of the Annual Pass for The National Parks and Federal Recreation Lands Pass. These issues have been thought out and resolved.
I have both a automobile and a motorcycle and I enjoy going to Kanaskat-Palmer State Park to enjoy the hikes and the Green River. Sometimes I use my Suburban and sometimes my motorcycle. I do not believe the intent of the Discover Pass is to force me to purchase two passes. The law as written does however.

Please reconsider how this first year program has been implemented and make changes. I'm all for supporting State Parks as I do National Forests/Parks.

Sincerely,
John Haggard
19411 8th Ave S
Des Moines, WA 98148
john@haggardmail.net
206-429-2808

RESPONSE:
Mr. Haggard has requested a response to this message.

How To Pull a Rabbit Out of Chase’s Hole…

Almost a month ago I entered into the Chase Bank fraud rabbit hole – a world tour of patched together customer service departments that strained my international ear and had me begging for the return of Muzak.

Today I now stand with a new credit card with a matching credit limit of my old card, but with out the balance. Yes, I still have the balance on the old card to pay, but now I have a new card, a new credit limit, and if I wanted, a new spending spree.

To put this into perspective, I get a very well crafted fraudulent email, I don’t bite, but I do check my account online, enter the rabbit hole, and come out with new account with double the credit amount on paper. To be sure only the newly opened account is open, but the account is a fresh account that mirrors the old. WTF? I just wanted my online account reset. What happened to a new password and a new card?

I have no idea yet if I have access to these accounts online (my original objective) because I’m exhausted. I have no stomach for entering the rabbit hole any time soon – even if I have the damned rabbit.

Email Fraud and the Chase Bank Rabbit Hole…

Below is a fraudulent email sent to me in an attempt to obtain my account user id and static password. What makes this email scam particularly attractive is I rarely use my Chase account and when I go to the legitimate site, it seems to echo what is being said below – that my account has problems, and it did!

From: Chase Bank [mailto:online@onlinebanking.chase.com]
Sent: Monday, June 20, 2011 9:16 AM
To: undisclosed-recipients:
Subject: Important Alert!

Chase Bank Online® Department Notice
You have received this email because you or someone had used your account from different locations.
For security purpose, we are required to open an investigation into this matter.
In order to safeguard your account, we require that you confirm your banking details.
To help speed up this process, please access the following link so we can complete the verification of
your Chase Online® Banking Account registration information :
To get started, please click the link below:

https://www.chase.com
Please Note:
If we do no receive the appropriate account verification within 48 hours, then we will assume this Chase Bank account is fraudulent and will be suspended. The purpose of this verification is to ensure that your bank account has not been fraudulently used and to combat the fraud from our community.
Regards,
Chase Bank - Chase Online® Banking Department

Securities (including mutual funds and variable life insurance), annuities and insurance products are not bank deposits and are not insured by the FDIC or any other agency of the United States, nor are they obligations of, nor insured or guaranteed by, JPMorgan Chase Bank, N.A., CISC, CIA, CMIA or their affiliates. Securities (including mutual funds and variable life insurance) and annuities involve investment risks, including the possible loss of value.

Here you see the bogus web site: http://c-spin.net/cgi-sys/suspendedpage.cgi. They were taken down, so no threat.

What sucks is the real URL did this to me when I tried to double check to make sure all was fine:

Note that I get an IE warning about the Chase web site. These types of warnings are danger signals that make me not trust using Chase at all. It creates fear. It is poor web design to use fancy designs that call into question the security of your site.

So, at 10:50 AM on Monday June 20th, I pick up the phone - here is what happened:

10:50, I call the reactivation process (877-242-7372). I followed the automated instructions (hit 2), entered my account number printed on my card statement.

10:52,  #1 person tells me my account is closed. I explain I am staring at my statement which clearly shows no problems. Agent says she handles debit cards and I need to go to the credit card department, long wait transfer

10:58, #2 Tracy came on and said my account was closed.  I explained I don’t use my physical card anyway, but have open account and simply want online access to the account information to manage it. That got me transferred to the Internet desk in India. I have to repeat my personal information for the third time. I get placed on hold with horrible quality loud distorted music. The image of Chase is reaching new lows as I’m listening.

BTW, this log is being generated real time while I’m waiting…… 11:15. I begin to take names and departments as know I’m in the rabbit hole.

11:16, #3 Sushma informed me that I need a new credit card number. I don’t want a new credit card; I simply want online access to my account to monitor an open Chase account. Back on hold…

11:19, Sushma is going transfer me to ISC. I have an online fraud alert on my account it seems (this supports what the fraud email has told me)

11:21, again transfer to hold and loud distorted music. I’m amazed that the 2nd largest US bank has such a poor quality phone system?

11:25, #4 Nancy answers from “Telephone Banking” with poor headset is attempting to pick up this issue. I have no idea how or why Nancy’s department got into this mix. Best she can see is my online access can’t be established because I don’t have an active card. I have an active account, but not a card. It seems a fraud issue was being checked into when the account was flagged. Nancy attempts to adjust headset, but little success. Every sentence has to be repeated.

11:29, put on hold to determine where to transfer and again, loud distorted music.

11:31, Nancy says she is transferring me to “Electronic Money Movement “ – I’m like “Uh?”

11:39, #5 Calandre in “Operations Preventions Department” cannot find the account number and says it is closed and case closed. Calandre said to go into a branch and figure it out. Remember, what started this off is an email and what I want is to NOT go into a bank. She doesn’t see any fraud, gives me 800-945-2006, a tough love lecture, and transfers me.

11:47, Automated system and I enter card number, zip code and it coughs up all my balance details. A bit strange to have all my balance details accessible with only an account number and zip code?

11:49 #6 Tiffany in credit card department answers. Finally a quality phone connection, coupled with an aware person. Tiffany has instant credibility. My card ending in 3832 is indeed marked closed. Tiffany used to work in the security department so she understands to read the account notes to see what is happening – notes indicate 04/10 fraud report which was valid, January 2011 address change request which was valid, then I called in to get something changed and they needed to call me back. I recall this happening and I recall calling Chase back 3 times because they never returned my call to verify me. The account was then closed without any thing being sent. Bill however continued and my payments continued. We both have a clearer picture of what happened.

11:58, Tiffany puts me on hold so she can contact security folks to get this straightened out – I feel comfortable knowing she is working toward a resolution. Chase image rising with Tiffany.

12:15, Tiffany spoke to supervisor and needed to do some research and apologized for long hold. Tiffany is a professional.

12:16, Trish didn’t answer. Tiffany was frustrated and said “never mind, let me explain what the status is.” She explained that since the account was not able to be verified in January, it was closed. Because it has been so long the account has been marked as permanently closed and cannot be reopened. I have to reapply, the balance is forever linked to a closed account and can never be viewable via an online account. Paper is the only option. This account is setup to be paid automatically from my USBank account.

12:26, Call ended 1 hour and 36 minutes.

Whew…. There has to be a better way.

Insyndia, My New Home

 

 

Today I am pleased to announce that I have merged my consulting practice into Insyndia Corporation. Insyndia is led by two likeminded professionals, Lance Gaines and Kevin Casey, who I have the privilege to call business partners.

I met Lance in December of 2006 in the most unlikely manner; I was helping a new firm launch biometric secured USB devices and Lance, as CTO of his company, had purchased some USB products for a very strange purpose – to hold random numbers generated by another company I was helping ID Quantique. I was floored that in my back yard someone not only understood the security implications of using the properties of single photons for random numbers (Quantum Random Number Generators), but they were already basing new products on these properties. Lance was not only using my favorite two company’s products, he was doing it at the same time (something I hadn’t thought to do). I think I made it to Tacoma to visit Lance in record time.

What I found in Lance was an incredibly talented and approachable technologist who was both a dreamer and a realist. He had a firm grasp on the science, the applications, the market potential, and importantly the restrictions all at once. He gained my trust immediately and over the years that trust has grown.

I met Kevin a while later when he was brought in to launch Lance’s team’s resulting product. Kevin had the unmistakable military “can do” spirit and he immediately reminded me of another treasured partner of mine Rick Vaden (now with IBM). Rick and I saw many business battles; some we won and some we survived, barely. I recall taking note of Kevin and wondering if he was as good as Rick, he had the potential clearly, but that is a high bar to cross. I also recall leaving convinced that Kevin had an uncanny ability to know precisely what the next indicated thing to do was (everyone else was considering while Kevin was doing). He did this with enthusiastic humility which made a believer out of me; I knew Kevin was a man to be counted on.

I followed Lance and Kevin as they followed the dream at their former company, I watched them deal with business ethics as they were confronted with tests not of their making; and I witnessed bi-directional loyalty between them and a their team. The whole team has been tested, not just Lance and Kevin.

Lance and Kevin did the right thing and created Insyndia with trusted associates from past business ventures. Initially seen as a vehicle to survive, Insyndia, as an organization, quickly learned they had a viable growing business that was interesting in of itself. By providing large scale integration services in places that no others could or would go has proven to be of enormous benefit. Not only are these projects tough and profitable, they enabled Insyndia to enter into even more interesting business models. They spent last year growing the infrastructure of talent, equipment, customers, and experience that can now be leveraged.

Insyndia is not a simple systems integration company; Insyndia’s team has the imagination to ignite and inspire not only IT customers, but also IT vendors. The tag line is not a marketing throwaway line, it is meaningful; just ask a few clients who have experienced the ignition phase.

Earlier this year several conditions arose that made this union possible: a) I sat down to help Lance and Kevin to discuss launching one of their product ideas b) Kevin reached out to help me with one of my other clients, c) I found myself with yet another exciting new product launch, d) Insyndia received the SDVOSB badge (Service Disabled Veteran Owned Small Business) giving them, and their partners, access to large set aside pools of $$ and e) it became crystal clear that we not only could leverage our collective imaginations and assets, but we needed each other. The three of us bring unique non-overlapping skill and experience sets to the table - and we trust; the most important ingredient.

It should be noted that Ken McLarin is also a Managing Partner who is explicitly trusted by myself through his long history with Lance. I’ve met with Ken and he clearly brings to the team the ability to mobilize staffing for large Microsoft systems implementations. Ken gives us our expanding/contracting technical staff that enables us to engage customers quickly and efficiently. Not only can we engage Microsoft projects, but we can also staff up implementations of our partners’ products over time as well. Ken’s unit, Descry, makes sure we have the talent and the infrastructure to support their needs. Read the press release announcing Descry last week here.

I join the Insyndia team as Managing Partner and SVP of Strategy. My role is to further assist existing business units grow and mature, but more importantly to establish Insyndia as a global launch platform for new and emerging vendors who have exciting products to offer the world. In some cases, new products are being developed under Insyndia’s guidance and capital. In other cases, new products have already been developed by outside vendors and need to be launched in specific markets.

Within a few days we’ll be announcing the launch of an exciting new player into the world of strong authentication. The product is a game changer for One Time Password devices and our job is to tell the world. Insyndia will be compensated for launch coordination, but has a front row financial position to share in the success of the sales. We have numerous such ignitions ahead of us; it should be an inspiring year.

Google One Time Password Setup - Holy Crap!

So you want to secure your Google Account? I know a bit about deploying 2 factor authentication (former COO/CTO of VASCO Data Security).

For a techie, I get goose bumps watching this the QR work. As a sales person trying to explain how it works, I get nervous twitches. As a support person I go “OMG.” And finally as a OTP specialist, I am absolutely horrified by my demo below – it shows the main weakness in the system – the QR code is reusable when knuckleheads like me attempt so show how this works.

Lets walk through the Google use case ….

First, figure out if you are ready to enter….

 

Select your device of choice and my iPhone is the perfect body appendage to select….

 

 

Now the cool part, click “next” and very cool QR code comes up to

 

Pull out your Iphone app (first download the Google Authenticator app from the iTunes App store – free) and fire it up….

1)      2)     3)

Now the really bad part…. The QR code above can be scanned by you (like right now) and you too can have my OTP for my account. If anybody in the middle captures the cool QR code image  and posts it up on the net (like I did), then that sucker will populate any iPhone with my identity.

I have invalidated the above QR code, but not after gasping in horror as my phone scanned the picture above and installed a duplicate OTP displaying the exact same rolling OTP as my first scan produced – it was an “oh God” moment.

Now below you verify the OTP so the loop is closed…

And now comes the creepy backdoor stuff that is why we use OTP’s to begin with – sticky notes with passwords stuck to the computer….

 

 

Yep. here are your 10 passwords you can stick to your computer for when your iPhone is forgotten and you are locked out….

 

 

This is better, but assuming my iPhone is lost, sending a SMS isn’t going to help much, so probably should go with voice messages. If this fails, Google offers a account recovery menu from hell (which is what it should be so people only take this trip a few times).

 

 

They check it out to make sure it works…..

 

And it did….

 

Now for my very complicated static password for all those apps that are not interactive (like Outlook, or email on phones, etc). All Google does here is scare you a bit. Actual static password several pages down….

 

Now it is time to turn this sucker on….

 

 

I’m live (I hope)….

 

Here we go for the first test drive…. user id and my normal password are still required…..

 

And here we are! I’m prompted for 2 factor authentication code which is a time based One Time Based password which I’m assuming is OATH compliant.

 

 

 

I go to my iPhone and fire up Google Authenticator app and there is my OTP along with the account it goes with (not real good to tell someone who picks up my phone which account to use the OTP with)…

 

Enter it in (you have to be fast because this sucker is on a tight 30 second window)…

 

I’m now all set up and ready to roll except I have to take care of those pesky apps that have no dialog capability. I need a static complicated password in addition to my old remembered static password. Click the “Create Passwords” to get started….

Now I get a confusing list of information. First, I see all the places that I’ve allowed my Google id to be used from – if I want I can revoke them here. Thanks. But the real deal is “Application-specific” passwords.

This should be “lets create a list of static passwords that you can give a label to and we’ll accept any of those complicated static passwords instead of your “userid/your old remembered static password/OTP.” Get that?

I didn’t at first, so I created one label and then hit create password and cut and pasted it into my Picasa, Outlook, iPad, and iPhone email apps. I could have created a bunch of passwords if I wanted.

I also could print them out and tape them next to the 10 backup OTP’s taped to the wall too.

 

 

Now I’m all done and totally secure, I get a nice email to tell my how much better things are. I now have the following:

1) Google identity – jhaggard1

2) Google static password – xxxxxxxxx

3) Google Authenticator OTP registered on my iPhone for generating my OTP

4) A List of Google generated static passwords to use when logon doesn’t support interactive OTP’s

5) A list of 10 backdoor OTP’s in case I need them taped to the wall.

 

Wow I feel better already….not.

JCH’s 2010 Music Picks (hottest videos go to Grace Potter)

http://8tracks.com/haggard/john-s-2010-picks

Kick Drum Heart by The Avett Brothers

Low Road by Grace Potter and the Nocturnals (use the 720p version and go full screen)

Slippin’ and Slidin’ by Justin Townes Earle (Amazon sample)

Satisfied Mind by Willie Nelson (Amazon sample)

Tragedy by Peter Wolf/Shelby Lynn

One More Night in Brooklyn by Justin Townes Earle

Roll Away Your Stone by Mumford & Sons

King Hummingbird by JJ Grey & Mofro (Amazon sample)

Little Lion Man by Mumford & Sons

I’m a King Bee by Kenny Wayne Shepherd

  Won’t Back Down by Eminem/Pink

The Cave by Mumford & Sons

Harlem River Blues by Justin Town Earle

I And Love And You by The Avett Brothers (Amazon sample)

The High Road by Broken Bells

Going Through Changes by Eminem

That Phone by Grace Potter and the Nocturnals (use 1080p version and go full screen)

The Strange Man by Patty Griffin (Amazon sample)

Stay Around A Little Longer by Buddy Guy/B.B. King

Behind the 8 Ball, OT8 Bed Bugs moving up the ranks, despite “old” news….

A quick check of King 5 News web site shows Seattle is communicating the OT8 Bed Bug story. Ranked #3 up from # 4 yesterday:

 

Interesting comments on the whole situation. Read them here: http://www.king5.com/news/local/Apartment-Bedbugs-111089689.html

One Thousand 8th Avenue Apartments (OT8) - The Right Thing To Do Re: Bed Bugs… Eradicate or Release (please)

First, Seattle is taking note of the news…. As of 8:30 this morning this story ranked #5 and #4 on most viewed and emailed  respectively…

 

The right thing for OT8 to do is eradicate the building or release residents from their leases. Once OT8 becomes aware of a problem it is their responsibility to notify other residents at risk. If a fire breaks out in an apartment, you sound the alarm and then you deal with it. Same thing here.

Bed bugs are not something that can be dealt with on an isolated basis. At the very least, OT8 should turn this over to a professional contractor for dealing with an infested apartment and all adjacent apartments, sides, up, and down. Letting Wally and others to fend for themselves is absolutely shameful. Clearly OT8 did not go out and negligently introduce bed bugs for Wally and others, but it is also clearly evident that no single resident can solve this problem by themselves. Every single apartment at the OT8 can be fumigated one at a time in an uncoordinated fashion and the result will remain the same – bed bugs at OT8. It is in OT8’s best interest to be as proactive as possible to get ahead of this while they can.

Offering assistance to residents while being open and honest earns goodwill and avoids the Wally’s getting hurt and all of Seattle finding out about it. Now that Seattle knows Wally’s story, OT8 has a choice – respond positively or negatively (which of course includes no response at all).

If eradication cannot or will not be done, then release residents from their lease and allow them to flee the building’s bugs. To enforce leases while simultaneously not disclosing hazards and taking corrective action is flat out immoral. Non-disclosure on OT8’s part is laughable because people who get chewed on are going to find out, you cannot sweep bed bugs under the rug.

Full disclosure is I have a family member who is Wally’s neighbor and who is also fighting the bed bug plague. As a father, I am not too keen on looking at welts all over my daughter’s body; I thought she was having an allergic reaction and requested her to seek medical care immediately (Nov. 13, 2010). OT8 did not tell her that Wally’s apartment was infested and being exterminated. The complex’s strategy seems to be to exterminate one apartment while leaving the neighbors in the dark. Guess where the bugs go when one apartment gets nuked? They flee to the next unsuspecting victim.

At the moment, she and Wally are wondering if they are playing ping-pong with bed bugs – her apartment just got nuked and Wally’s place is now open season again.

Today is the 1st of December and rent’s are due. OT8, whatcha going to do? Eradicate, release, or let us keep telling this story?

One Thousand 8th Avenue Apartments have Bed Bugs….

In case this place (http://www.onethousand8thavenueapts.com/) doesn’t disclose this along with their “First Class Amenities.”

Just saying…

You can watch here: http://www.king5.com/news/local/Apartment-Bedbugs-111089689.html

 

Wally is 87 and dealing with this. A family member who is his neighbor is much younger and also having a hell of a time.

So now, automated Google search, do what you do, put me in the search for OT8, One Thousand 8th Ave Avenue Apts Apartments, etc… you get the idea.

If reading this, feel free to repost as often as you want….