(Archived) Security choice #epicfail

[mogf01 12]

Attached dialogue is displayed when another server takes over IP traffic, for example at hotels where one has to login to a server before using Internet. I just think that it would be nice to get more than one option. Especially since one has to press OK to continue using Evernote (yes, that dialogue is modal...).

The dialogue presents a warning, and asks the user if he/she wants to continue or not. Then the dialogue gives the user only ONE choice (and forces the user to select that choice since the dialogue is modal): to chose to continue even though that has just been stated being a security risk.... This is so silly it is actually a bit funny.

What is really not funny at all, is that Evernote support refuses to even call this a bug. Instead they blame "using a public Internet source"! Using a public Internet source that works by taking over the traffic is of course the source of the warning, but this in no way changes the fact that the dialogue is plain wrong. The fact that Evernote support doesn't even acknowledge that this is a seriously stupid dialogue, that simply needs to be fixed worries me. My ticket number is #69490.

Any tips on what I can do, now that Evernote support has told me they cannot do anything to fix this? Can I contact someone who actually understands, and/or is it possible to escalate the issue?

Btw, there is one advantage of the silly dialogue: it is given me a new fun #epicfail screen clip to show security minded people! :-)

[gazumped 11,652]

I have some experience of working on government contractor sites who are not known to have a sense of humour that they're aware of on security issues.

 

Internet access is locked down through various proxies, and because of that, notices like the one that offends you are pretty common for notoriously dangerous clients like G**gle and Y****!

 

If I were going to a site I hadn't used before and got worried about it I would use the off switch or unplug something.

 

If I know it's an artefact of the system I shrug and click on.  Life's too short to worry about known false positives.

 

If you really want to make an issue of this the ticket system is also a general feedback route into Evernote.

[mogf01 12]

Gazumped, you do realize how silly the dialogue is, right? I fully understand the background, with traffic redirected to servers for payment purposes, etc. I don't expect Evernote to actually do anything about this, of course... What I do expect is that they fix a dialogue that is just plain wrong.

Since my last message here, Evernote support has changed its view, and now acknowledges this as a bug. So, my complaining actually did work this time! :-)

[gazumped 11,652]

See my "life's too short" comment above...

[BostonEnginerd 2]

Attached dialogue is displayed when another server takes over IP traffic, for example at hotels where one has to login to a server before using Internet. I just think that it would be nice to get more than one option. Especially since one has to press OK to continue using Evernote (yes, that dialogue is modal...).

The dialogue presents a warning, and asks the user if he/she wants to continue or not. Then the dialogue gives the user only ONE choice (and forces the user to select that choice since the dialogue is modal): to chose to continue even though that has just been stated being a security risk.... This is so silly it is actually a bit funny.

 

What happens after this? Does Evernote connect using an invalid certificate? If so, this is a pretty bad security bug! Your authentication information may be exposed to the redirected host.

[cwb 225]

BostonEnginerd, no.  You were informed, and you took action to continue.

 

The only thing I'd say is that I'd agree the system is half implemented.

If it was fully implemented, the dialog would give a choice to continue in offline mode.

 

As to the OP's question on any tips...

If you elect not to continue, your choice would be to leave the app with the home button and put yourself in offline mode (airplane mode).

Then you can safely hit OK on the dialog, after coming back.

At worst, I guess you could force quit the app.

 

On such a network, It might be prudent to have a VPN option setup on your iphone/ipad, and bring that up before launching evernote again.

If a network doesn't let you use that, I'm not sure the network is worth using.

For the Mac users who happen to have a Mac generally running at home, rather than subscribe to a VPN service, you can use VPN Server Agent for a couple bucks in the App store to easily configure one on your Mac, plus email you your public IP whenever it changes.

 

And/Or adding OSX Server  to your Mac with all the bells and whistles including VPN, is about $20 in the App store.