Categories
Technology Thoughts

Privacy Nutrition Labels for the Top Apps of 2020

With the release of iOS and iPadOS 14.3, all app updates in the App Store are now required to include Privacy Details, or “nutrition labels”.

App Privacy Labels

At a high level, there are three categories of nutrition label:

  • Data Used to Track You
    • “May be used to track you across apps and websites owned by other companies”
  • Data Linked to You
    • “May be collected and linked to your identity”
  • Data Not Linked to You
    • “May be collected but it is not linked to your identity”

Within each category, there is additional info split into types of data collected and ways data is used.

Types of data an app can collect includes:

  • contact info
  • health & fitness
  • financial info
  • location
  • sensitive info
  • contacts
  • user content
  • browsing history
  • search history
  • identifiers
  • purchases
  • usage data
  • diagnostics
  • other data

Ways data is used include:

  • third-party advertising
  • developer’s advertising or marketing
  • analytics
  • product personalization
  • app functionality
  • other purposes
App Privacy 
See Details 
The developer, Zoom, indicated that the app's privacy practices may 
include handling of data as described below. For more information, see 
the developer's privacy policy. 
Data Linked to You 
The following data may be collected and linked to your identity: 
Location 
o 
Contact Info 
User Content 
Identifiers 
Usage Data 
Diagnostics 
Privacy practices may vary, for example, based on the features you use 
or your age. Learn More
Zoom Privacy Details – apps.apple.com

Putting it all together, when looking at an app in the store, like Zoom for example, you can see the app collects your location, contact info, user content, identifiers, usage data, and diagnostics and links the data to you. If this data was in the “not linked to you” category, the data would still be collected, but done so anonymously.

The top level information tells you what data the app collects, but to see how the data is used, you need to select the “See Details” link at the top right of the App Privacy section.

From the expanded view, you can see that Zoom collects data for advertising & marketing, analytics, and general app functionality. This may look like a lot, but Zoom’s data use is comparatively short. Details for Facebook’s data use scroll for days.

And the distinction between data collection and data use is important. For example, an app may collect your location and use it to tell you the weather nearby. Granting permission to location would make sense if you are downloading a weather app. But an app may also collect your location and use it to tell ad providers all the places you go. In this case, giving access to your location would be sketchy if you were downloading a calculator app.

There is also an inherent level of trust associated with Apple’s new model for privacy details, as for app developers:

“You’re responsible for keeping your responses accurate and up to date.”

This means, to apply these new privacy labels, app developers must self report their data use when submitting updates to the app store. Apple does not read through all the code or monitor network traffic to automatically create an app’s privacy details. 

Apps can change their behavior with any update, but developers are required to update on their own. App reviewers do not flag when the privacy details need an update.

So while the longevity and robustness of the new privacy nutrition labels remains to be seen, we can take a look at how the most popular apps of 2020 report their privacy nutrition details.

Top 2020 Apps

If you have updated to iOS 14.3, it’s interesting to flip through some of the apps you use to see how they report their data collection and use. Although, it’s not exactly easy to compare two apps.

Since Apple recently unveiled the top games and apps of 2020, you can look at all the privacy nutrition label details in search of trends from the apps everyone are using.

So I did. And compiled the Privacy Nutrition Label Data for the Top Apps of 2020.

This starts off with general info regarding what data is collected, then looks at how specific apps and games report data use, and finally lists insights and questions from the investigation. (All the spreadsheets and data are included at the end).

Nutrition Label Data

General statistics
  • 80 total apps
    • 20 free apps
    • 20 paid apps
    • 20 free games
    • 20 paid games
  • 51 updated to report privacy data
    • 32 apps
    • 19 games
  • Top collected data types across all three categories
    • identifiers (70)
    • usage data (70)
    • diagnostics (59)
    • purchases (46)
    • location (42)
    • user content (36)
    • contact info (35)
    • other data (21)
    • search history (16)
    • contacts (14)
    • financial info (12)
    • browsing history (11)
    • sensitive info (7)
    • health and fitness (6)
  • Top collected data types (used to track you)
    • identifiers (27)
    • usage data (23)
    • purchases (12)
    • contact info (10)
    • diagnostics (10)
    • location (10)
    • other data (8)
    • user content (4)
    • browsing history (3)
    • contacts (1)
    • financial info (1)
    • health and fitness (1)
    • search history (1)
    • sensitive info (1)
  • Top collected data types (linked to you)
    • usage data (30)
    • identifiers (28)
    • diagnostics (26)
    • user content (24)
    • purchases (23)
    • location (22)
    • contact info (22)
    • search history (13)
    • contacts (12)
    • other data (11)
    • financial info (10)
    • browsing history (7)
    • health and fitness (4)
    • sensitive info (4)
  • Top collected data types (not linked to you)
    • diagnostics (23)
    • usage data (17)
    • identifiers (15)
    • purchases (11)
    • location (10)
    • user content (8)
    • contact info (3)
    • sensitive info (2)
    • search history (2)
    • other data (2)
    • health and fitness (1)
    • financial info (1)
    • contacts (1)
    • browsing history (1)
By Apps and Games
  • Most types of data collection (17)
    • Facebook
    • Instagram
    • Spotify
    • Twitter
  • No data collection (* these are all paid apps/games)
    • HotSchedules
    • AutoSleep Track Sleep on Watch
    • Shadowrocket
    • EpocCam Webcamera for Computer
    • Arcadia – Arcade Watch Games
  • Only collects data not linked to you
    • Widgetsmith
    • Among Us!
  • Most data types used to track you
    • Twitter (7)
    • Subway Surfers (6)
    • Spotify (5)
Free vs Paid
  • Average types of data collected (overall)
    • Free (10.5)
    • Paid (3.6)
  • Median types of data collected (overall)
    • Free (10)
    • Paid (4)
  • Average types of data (used to track you)
    • Free (2.9)
    • Paid (0.3)
  • Average types of data (linked to you)
    • Free (6.3)
    • Paid (1.1)
  • Average types of data (not linked to you)
    • Free (1.3)
    • Paid (2.2)

Insights and Questions

Many of these points stem from the descriptions of Types of data and Data use sections of Apple’s privacy details page.

Free apps
On Apple’s categories:
  • “Identifiers” is a vague name, but it’s related to device and user IDs. These types of IDs are often static and used to link your information across apps and services
  • “User content” from apps not creating user content is interesting (Disney Plus and Netflix). Guessing these are related to the “Customer Support” category.
    • And how does an app have “User Content” not linked to you?
  • “Purchases” is not included by Netflix (as you can’t subscribe in the app)
On companies:
  • Google hasn’t updated info for any of their apps yet
  • Widgetsmith was a breakout iOS 14 app of the year. It only collects anonymous purchase and diagnostic data.
  • WhatsApp is Facebook’s least offensive app.
  • What is Spotify doing with browsing history?
  • Twitter is doing a lot of tracking
On trends:
  • “Data linked to you” is largest category and shows most first party data use
    • “Data used to track you” is “owned by other companies”
  • Companies should move usage data and diagnostics collection from “linked” to “not linked” categories
    • Free games do a somewhat better job collecting anonymous data (but also use the same data types to track you)
  • Top free apps do less data sharing (tracking) than expected

Overall, rules are new, so companies are still getting used to the categories. Guessing they’ve over-reported as it is easier to move to a more private usage category. Companies may interpret rules differently (Twitter vs Facebook vs TikTok, why so different?)

Free games
Paid apps
  • Top paid apps do less tracking and data collection overall
    • Also have most non-updated apps in the top 2020 list
  • “Data Not Collected” is a tag (took going through a lot of apps to find that out…)
App Privacy 
The developer, HotSchedules, indicated that the app's privacy 
practices may include handling of data as described below. For more 
information, see the developer's privacy policy. 
Data Not Collected 
The developer does not collect any data from this app. 
Privacy practices may vary, for example, based on the features you use 
or your age. Learn More
Paid games
  • Very few top games have updated
  • Seems Facebook SDK could require Identifiers, location, usage data, diagnostics
Overall
  • Apple, what’s up with the random ordering of data types? Seems to be consistent by count, but not across all apps
  • Health and fitness apps were not very popular this year
  • How do changes to data collection and use get reported? Is there a notification added to the nutrition label?

Wrap up

Probably can do a lot more analysis on all this data, but it’s the holidays and everyone is asking me why I’m working. So I’ll leave it at that. As more apps update with their privacy nutrition details, we can expect to learn more about about how the apps we use use our data, and how Apple’s new system changes with time.

Charts and Graphs

Here is all the raw data if you want to compare: Top 2020 Apps – Privacy Summary

☃️ 🛷 ❄️

Categories
Thoughts

The Music Mentality

Music connects you with others, lifts your spirits, and inspires. Recently, listening to music inspired me to try making music. There is still so much to learn, but I’ve been able to make decent progress despite a quarantine and the obstacles it has presented, by seeking knowledge passed along by musicians online. To continue connecting, I figured I should pass along all I’ve learned so far.

Finding inspiration

When you listen to music, you’re never alone

The title of this article keeps popping into my head during all the quarantining and social distancing brought about by the Covid-19 pandemic. I forgot what the article was even about, but the words are a reminder for me whenever I’m not having a great day, that music can bring people together, even when we’re apart.

You put the headphones on, you’re listening to music, but the music’s still part of the larger social world

Jay Schulkin

Another idea that sticks with me comes from Oak Felder. If you haven’t heard of Oak (I hadn’t before this deep dive into music production), he’s a producer for many popular artists including Nicki Minaj, Alessia Cara, Kelly Clarkson, and John Legend but in this case, the line comes from a video of him talking about the production of the song Sorry, Not Sorry, by Demi Lovato.

Oak says,

A song is a conduit of emotion from one person to another, but in order to accurately depict this emotion, it has to be a snapshot of a moment.

Oak Felder

More succinctly, “A song is a snapshot of a moment.”

And Covid-times are providing quite the moment to snapshot.

Early on we got songs like Level of Concern from Twenty One Pilots talking about an initial uncertainty of the situation, and Quarantine Casanova from Chromeo making light of it. Glass Animals made Quarantine Covers and later, AJR released Bummerland.

But a general theme was musicians wanting to play music. 

Martin Garrix played on an assortment of roofs and boats around Amsterdam, Machine Gun Kelly played virtually with Travis Barker and later for aliens, Post Malone played Nirvana, David Guetta played to Miami, Steve Aoki played in a foam pit, and the Preservation Hall Jazz Band played Keep Your Head Up.

It’s easy to see that music isn’t quite the same this year. No shows to play, but plenty of thoughts and emotions to share about trying to figure things out.

I used go to a ton of concerts back when they still happened. I love the energy of the music, the atmosphere of the venue, and the creativity of musicians.

Quick aside. You should be proud of what you like and the things you do. It’s the creativity and uniqueness that makes you, you. Don’t be ashamed of being out of the ordinary or mainstream. Be both. You can contain multitudes.

I love music because I love to see what people create. And this applied to people in all creative professions. I am always amazed by the songs, movies, shows, and books people make. But you don’t have to be a Grammy winning record producer to pursue your interests.

Learning to play

I realized a couple years ago that after countless hours of listening to music and going to concerts, it would be fun to try to make music of my own.

And the good news, I learned, is some of the award winners will walk you through their process for creating their industry recognized art. So yeah, you don’t have a to be a pro, but you can still learn from them.

When you listen to music, you’re never alone. When you make music, you find out if you have schizophrenia.

If music is part of the larger social world, I wanted to be part of the conversation (but had to figure out what I wanted to say).

I have some musical background. I played piano briefly as a child, but didn’t stick with it. I tried guitar but never could progress beyond basic chords. I did play trombone in jazz and concert band throughout high school and middle school. I think picking up bass would have translated better instead of guitar. 

I began my musical restart in Winter 2018. I couldn’t read treble and had all but forgotten bass clef. And I couldn’t play piano, but I wanted to be able to.

Since then, I’ve said playing piano is my winter activity because Seattle summers are so amazing. Through quarantine and social distancing I have played more than usual and uploaded 15 songs to Soundcloud, but it’s still tough to sit inside when the weather is so nice. With recent weather making the city look like a scene from Mad Max, staying in has me reflecting on making and listening to music again.

Here’s how I started learning piano and music production.

To set some expectations, my goal is to learn piano, but also understand musical concepts in order to produce songs. I’m also no where near experienced enough to teach people how to do either, so I’ll just pass along the ways I’ve learned how to do things. There are tons of resources out there! These are just a few.

The first book I worked through was the Alfred Adult Course. I made it through the first and part of the second. The Alfred books were great for piano basics, but did not get enough into the theory. I also found I wasn’t very interested in the songs so I wound up going online for music I wanted to play. 

I later picked up the Compete Piano Player which I would recommend over the Alfred books. 

There are tons of digital resources for piano music, but I found that for piano scores both Musescore and Music Notes to be the most reliable and easiest to just open on a tablet and play from the piano music stand. And generally, if you search for “(song I want to play) piano score”, these two sites will be top results. 

With sheet music on stand, I immediately realized I needed to get better at reading the notes. The Music Tutor app is free with ads, and provides a game-ified way to learn notes from the bass and treble clefs tailored to your level of experience. I like it so much that I purchased the option to remove ads. Support those developers!

Beyond just the notes, to better understand key signatures and chords, the Piano Keyboard Guide website is invaluable. Again, it will probably be the first result if you search for “key of (key I’m playing) piano”, but you can always go there directly. This site has diagrams to show the notes in each key and lists chord progressions which is really helpful when coming up with the background for new songs.

With the basics covered I was itching to start moving into music production, but I recognized I had a lot to learn about theory. I also realized, in retrospect, that I was not playing my solos in high school jazz band correctly at all. I should have looked up the notes in key signatures back then. Whoops!

It was about this time that I came across Bill Hilton’s YouTube channel. I learn well by watching people, and watching Bill play while he talked through his lessons jump started my progress. Not only is he inspirational to watch (he’s quite talented), but he is also a great teacher. Bill has a wide range of videos from basics to more advanced topics and he explains each concept in ways any level of piano player could grasp.

Bill also has a book called How to Really Play Piano which has the same detailed information in a well explained format. Plus it’s nice to have something tangible to read. 

Bill’s book is the one I was looking for from the beginning, it only took a while to find. The lessons satisfied my desire to take the basics of playing piano and translate that understanding into learning the structure of writing music.

Granted, I am still terrible at playing piano, reading notes, and writing music, but one of my favorite things to do now is pick a random key, figure out a chord progression, then improvise on top of the chords. It’s this type of informal playing that often leads me to making new songs. 

Learning to produce

I did say you can learn from Grammy winners, right?

Turns out, if you go to the list of 2020 Grammy winners and scroll down to the “Best Arrangement” winners, you’ll find Jacob Collier, who has kindly recorded a nearly two hour breakdown of his Logic session for his, Grammy winning, All Night Long arrangement. And wow, is he talented. Collier says he put together the initial track in one night after procrastinating for weeks.

Logic, (Logic Pro X) by the way, is Apple’s music production software that allows music producers to input sounds, midi, instruments, and vocals, edit all the inputs together, and create a song. Ableton Live is another popular production software.

I was initially using a trial of Ableton, but I decided to switch to Logic after seeing it’s what Grammy winners use 😜.

Non-Grammy winners (but maybe future Grammy winners?) use Logic too, and there are tons of people on YouTube uploading tutorials and making songs using the software. Although, it really doesn’t matter what software people are using in YouTube videos, you can still learn the concepts of music production from someone using Ableton.

One of my favorite music producers on YouTube is Ocean. He uploads multiple times a week, and shows how to create a simple melody then turn it into a full song. 

This brings us back to Oak Felder and his breakdown of the production for Sorry, Not Sorry. Similar to Collier’s breakdown video, Oak pulls up the Logic track for the song and talks through each part of the arrangement, step by step. From the main loop to Demi Lovato’s vocals, Oak shows how each component is edited together into the final song.

These behinds the scenes videos show that musicians put a tremendous amount of thought and effort into getting their songs just right.

Putting in effort and a drive for perfection is best exemplified by Billie Eilish and Finneas talking about making their song, Bad Guy. (Finneas also has another video talking about producing additional songs). The duo makes music in their cramped childhood home, and take great pride in the meticulous details of their music production.

It’s interesting to see how people use different techniques. If you watch the Sorry, Not Sorry and Bad Guy videos, they both touch on the concept of doubling vocals (creating multiple versions of the same vocal track). Oak says he takes Demi’s original vocal track and auto-pitches it up/down to layer harmonies in exact alignment, while Billie and Finneas say they have a rule against pitch shifting, instead opting to painstakingly record each vocal layer separately. But no one knows about it.

Learning to listen

Going into this music creation experiment, I thought that pop songs sounded so easy to make. I learned that coming up with a beat or melody in music is like coming up with a great start-up idea. They’re pretty easy to think of, but execution requires a lot of dedication, learning, and refinement.

I also discovered you don’t need to be able to play like a concert pianist to be able to make songs. You don’t even need to have a piano. Production software like Ableton and Logic Pro X let you “write” the music without any instruments. All you need is a little inspiration and desire to create something new.

A quote that comes to mind from back in my overly philosophical days goes like this:

The more you try emulate others and fail, the more you define yourself.

Me?

Another interpretation I found looking back in my journals is,

Find a someone you admire. Use what you like about them to bring out more of that in you. Use what you don’t like to stay away from those qualities.

A pop psychologist

There is so much to learn from music. The genre and lyrics can impact your emotions, and the production is an artform.

In a similar way that listening to good music can be transportive, playing and creating music, is engrossing and addicting. You can make what you think sounds good. There is a compounding effect. You don’t want to stop.

Outro

Through Covid-times, getting outside to go biking was my daily dose of serotonin. With the Seattle smoke, I’ve nearly lost my mind being inside for days in a row. So to change things up, I’ve now spent an entire afternoon and evening listening to all the music in this post while writing it. The process really has lifted my spirits. And to me, it proves the points: a song is a snapshot of the moment and when listening to music, you are never alone. 

Since this has all been about creating, listening, reflecting, and how music affects your mental state, I’ll leave you with the latest Demi Lovato song (she took my Emojion design for the album cover) and a playlist for solo dance parties (and writing blogs).

Coda

Guess this is a good time to plug my Soundcloud  😉

Keep listening 🎧

Categories
Thoughts

This Is Phishing

Password managers can help you identify when you’re on the site you want, or might be somewhere you do not intend. By comparing the url of the site you’re on, to the urls saved in the password manager, the password manager can indirectly alert you to a suspicious situation.

Here’s an example. In the Robinhood app (which registers on iOS as Robinhood.com), you are prompted for a Wells Fargo account and password.

This sure looks a lot like Wells Fargo, but the password manager (Dashlane) tells you it detected that you’re actually entering this information on Robinhood.com.

If you ever find yourself in a situation where your password manager credentials don’t match or don’t autocomplete on a site where you expect they should, it should set off all sorts of alarms in your head.

This is not the login page for the site you think you’re on.

So then why does Robinhood make it seem like you are entering your information on Well Fargo?

In this case, the app is not trying to steal your bank information (or so they say), instead, it’s trying to help you log in quickly, so you can get back to using the app as soon as possible.

Robinhood, like many other financial apps, uses a service called Plaid (owned by Visa) to sign in to your bank accounts. Plaid touts itself as “The easiest way for users to connect their financial accounts to an app”. Incidentally it’s also the easiest way to condition people to fall for phishing schemes.

“Secure and private”, or “encrypted transfers and no access by Robinhood”, boils down to you trusting Plaid with your financial account information.

Is using Plaid any worse than sending your bank account and routing numbers? Well, at least you can change your password easily enough after giving your old one to Plaid. Changing a bank account is a bit more cumbersome.

Just be aware, the same tricks Plaid is using to make you think you’re logging into your bank can be used by more nefarious actors. And if you’re not using a password manager to help you recognize these tricks, you just might fall for one.

Stay safe. Wash your hands. Wear a mask. And use a password manager 🧼

Categories
Thoughts

Internet Safety Tips

Lots of weird things just happened at once.

It’s always important to be cognizant of what and who you interact with online, but phishing is way up right now, so be extra careful with emails, links, and articles sent to you that you didn’t initiate or request. And while email phishing is often a main focus for scams, there are additional methods to be aware of and keep in mind. Reseller and rental sites like eBay, Craigslist and Airbnb present similar opportunities for scams, however these scams are crafted differently since you are often the one initiating the contact with an unverified third party (instead of the other way around).

So weirdness, here’s what happened

Over the course of the afternoon, 5 phishy things happened to three different groups of people I know.

  1. Three people in the same family individually received notices that a PayPal, credit card, and Instagram account were hacked.
  2. A friend got an email that someone signed into their Instagram on a new device.
  3. Another fiend stumbled across a Craigslist apartment rental phishing scheme. (The exact one covered in this report. Word for word, save for a change in company name and a different person in nearly identical photos)

This very coincidental timing, but it’s a good opportunity for an internet safety refresher!

Safety tips & reminders:

I shared these with family and friends after all this weirdness, but will aggregate them here.

1. When in doubt, go to the actual site

If you get an email from PayPal (or your bank or Instagram) about an account issue, go to the PayPal website yourself to check out the notification. Don’t click on any links sent to you. You can hover over links to see where they really go, but even then, it can be easy to miss smaII deta1ls.

paypa1

So to be safe, go to PayPal using the app, by searching for PayPal (trusting the wisdom of the search engine crowd), or by manually going to https://www.paypal.com.

Better yet once your are on the PayPal.com that you know is the actual PayPal.com, add it to your favorites and use your own personal trusted bookmark to get back to the real PayPal every time. This way you don’t make a mistake later by mistyping the url and ending somewhere you don’t expect. (And yes, I’m purposefully not linking to PayPal from here. Go build that muscle)

This tip applies to phone calls too!

Summary: It’s your best bet to search for the site/article/etc or go directly to the url if you have it saved somewhere.

2. Use a password manager

You can visit every site you go to as carefully as possible, but if you reuse passwords, one security breach can cause issues across your accounts.

A password manager creates strong, unique passwords for every one of your accounts and securely keeps track of them all for you. You only need to remember your master password to unlock the account.

Some good options are LastPass, Dashlane, and 1Password.

They can also help you more easily change passwords if one is stolen or part of a data breach. You can check to see if your accounts have been part of a data breach using Have I Been Pwned (just don’t enter your current passwords).

Password managers can be difficult to transition to at first, as you need to manually change passwords one at a time, but if you use a password manager solely to keep track of new accounts, you can quickly start to see the benefit.

Read this exhaustive post to learn more before you set up a password manager. A quote:

Password managers are programs that remember passwords for you, along with the email address or other user identifier you use for each account. They make it easier to use strong passwords: those that are sufficiently random, long, and different for every one of your accounts. They also make it easier to lose all your passwords at once, or for attackers to steal all your passwords in one instant.

Summary: See above quote, but you should probably be using one of these.

3. Set up two factor authentication (2FA)

After setting up strong passwords, you can go a step further to safeguard that even if one of your account credentials is compromised, you are still in control of signing into the account.

Two factor authentication satisfies the “something you know, something you have” paradigm for online security (or the first two parts of multi-factor authentication). You know your password and have either a code or USB key or app to verify you are you. If your password is compromised, the second factor of authentication ensures someone with just your password cannot log in.

Needing a second factor can cause problems, however, if you (who is in reality, is you) loses the second factor of authentication. Then you can be locked out just as if you were an attacker.

Also, if multiple people use the same account, two factor authentication can be difficult. With 2FA enabled someone may try to log into an account and the 2FA code can be sent so someone else (which also happened to my family today).

Read this other equally exhaustive post to learn more before you set up 2FA.

Summary: Two factor auth can help keep your accounts secure, but comes with some extra challenges.

4. Keep third party communication within app and website services

This one is related to staying safe when reaching out to others you don’t know online. Talking to strangers! 😱

Whenever possible, keep communication within the app or website service you are using. If buying on eBay, communicate on eBay. If renting on Airbnb, use their chat functionality. Let the site intermediate communication. Don’t share your email or phone number to talk with a third party seller or host outside of the service. Major sites like eBay and Airbnb have measures in place to help you stay safe (and allow you to provide evidence in case of an issue), but only if you leverage their tools.

Be extra cognizant on Craigslist where direct email communication is the standard! I’ll put this Anatomy of a rental phishing scam post here again as a reminder to read it. A quote:

The first red flag was “So we’ll keep our communication to email if that’s ok with you”.

This tip also applied to articles you read or videos you watch. If you aren’t sure of the source, don’t trust, verify 🙃

Summary: There are more signs of a scam than only asking for your bank account and credit card information.

5. Bonus Tip: Use Zoom on your phone or browser

If you use Zoom, you should know that Google banned it’s employees from using the desktop app, and suggests to use mobile or web.

Employees who have been using Zoom to stay in touch with family and friends can continue to do so through a web browser or via mobile

Google’s guidance is to uninstall and block the app completely (maybe because they prefer everyone to use Hangouts 🤷‍♂️). In any case, if you’re interested, here’s how you can uninstall the desktop version on Mac and PC.

A legitimate reason behind allowing mobile and web, but blocking desktop, stems from the fact that mobile and web platforms have security and containment measures in place that limit sites and apps from accessing your underlying device. Whereas apps installed from the internet can do whatever they want after you type in your computer account password to allow higher level device access.

To continue using Zoom on a desktop, here’s Zoom’s support article on how to join a call using your web browser. The link is a bit hidden (and misleading), but it looks like this:

zoom

Summary: Use your phone to show off your Zoom backgrounds

 

That’s all for now

Stay safe. Wash your hands. Wear a mask. Don’t touch your face or click on links in your email 🧼

Categories
Thoughts Travel

Learnings From My First Conference Talk

This past Tuesday I gave my first conference talk at View Source in Amsterdam! It was an awesome experience at an amazing venue in a rainy city where people from all corners of the web came together to discuss many of the challenges, opportunities, and learnings for browsers, web development and the overall landscape of the internet.

I work on creating experiences to help people stay safe and have greater privacy online, so it was enlightening to hear from such a wide range of topics about the web. I’m always impressed by the depth of understanding and passion people have about their subjects of work, and the speakers and attendees at View Source carried an overwhelming amount of inspiration.

Just to name a few, gaming, entertainment, monetization, accessibility, connectivity, and rethinking digital utopianism were all covered. I love hearing about what people are working on. It shows how there is so much to think about and is a humbling reminder that my work is a small piece of a vibrant community.

I was fortunate to attend the conference with a group of us from the Microsoft Edge team. It was a great team bonding experience to get to know others from different parts of the team who I don’t normally work with. While it’s not always possible, I would highly recommend going to conferences with folks from your team. It’s great to have others with a similar frame of reference to talk about new ideas and to be more connected when you get back to work.

My colleague Lillian Kravitz and I spoke about the privacy principles we’ve developed for Edge. Melanie Richards gave a talk about the simple and actionable steps to help make your site accessible to everyone by considering of various contrast and theme settings, and others on the team held “conversation corner” discussions about web compatibility and more. The talks were recorded, and I’ll post a link here when it’s available. (Here it is! And me tweeting about the talk.)

A main theme of our privacy talk was listening, learning, and trying to gain a fresh perspective on a topic we thought we were familiar with. I know I am not at all familiar with giving talks on a big stage, but the aspect of learning something new and having a different perspective on presenting my work still felt as fitting to the process of giving the talk as it did to the contents of the talk itself.

I can come back to more about the talk when the recording is posted, but for now, while the experience is still fresh in my mind, I wanted to reflect on the things I learned, what went well, and what I could improve for next time. Because, yes, giving a talk is exhilarating and this one will not be my last.

IMG_9365

Preparing

Our talk was second to last on the last day of the conference. It’s tough having a time slot late in the day on a later day of a conference (this post and comments came to mind when I learned of our time). You almost need to leave something small to clean up and keep working on during the conference because if you show up on day 1 ready to go, you’ll have to keep your excitement and preparedness high for quite a while.

It would be great to be at peak preparation the night before the talk, but even then, we ended up waiting 8 hours the day of as our talk was at 5pm and the events started at 9am. At breakfast the morning of, excitement needs to be reserved because adrenaline could give out well before the talk. I likened the situation to an athlete or musician where a game or performance is late at night (worth looking more into how they manage energy). You need you energy and focus to be up at an hour different than your normal operating schedule.

Which leads to another interesting aspect of this conference. Traveling to a different time zone can be debilitating for the first few days. Especially when it’s many hours different than you’re used to (And seemingly more-so when going east around the globe?).

I am not one to take naps normally, but when your schedule is turned upside down, naps can be your friend.

Luckily the hotel was nearby the conference theater, so it was easy to go back to sleep. I was conflicted because I wanted to listen to all the talks, but I knew if I wanted to have the energy for my talk, I’d need sleep a bit before we were up.

My pre-talk routine (but maybe not a routine because I only did it once), was check the slides early in the morning before the first talk, listen to the first few talks, go for a nap, head back for lunch, listen to more talks (three hours before ours), regroup for a bit just before getting mic’ed up, the go on stage. Seemed fine. I think the whole process would have been easier in my normal time zone, but this helped manage energy and focus well enough.

The talk

It’s impossible to even scratch the surface of all you need to know going into something you’ve never done before. You have to put yourself out there and figure things out as you go.

There’s a lot of “tribal speaker knowledge” I learned from this first talk. Questions I hadn’t considered asking because they didn’t even come to mind before, and issues I could have mitigated had I known a bit more about the process. All good takeaways though. Makes me want to try again soon to test out my new perspective.

First, I think I was a little too reliant on my slide notes. I wanted to be sure to hit the speaking points we planned, but the talk felt less conversational as a result. The story we were going for lent itself to a more prescription presentation style, as we were sharing a process others might be able to apply, but I enjoyed the more casual and friendly sounding style of some other presenters that was more akin to giving a well thought out answer to a question rather than reading a speech.

Awareness of my over reliance on notes cropped up when, under some unforeseen circumstances, a few of my notes got cut off from the presenter screen. Without the expected cue, I stumbled a bit to keep with the flow I’d practiced when leading from an idea on one slide to the next. This was unfortunate because we checked the presenter screens before the talk, I just missed the few slides that had issues.

But when things don’t go according to plan, you’ve got to improvise! You can’t do a dance and walk off stage. You have to keep going!

Second was a simple problem of struggling with the clicker having issues advancing slides. At one point I thought I was ahead of where I was only to realize I missed a slide. (Sorry folks, that one image transition really made the talk 🙃).

After the talk when we went backstage to the “green room” talking about how it went, in an eye opening detail to me, another presenter mentioned that before his talk he asked the AV team where to point the clicker. I hadn’t even considered doing that. I figured the thing would just work (and I really think it just should), but for such a simple, yet crucial piece of presentation consistency, it was important to understand. This was some tribal knowledge that one who had given talks might know from variance of venues and presentation setups, but for me, it had not even crossed my mind.

Overall though, I think we did well. We connected ideas from other talks in the conference about privacy, collaboration, and the future of the web, and presented our customer focus as a way to reframe thinking about developing experiences. We realized there is always more to learn, and listening to feedback to spur continuous improvement was a common theme encompassing our time at the conference.

So yeah, that was the talk. Lots to think about for next time, but mostly minor tweaks to smooth out delivery. It was a great start to what I am look forward to as the beginning of many more to come. I definitely have areas to improve, and am anxiously awaiting the recordings to come out to kick myself over all the little things I didn’t get quite right. But I’m not going to hark on the mistakes. I’m going to learn from them to make my next talk even better. Can’t wait.

Touristing

Oh, and I mentioned the talk was in Amsterdam!? How about a quick travel update to round out the trip.

Side note, I think the concept of being a tourist and trying to avoid touristy things is funny. Why try so hard? Just go, enjoy the culture, and have a good time!

Side side note, a couple weeks ago at an organized bike ride in Seattle, which I would consider a very local thing to do, I met a couple who traveled from Missouri (I think it was Missouri, can’t remember exactly) who were visiting specifically to do the bike ride. No idea how they found out about it, but I was amazed at their ability to be local tourists. Pretty cool.

Anyway, I really like Amsterdam. The bikes, canals, frites, stroopwaffles, and tiny red cars all come together into a bustling culture. People are friendly, even if I often misunderstand what’s said under a Dutch accent (a taxi driver asked me how long I had to wait for the ride, and I answered I would be returning to the US. Thought he asked where I was heading… Sorry!).

Amsterdam is the first country outside of USA and Canada I’ve now been to twice, and I would definitely go again. Here are some photos from the rainier and sunnier parts of quickly playing tourist while on a trip for work.

Categories
Fun Review Thoughts

Learning to Row

Well this post has been sitting as a draft since the end of last summer. I started classes again, so now seems like a good time go over notes from last time!

On learning a new skill

It’s almost commonplace in Seattle, for people to have read or remembered the story of The Boys in the Boat. The book tells the history of the University of Washington rowing team that competed in the Berlin Olympics in 1936. It captures the feel of the sport through the teamwork, bonds, and drive of those on the UW crew, but also recounts what life what like in Seattle years ago.

Categories
Thoughts

Flash Seats Usability, Security, and Privacy

The Quora Conundrum

Quora reported a data breach earlier this month and the company outlined the stolen data, what they are doing, and what you can do in an email to those affected:

The following information of yours may have been compromised:

  • Account and user information, e.g. name, email, IP, user ID, encrypted password, user account settings, personalization data
  • Public actions and content including drafts, e.g. questions, answers, comments, blog posts, upvotes
  • Data imported from linked networks when authorized by you, e.g. contacts, demographic information, interests, access tokens (now invalidated)
Categories
Random Technology Thoughts

Is this a legit Fortnite V-Buck site? Probably not.

Fortnite has caused quite the security kerfuffle. Between releasing the Android app outside the Google Play Store, and an insane desire for V-Bucks, scams are running rampant.

Wired put out this article yesterday entitled Fortnite scams are even worse than you thought, and it made me sad that people are being tricked (that’s for tomorrow 🎃).

I made a simple browser extension as a helpful reminder of legitimate V-Buck sites. It will give you a green thumbs up on real V-Bucks websites, and a red thumbs down for sites where you can’t safely purchase V-Bucks. Check it out on GitHub.

If all else fails, to stay safe, remember: ONLY BUY V-BUCKS IN THE GAME.

Installation

Download the extension files by clicking “Clone or download > Download Zip” on Github
Follow steps 1, 2, and 3 here to install the extension
(Yes, enabling developer mode to sideload extensions is a similar security whole to what Epic is doing with Fortnite on Android. I’ll look into publishing the extension officially.)

Test out the extension!

V-Bucks for PlayStation:
https://store.playstation.com/en-us/product/UP1477-CUSA07022_00-MTX01K0000000000

psn_vbucks

V-Bucks for Xbox:
https://www.microsoft.com/en-us/p/fortnite-1-000-v-bucks/c0f5ht9nv86p

xbox_vbucks.png

V-Bucks for PC/Switch/iOS/Android are only available in game, but here’s a link to Epic Games explaining that:
https://www.epicgames.com/fortnite

epic_vbucks.png

Don’t buy V-Bucks on eBay:
https://www.ebay.com/sch/i.html?_nkw=v+bucks

ebay_vbucks.png

Video demo

It’s all out the gifs

Other Fortnite Links and Security Tips

Here’s how to get Fortnite on Android:
https://www.epicgames.com/fortnite/en-US/mobile/android/get-started

How to protect your Epic account:
https://www.epicgames.com/fortnite/en-US/news/protecting-your-epic-account

Epic on V-Buck Scams:
https://epicgames.helpshift.com/a/fortnite/?s=epic-accounts&f=account-security-bulletin&p=all

And a reminder from Wired:

 

I’ll wrap up by saying I don’t endorse actually purchasing these things, but for those of you who do buy, stay safe out there!

Categories
Articles Thoughts

Ninja and Kylie Jenner, Who Owns the Future

In his book, Who Owns the Future, Jaron Lanier discusses the idea of real-time income and wealth generation. He presents the topics through the lens of sharing songs in the music industry, but the principle applies to today’s sharing economy.

Categories
Thoughts

Short Codes (aka Messages & Two Factor Authentication from Random Five to Six Digit Numbers)

There are some cool new security features in the latest versions of iOS and Android to help you keep your accounts secure. Android’s updated Messages app and iMessage in iOS 12 both bring simplified one-time passcodes and two factor authentication (2FA) management.

iMessage – iOS 12

iMessage Security code AutoFill
Security code AutoFill. SMS one-time passcodes will appear automatically as AutoFill suggestions, so you never have to worry about memorizing them or typing them again.

 

Android Messages

Copy one-time passwords with one tap
Copy one-time passwords with one tap
Now, when you receive a message with a one-time password or code from a secure site—such as your bank—you can save time by copying that password directly from the message with a tap.

 

With both Apple and Google updating their messaging apps to ease use of text message (SMS) based two factor authentication, I’ve been thinking about why copying a verification code is the feature we need to bring more people to use 2FA. While cutting down steps required to use 2FA will make for a more streamlined experience, there seems to be an opportunity elsewhere to improve general usability of SMS based 2FA.

Understand there has been plenty of discussion regarding the security risks of these features, but putting aside discussion of the entire 2FA ecosystem and the shortcomings of SMS based 2FA, let’s look at a quirk of how people experience 2FA on their phones.

An example

Android Messages two factor authentication shortcut

Take the Capitol One notification from this article discussing the “copy 2FA code” feature in Android Messages. The message from number 227898 says “From Capitol One” and provides a code: 939966. There are two things we need to figure out here. One, that this is in fact the message from Capitol One, and two, this message contains the 2FA one-time passcode we need to complete the log on process.

First off, while the message says it’s from Capitol One, we know from our phishing lessons that we shouldn’t use the content of a message to influence our trust decision making process. The timing of getting this message in relation to attempting to log in to a bank account would make it seem like the message is legitimately from Capitol One, but how can we be sure? What is that 227898 number? Can we look it up like a phone number to verify it is registered to Capitol One?

The second bit of confusion is recognizing the 2FA verification code is 939966 not the big bold 227898 number at the top of the message. Usually the distinction between sender and message is clear with a regular 10 digit phone number or a message from someone in your contact list, but when you are sent a six digit code from a six digit number you need to do more mental processing choose the right number. Google has partially resolved the issue by giving an explicit action to copy the 2FA code, but it feels a little strange not being able to see the actual code in the message.

An aside

Slightly off topic, but while researching YubiKeys (after listening to Scott Hanselman’s podcast with Sarah Squire), I came across Two Factor Auth which maintains a list of sites that support, well, two factor auth. Exploring the various service, I noticed very few banks support usb hardware tokens. Wells Fargo seemed the only big bank with support. Clicking though the WF link from the Two Factor Auth chart, I ended up on the Advanced Access page trying figure out how WF does U2F. It turns out they use RSA SecurID (not usb U2F) which was uninteresting, but the footnote caught my attention:

We always send our text messages from 93557. Incoming calls with an Advanced Access code will come from 1-800-956-4442. We recommend adding these numbers to your phone’s address book so you can easily identify our incoming text messages and calls.

via Wells Fargo Advanced Access

Is this really the case? Every Wells Fargo communication and two factor authentication message comes from 93557? What’s the significance of 93557? And does every company always use the same number?

If so, this is a fantastic piece of advice buried in a random support page

We recommend adding these numbers to your phone’s address book so you can easily identify our incoming text messages and calls.

Why doesn’t every company and service mention this?

An investigation

To figure that out, I first needed to learn what that 5 digit non-phone number is really called. Naturally, I went online and searched “what is the number for two factor sms?”

This article from The Verge was at the top: Facebook admits SMS notifications sent using two-factor number was caused by bug

Not what I was looking for, but at least a clue.

Facebook uses the automated number 362-65, or “FBOOK,” as its two-factor authentication number

So these numbers have some T9 significance (remember landlines and flip phones?).

I figured that if facebook’s number is known, maybe there are some resources that include more of these numbers, so I quickly searched 362-65 and got 297. 😑

After getting rid of the minus sign, there was this Facebook Support link with people confused after receiving a random text seemingly from Facebook with a link to “fb.com”, a non-“facebook.com” website (here’s another example).

They are right to be concerned.

A little more searching, and boom: short codes

Short Codes

Is this a name people knew about? It’s the first time I came across the phrase “short code” even though I have been using the things for some time now.

It turns out there is an official US Short Code registrar run by CTIA and icontectiv:

Short Code Registry

Short Codes offer marketers unique opportunities to engage their audiences via text messaging. Short Codes are five- or six-digit codes that may be personalized to spell out a company, organization or a related word. Many organizations may choose to use Short Codes to send premium messages, which may charge subscribers additional fees for informative or promotional services such as coupons or news updates.

The Short Code Registry maintains a single database of available, reserved and registered short codes. CTIA administers the Common Short Code program, and iconectiv became the official U.S. Short Code Registry service provider in January, 2016.

For more information, please see the Short Code Registry’s Best Practices and the Short Code Monitoring Handbook.

The iconectiv site routes to https://usshortcodes.com/ where you can learn all about registering, case studies, and best practices. But I still want to know how to verify the sender of that 2FA message.

This is where US Short Code Directory comes in.

The U.S. Short Code Directory and the team at Tatango has assumed responsibility for the indexing of these unique phone numbers, creating the industry’s only public address book.

via https://usshortcodedirectory.com/about/

What do you know, the first code in the directory: Facebook, 32665. But wait, that’s not what’s listed in the Verge article… That’s 32665 vs 36265. Not sure what the deal is there, but may be a typo by The Verge (3-F, 2-B, 6-O, 6-O, 5-K in T9).

Just for a sanity check, does the Wells Fargo short code match their Advanced Access list? Yep! And so does the Capitol One code.

Cool! We figured out a way to verify the sender of SMS based 2FA! Remember though, this does not only apply to 2FA, but also other SMS based communication from the company.

Short Codes in the Wild

Check out this recent Wells Fargo ad on YouTube.

Wells Fargo account alert text message from YouTube ad

At the 17 second mark the narrator mentions “alerting you to certain card activity we find suspicious“. How do they do this? By SMS of course. And what number is the alert from? 93733!? NOOOOO! That’s not 93557.  WF was so close. Missed an opportunity to tie everything back to that random support page. The ad has a caveat “Screen images simulated”, so ¯\_(ツ)_/¯. For what it’s worth the phone number to call is in fact for WF Customer Service.

Questions, Concerns & Opportunities

This feels like the tip of the short code iceberg and I still have a lot of questions. How long do short codes last? Do companies change numbers? Can short code be reused? Can I trust that the next time I receive a message from a short code number that it is from the same company as last time? Can messaging apps label the code like caller id?

I don’t have all the answers, but there are definitely more things to be done to help fight the next generation of phishing. As more companies continue to recommend 2FA and send updates over SMS, we need tools in place to ensure we can trust the messages we receive.

Wells Fargo’s advice to add their numbers to your address book is good, as long as the short code (and normal telephone) numbers do not change over time. While it may be uncommon, it is possible for companies switch numbers, and (possibly more common) previously used numbers can become available for a different company to re-register. In the former, people will see an unknown number seemingly masquerading as a service they do use, which should be a cause for suspicion (although benign). For the latter, people will assume trust in the content from number they recognize (creating a phishing opportunity). While instances of these issues may be unsubstantiated (there’s very little info on how short code numbers change hands and “Best Practices” are all about marketing), this is a reason to have service driven trust management keeping track of ownership and identity.

There is an opportunity for services like US Short Code Directory and tatango to provide access to their index of short codes, so companies like Apple and Google can continue to improve their messaging services. If the Short Code Directory had a public API to query and verify short codes, messaging apps could implement a new style of caller id (essentially a DNS for SMS, but not this) to let you know the message from 227898 that says its “From Capitol One”, is legitimately from Capitol One.

At the end of the day, it should be easier to stay safe online, even if improving short codes are just an obscure part of the solution. Now to see if I can get Wells Fargo and The Verge to fix their typos.

Popular Company Short Codes

Disclaimer, I have not received messages from all of these numbers, so I cannot verify their legitimacy nor comprehensiveness. Given the issues noted above, these numbers may change or companies may start using additional numbers for SMS communication (Google already has at least 5. They may consolidate or add another).

Facebook: 32665 and 3266

Twitter: 40404

Google: 22000, 23333 and others

Apple: 272273 and others

Microsoft: 365365, 51789 and others

Amazon: 262966, 58988 and others

Capital One: 227898 and others

Chase: 28107,  24273 and others

Wells Fargo: 93557 and others

Bank of America: 73981 and others

American Express: 25684 and others

Intuit: 75341 and others

Discover: 347268 and others

PayPal: 729725777539

Venmo: 86753

AT&T: 88170, 883773 and others

Verizon: 27589 and others

T-Mobile: 37981

FedEx: 37473 and others

USPS: 28777 and others

Walmart: 40303 and others

Twilio: 22395 and others

Uber: 82722289203

Additional Reading

Categories
Thoughts

Economics of driving the Tesla Model 3

Long exposure photo of car lights on a highway at night

So I test drove a Model 3, and I have some thoughts.

Backstory

I feel like everyone has a story about when they got interested in Tesla. For me it was summer of 2012 just before the official release of the Model S. I was at Coit Tower in San Francisco and on the way back to the parking lot when I noticed a black Model S. I don’t remember how I’d heard about Tesla, but when I saw the car that day I remember doing a double take after realizing it was a Model S. Seeing it was so unexpected, but the thing was the coolest gadget: an all electric car with a giant touch screen. From that moment on, I wanted one. The only problem, the price tag was prohibitively expensive. (I settled for buying a few shares of stock in the company, yet not enough to afford a car now)

So six years later, the Model 3 is rolling out to the general public with the allure of a $35,000 Tesla. Still all electric with a giant touch screen, plus crazy features like autopilot no one would have imagined to be possible back in 2012.

Before the test drive, I had never been in a Tesla on the road let alone driven one. I was purposely avoiding the car knowing I would want one even more after I went for a test drive. But TL;DR, surprisingly that wasn’t the case. I’ve spent so many years thinking about the economics of owning a Tesla while listening to others talk about what the cars are like to drive and own. When I got to actually drive the Model 3, I already had my expectations and mind set on not buying one. I tend to be pretty frugal, and try to be rational about buying things that I really need instead of overspending on cool things that are just for fun (looking at you DJI Mavic…), so I knew going in that the car would be a blast, but an unnecessary purchase for me at this time. Maybe a few years down the road, when my current car starts to show its age and EV costs have been subsidized further by increased production, I’ll finally be ready to get a Tesla. For now, driving a Model 3 was just a fun thing do on one hazy Sunday morning.

Test Drive Experience

I signed up to test drive the $55,000 model with long range battery and dual motor. I specifically did not want to try the upgraded performance model because it was out of my price range (even more so than the mid tier model), and I didn’t want my first impression to be with the highest end model. The test drive started out with a warning that someone had backed the mid tier model into a wall, so we’d be driving the high end performance model. (Um, how does that happen? Aren’t all the cameras and sensors supposed to be able to prevent such a thing from happening? My question went unanswered and we hopped into the car.)

I immediately realized there would be a steep learning curve to understanding the controls. The first thing I usually do when setting out to drive a new car is adjust the mirrors (as I try to be a good driver), but there is no dial on the driver door panel. It turns out you have to tap the “car” button in the bottom left of the screen to bring up the controls menu, but without the sales associate to point me to the menu, this would have been a complicated task of searching through menu options.

Settings & controls

I could see myself sitting in the car for 30 minutes to an hour just figuring out what it can do and customizing it all to my liking. A Tesla feels like a gadget and tries to bring the simplicity of a smartphone design to a car. It works to an extent, and definitely would take time to get used to. When I found myself wondering if there was a setting to adjust the rearview mirror, or if I could just reach up and do it manually, I knew I was a bit overwhelmed by all the changes to the controls. Luckily, the controls for seat position adjustment are still on the side of the seat, so some of your muscle memory may still transfer over. It’s just hard to tell when that’s the case.

Steering

I drove the 3 out of the parking lot, the first thing I noticed was how heavy the car felt and the weight of the steering. The car feels strong, big, and solid. Turning the wheel takes effort, but not an absurd amount, just enough to give you firm sense of control. I wonder now if this is another setting Tesla programs into the car. Could there be a “light” steering mode that reduces the tension in the wheel? I don’t know why they would do such a thing, but it seems possible.

Turn signals are confusing.

Because the controls are reduced to a wheel, two stalks, and a screen, many of the controls act differently than a normal car. The turn signal for example always returns to the center, which is confusing because for all the car’s I’ve ever drive, a turn signal in the center position means its off. Pushing to the up or down position will turn right or left. I learned there is a short and a long press to the turn signal stalk, but I didn’t figure out exactly how it worked. All I know is that as long as you ignore the fact the stalk always returns to the middle position, you can signal for starting and completing turns by pushing up or down the same way you would on any other car. The 3 is even smart enough to recognize when you’ve completed a turn, but in some cases when I put the signal on too early, the car decided to turn the signal off before I even made it to the turn.

Blast off

The Model 3 goes 0 to 40 goes by in a flash and you don’t realize how fast you’re going because it happened so quickly. Just to reiterate, I was trying the Performance upgrade, so the pick up probably won’t be as powerful on lower models, but the immediate feedback and roller coaster feel, should be transferrable. There was a car ahead as I merged onto the highway, so instead rocketing by at the last minute, leaving the car in of in a cloud of dust, I decided to play it safe and drive like a normal person.

Enhanced Autopilot, lane keeping, and distance control

The vision system gives the Model 3 a super cruise control mode. In addition to maintaining speed, the car will help you stay in your lane if you start to drift, and keep the same distance between the car in front of you whether the car speeds up or slams on its brakes. Tesla notes, “Enhanced Autopilot includes additional driver assistance features. Every driver is responsible for remaining alert and active when using Autopilot, and must be prepared to take action at any time.”

Full Self-Driving Capability with hands nearby and automatic lane changing

This was just nutty. Pull down twice on the right stalk to engage full self driving mode, and you can take your hands off the wheel as the car drives itself. The same lane keeping and distance controls apply to the full self-driving mode as they do with auto pilot, but now they are the sole means of maneuvering the car down the freeway. I (eerily) quickly grew accustomed to the car driving me as we stayed in the same lane, but the craziest part is changing lanes. Simply pull down or push up the left stalk to let the car know you want to turn left or right. The car determines the lane is clear and moves on over. It’s wild. We’re not quite at the point of removing the steering wheel, but this still feels like the future. Again, Tesla includes a disclaimer, “This functionality is dependent upon extensive software validation and regulatory approval. It is not possible to know exactly when it will be available, as this is highly dependent on local regulatory approval, which may vary widely by jurisdiction.”

Other Tesla and EV specific things

Hold mode puts keeps the car in place when you push in the break all the way at a stop. Creep had to be programmed in because EVs do not inch forward in the same way a gas engine does while idling. Unlike a cell phone or laptop which has charge limiters for batteries, you have to set the max charge for a Tesla (~90% while city driving, and 100% for long road trips). Avoiding a full charge helps keeps the battery in good condition for longer.

Features & Pricing

The whole point of the test drive is to make a decision about buying the car, right? So what configuration do you want to get? Most of us bought into the allure of a $35,000 Tesla when the Model 3 was announced two years ago, but we still aren’t quite there yet.

Base configuration Model 3 available in 5 to 8 months

This is all brilliant marketing by Tesla to lure you in with the $35,000 option, anchoring your first impression of the car to a lower price, while only selling configurations that can cost upwards of double the base price for the next 5 to 8 months (as of late August 2018).

So the $35,000 (or $27,500 when considering the $7500 credit) you were expecting to pay immediately goes up by $14,000 for the Long Range model with rear wheel drive. Want Long range and Dual motor? That’s another $5000 or $19,000 over the price of the base model. You could buy one Model 3 or three cars for $54,000, and that doesn’t even include the “cool” Tesla features like Autopilot or Full Self-Driving mode add-ons (for an additional $8000). At the high end, the Performance model can cost up to $80,500. How is that affordable?

A formative view for my understanding of the value of the Model 3 came from Mr. Money Mustache. He thinks about buying a Model 3 while considering cost-per-use in relation to the base $35,000 model and upgrade options.

“I’m thinking of springing for the $9000 long-range battery in my upcoming Tesla Model 3 order” – this one strikes straight at my own heart, because I crave a long range Model 3 myself. But even for a serious roadtripper, this works out to $125 per hour of charging time that you manage to avoid. Aren’t you willing to take a few minutes occasionally to walk around and admire your beautiful car if you get paid $125 per hour after tax for it? If you are, standard range will do.

Calculations:

Tesla Battery Upgrade: The only time you use the longer range is on roadtrips over 230 miles. If you do a 600-mile trip once every month, you have to make two extra 30-minute charging stops per month. Figure the $9000 battery costs you about $1500 in extra capital cost and depreciation per year, or $125 per month. However, if you are a Tesla fan like me and you want the company to make more profit to continue their mission, you may still opt for the extra options since you have nothing better to do with that money anyway.

All wheel drive car: if the car costs $5000 more up-front plus an extra $200 per year in fuel and maintenance, you could estimate it as about $500 per year more expensive to own. Then, how many times do you truly get stuck in a front-wheel drive car with really good dedicated snow tires on winter rims? (because snow tires always come before buying AWD!)

via MMM The Twenty Dollar Swim

If you are trying to decide to buy now or wait, a commenter brings up a valid point: “Getting the larger battery gets you the full $7500 tax credit, getting the smaller battery likely doesn’t.” This is because Tesla’s US federal tax credit will expire at the end of 2018. The lucrative $7500 will only apply to vehicles delivered (not ordered) before December 31, 2018. Afterwards the credit will decrease by half and expire at the end of 2019.

Let’s consider how this pricing scheme came to be because it all seems a bit out of proportion.

Upgrade Perception

Before we get into Model 3 pricing, first think about what you get by upgrading from public transit to a car (of any kind), then move to what you get for the base line Model 3 and above.

Owning a car is a luxury allowing you to move around on your own time and optimize the routes you drive. You don’t have to adhere to bus schedules, try to find rides with people, or spend time going out of your way. A car takes a psychological load off your mind that gives you the freedom to engross yourself in your work without ever worrying about rushing to make a bus that leaves in the next 5 minutes. In many places a car is not a necessity, but it can be a quality of life improvement.

On the other hand, not owning a car has its upsides. For one, there is a significant cost savings when factoring paying for a car, insurance, gas, tolls, parking, and maintenance. It’s not unreasonable for owning a car to cost upwards of $10,000 a year (with a rough estimate of $400 a month for loan, $250 for parking and tolls, $150 for insurance, $150 for gas). Plus, you can get a lot done on the bus/train/taxi when you aren’t the one who must be engaged behind the wheel.

Ok, so for any car you decide to go with (or not) you’ll have to weigh these pros and cons. Driving a Tesla does not magically change the dynamics of owning a car any more than driving a Subaru does (yet. We’ll have to wait for advancements in autopilot and changes to regulations). If owning a car is a luxury, owning a Tesla is an opulence.

Let’s say you’ve decided against the advice of the Millionaire Next Door and are in the market for a new car under $50,000. What would persuade you to upgrade from a $35,000 Model 3 to a more premium package?

The Model 3 is a curious case of behavioral economics. It is more common for car brands to price multiple models across a $35,000 to $80,500 price range with visibly distinct prestige of owning a higher end car. Just look at the BMW line-up, they (logically) use a numbering scheme that increases with perceived prestige. For the Model 3, the body looks the same for all price configurations of the car, the only distinguishing factor is the tires (and this little badge on the back). Is it any wonder why the upgraded wheels cost an arm and a leg? It’s how you show you got the nicer car. Tesla is not the only company to do this. Apple is a constant offender, tweaking iPhone design to show make newer models easily recognizable, and adding a big red dot to their latest and greatest watch.

This makes business sense. For a company to make the most from its high end customers in order to subsidize lower end products is nothing new either. Apple also does this with the iPhone and Mac in regard to spec upgrades. The build quality, apps, OS, customer support, and general Apple ecosystem are all the same no matter of the type of iPhone or Mac you decide to purchase.

The majority of Apple’s margins come from upgrades that cost them a tens of dollars that they sell to you for hundreds (or thousands).

There’s nothing inherently wrong with this. It’s how Apple continues growing even with a trillion dollar valuation.

when you raise prices and a segment of your customer base will only buy the best, you can achieve higher average selling prices — over $100 higher year-over-year ($796 versus $694) — which means higher revenue.

Charging its best customers more for iPhones wasn’t the only reason Apple’s revenue was higher, though: remember that Apple is making more off of every customer over time via Services. And there is one more piece: Apple is selling its best customers more and more devices.

Apple’s Middle Age via Stratechery

And Tesla is doing the same thing. The baseline $35,000 Model 3 gets you the same build quality, software upgrades, autopilot hardware, customer service, brand prestige, and roller coaster acceleration. Higher margin cars will subsidize the more affordable models at larger scale, they even called it out as their master plan ten years ago:

  1. Build sports car
  2. Use that money to build an affordable car
  3. Use that money to build an even more affordable car
  4. While doing above, also provide zero emission electric power generation options

Tesla’s Master Plan

However, making business sense does not absolve companies of the psychological manipulation they employ with these pricing strategies. By singling out the one feature you get for a disproportionately large amount of money over the cost of the base product, companies frame upgrades to make you forget about all you get when you initially decide to opt for their product without the extra bells and whistles. Just look at the similarities across the iPad lineup. If Apple only pointed out the commonalities, people would question upgrading, so Apple makes the differentiators big, bold, and right at the top.

Whether you just have money to spend and only settle for the top of line, or have been saving for years only to wait a few months longer, consider the return on investment when spec’ing out a Model 3 (and anything else you buy). Maybe you ski every day and need all wheel drive, or live so far away from charging station that the larger battery is a must, but if that’s not the case for you, is the baseline good enough? After all, you’re still getting a Tesla.

So buy now or wait?

This totally depends on your budget. For me, I’ve had my current car for three years, and plan to keep it for at least 10. If you need a new car right now, and are looking at a Tesla, maybe this helps to think more rationally about the purchase. A used Chevy Volt is a decent alternative that checks many of the same boxes as a Tesla.

And if you’re set on a Tesla, just consider if driving down the highway knowing you’re safe with your hands off the wheel is worth $8,000, It is fun to be an early adopter, but why not let others subsidize your cost a bit? Are you going to buy one of these?