Mobile Design Predictions for 2017

It’s hard to believe it’s almost here – 2017. We’re launching a year with a new president, the Cubs as World Series champs, and mobile apps and sites top of mind for every organization.

Mobile as a platform has been around for years, and yet each year, just like the web, there are advancements and changes that need to be taken into account as new products are developed, and old ones are updated. We’ve pulled together 10 of the top mobile design predictions for 2017.

 

1 – Mobile First Search Indexing

Google’s search algorithms have, until now, always used the desktop version of websites to catalog and rank pages. But no longer. Google will move to indexing against mobile sites, first. And this isn’t a surprising move on their part considering in 2015 we reached the tipping point – over half of searches are now done on a mobile device. Responsive and dynamic sites won’t have anything to change, but sites that serve mobile customers differently will need to consider making some changes to keep up.

2 – Failure mapping

User experience designers have gone from mapping user paths to mapping user experiences to mapping a user’s journey. In 2017 you’ll see new mapping coming from your UX department – failure mapping. Current mappings show what happens for the ideal user – the one that follows the set path or paths. But what happens to the user that strays from the defined path? Failure mapping makes sure that users that follow non-ideal scenarios will still have a good user experience.

 

3 – Haptic Feedback as part of the interface

Haptic feedback is that tactile response you get when interacting with your smartphone or tablet’s screen. With the increase in high end devices available, and the decrease in the cost of the technology that enables this kind of feedback, interaction designers working on mobile devices now have a new palate to play with – the sense of touch. What you’ll see in the next year is apps and sites that subtly direct the user to toward positive reactions, like clicking the Add to Cart or Checkout buttons on an eCommerce site.

4 – Skeuomorphism

At its simplest, skeuomorphism can be defined as a design style that mimic real-life. Books on a webpage look like real leather, 3D objects cast shadows, knobs appear smooth. This may seem like a design decision, but for the user it’s much more. Because the objects in skeuomorphic design look like objects in our day to day lives, they direct the user and clue them into the object’s use without the need to call out the purpose of the control. And since mobile doesn’t have an abundance of real estate, anything that helps the user divine the purpose of a control leads to a superior customer experience.

 

5 – Non-linear experiences

In the early days of mobile applications, all users were novices. We needed handholding. Many mobile sites and applications catered to this, driving users in a single direction with simplified user interfaces and linear paths through the experience, like an old side scrolling video game. But users don’t look at mobile experiences as dumbed down desktop sites any longer, but instead as a first stop. Like modern video games, mobile interfaces in 2017 will become more sophisticated and less linear to meet user expectation and more closely mirror how they operate in transactional situations.

 

6 – Animation

Advances in mobile languages like HTML5, CSS5 and JavaScript libraries make animation in mobile experiences a reality. This means that, like haptic directives mentioned above, interaction designers can use subtle animations to help direct user behavior in positive ways. The inclusion of animation also helps to provide a richer user experience, engaging the user more deeply in the application.

 

7 – Increased Use of Video

The past few years has seen an increase in the use of video as part of website design. We’ve moved beyond hero images and have increasingly changed to hero videos on landing pages and as part of page headers. Traditionally, though, mobile pages have veered away from this practice. But consumers crave video content. Hubspot predicts that 79% of Internet traffic will be video based by 2018, and 59% of executives would rather watch a video than read text. And with YouTube reporting 100% increase, year over year, in mobile consumption, the small screen isn’t a deterrent to users viewing video.

 

8 – Advances in Alternative Payment and mCommerce

Alternative payments – everything from Paypal to Apple Pay – are natural resources for consumers shopping on their mobile device. And shopping on mobile they do – mobile purchases are now 42% of all online orders. Consumers are looking to reduce friction in their mobile purchases, and alternative payments like Apple Pay, Android Pay and Samsung Pay, help them do that by limiting the information that needs to be entered to buy something. Making payments, and therefore purchases, easier will only lead to increased revenues for mobile commerce.

 

9 – Age and Ability Responsive Design

There are a wide range of users turning to mobile devices. Some are technically savvy and can find their way around the most convoluted and user-hostile interfaces (although they shouldn’t have to). But others are novices – as older users pick up their phones to browse with and children engage more and more with tablets, there becomes a wider range of user experiences that need to be addressed. Some apps clearly have a defined audience and don’t need to adapt. But other, more general use mobile experiences should to cater to users of varying experience levels. By examining a user’s actions on a site, age and experience can be inferred. With machine learning and predictive analysis, user experiences can be adjusted to respond to the perceived age and experience of the user, dynamically.

 

10 – Increased use of microinteractions

Microinteractions are those tiny, in the moment actions that users take that are meaningful right then. They are single purpose actions – liking a page, logging into a site, changing a setting. Google goes beyond the use of microinteractions to call out micro-moments; those moments when a person turns to something like their phone to watch a video, buy something, or look something up. These moments are like tiny pieces of the user journey, and when put together paint the whole picture of a user’s path to purchase, from awareness to conversion. In 2017, we’ll see an increase in the implementations that take advantage of these moments – from NFC alerts for sale items while in a brick and mortar store to prompting a purchase when searching for movie tickets.

The post Mobile Design Predictions for 2017 originally appeared on the Curotec Blog

We’ve Moved! – Curotec Now at the Radnor Financial Center

As our business has grown so have we, and the time has come for a new address. Curotec has moved to the Radnor Financial Center, just off of Lancaster Ave.

This new space isn’t far from our old offices, but the additional space gives us room to grow. Plus, the view isn’t bad, either. Located in the Main Line, our new offices are in the middle of some of the most beautiful and historic homes in the Philly suburbs.

Here’s where you can find us, now:

Radnor Financial Center
170 North Radnor Chester Road
Suite 150
Radnor PA 19087

The post We’ve Moved! – Curotec Now at the Radnor Financial Center originally appeared on the Curotec Blog

Workplace by Facebook Takes Aim at Competition

Last week Facebook publicly released their new enterprise collaboration platform, Workplace. Referred to as Facebook at Work while in
beta, Workplace is the newest entrant into a growing lineup of platforms intended to help teams communicate better, more frequently and more completely.

But what exactly does Workplace provide for enterprise users? And is it really any different than all of the other platforms available?

What is Workplace?

The short version of that answer is Workplace is a collaboration platform. But just like the other residents in that space, that really doesn’t
mean much out of the context of the application.

Like other collaboration platforms, Facebook’s intention with Workplace is to give teams an alternative to email and meetings; a place where they can discuss projects, ask questions, get answers and connect with other team members via chat, messages and live video. Most of those things are already features Facebook provides for their 1.71 billion user audience on their public platform. But Workplace is different.

Is it Secret? Is it Safe?

To begin with, Workplace isn’t public. In fact, it’s very not public. Access is restricted to your company alone (although, as we’ll see in a moment, there is functionality that allows you to work with other companies). Workplace is a completely different platform from Facebook, which means there is little possibility of accidentally posting your company secrets for all of your friends to see. This is part of the reason that Workplace took so long to come to market – despite the family resemblance, the platform was built from the ground up to be separate from Facebook.

Workplace even looks different than its public sibling, with more muted colors. There are also no ads on Workplace, which makes all of us using Facebook more than a little jealous.

This separation from the public platform and differentiation in look and feel answers a big concern by a lot of companies – namely, you don’t need to worry about your employees using Workplace as a cover for spending their days on Facebook.

 

Peeking Behind the Curtain

Despite being a completely different platform, Workplace leverages a lot of the same features found in Facebook. So those familiar with the social media tool will find a lot here that feels like home.

Workplace has a Newsfeed, chat messaging, and live video. You can also make voice and video calls to others in your organization through the platform. Reactions, such as liking a post, were also brought over from Facebook.

No enterprise is an island, and Workplace takes that into account. Not only can people in your organization create groups around a specific subject – like a project or product – they can also share those groups with other companies outside of your organization that are also using Workplace. This makes collaboration with partners and vendors much easier.

Being a multinational enterprise themselves, Facebook recognizes the global nature of business. To facilitate work groups that can span miles and languages, Workplace has automatic translation built in to the application.

 

How Does It Compare?

So let’s get down to the real question – why should you consider Facebook’s Workplace product when there are so many existing platforms that are well established in the space? As with all enterprise applications, it comes down to what your needs are – each of the tools is the best choice in different circumstances.

But here are a few places where Facebook can be (favorably) compared  directly to a couple of the biggest gorillas in the room – Slack and Saleforce’s Chatter.

Slack vs Workplace

Leaving aside for a moment the discussion of price and subscription model, the biggest difference between Slack and Workplace is the integration of apps and services. At the moment, Slack allows for the integration of outside applications (on a limited basis for the free model, unlimited for paid subscriptions). This includes integrations for project management apps like Trello, application performance like New Relic and even a host of Zoho apps, like Subscriptions, Events and Invoices.

Workplace, on the other hand, has no such integrations. But there are plans to change that. Workplace is already talking to Deloitte, Okta and TBWA regarding integrations. The plans are to partner with outside apps for the areas where Workplace is lacking capabilities and features, such as document storage and collaborative editing. Basically, Workplace doesn’t want to re-invent the wheel. They just want to give it power steering.

Chatter vs Workplace

The comparison between Workplace and Chatter is an interesting one. Chatter, as part of the Salesforce platform, is one of the longest standing and most mature of the collaboration platforms. Because of this, Chatter is hard to beat – the features are well designed and vetted, the integrations already exist and there is an entire marketplace of Salesforce add-ons available.

But where Facebook comes out on top in this comparison is exactly where they planned to. Because Workplace uses the same functionalities and features as the public platform, there are few people in the world who don’t already know how to use it. Almost no training is required.

Between being an interface already so familiar to many and having mobile applications available for Workplace at launch, it’s a no-brainer for use by employees who aren’t desk jockeys.  Field agents, maintenance staff and even retail employees can rapidly come up to speed and participate in the corporate conversation without taking hours away from their work to learn a new system.

 

The Biggest Difference – Cost

The differentiator that Facebook is really counting on is price. It’s pretty clear that Facebook would rather have you using Workplace than worry about making a profit at the moment.

Their subscription model, after the 30-day free trial, is only $3 per active user for up to 1,000 users. From there and up to 10,000 users, the rate drops to $2. At 10,001 and above, the price is only $1 a user. For educational institutions and non-profits, Workplace is free.

The active user piece is of note, as well. To qualify as an active user, and for Workplace to bill you for that user, they must have logged in at least once during the month. The intent is to keep Workplace on their toes. If the platform doesn’t work, no one will log in and use it. If that happens, well, Facebook doesn’t get paid.

This subscription rate and structure is substantially different than either Slack or Chatter.

In Slack’s case, they operate on a freemium model. Restricted accounts are free, but for paid accounts, the prices are higher than Workplace. For a standard account, Slack is $8 per active user, and $15 if you want features like SSO and uptime SLAs.

Pricing for Chatter isn’t quite as upfront as that of Workplace. With Chatter, you can get a company of up to 5,000 people on the platform by purchasing a single CRM license, which according to their website starts at $25 per user a month for up to 5 users. With that you get something equivalent to Workplace – messaging, status updates, activity feeds, plus things like file sharing. But to get the full suite, including the integrated apps, reporting and so forth, it’s $15 per user.

If you have a small team that will access the CRM features, Chatter might be more attractive than Workplace for your organization. But for smaller teams that won’t use the CRM features, the price plus the training needed to use the platform to its fullest may be higher than you’re willing to pay.

 

As we said earlier, your organization’s needs will drive the choice of collaboration platform best suited to you. But with Workplace entering the market, expect to see some jockeying for position from even the bigger names in the space. Once a heavy hitter like Facebook steps on to the field, all bets are off.

 

 

*None of the comments or comparisons in this column should be deemed a recommendation of a specific product or service.

The post Workplace by Facebook Takes Aim at Competition originally appeared on the Curotec Blog

7 Steps to Adding Ecommerce to Your Business

As a business owner, you likely already have a website. You promote your business there, provide information, probably even have a contact us form. But if you sell products and don’t have an eCommerce presence, you’re missing out on a huge opportunity as well as some serious revenue.

Earlier this year, Forrester Research reported that online sales will increase from $335 billion in 2015 to $523 billion by 2020, with 270 million shoppers browsing and buying online. Without an online shopping experience for your business you’ll miss out on the opportunity eCommerce presents.

In this first post in a series of three, we’ll outline at a high level the 7 things you need to do to add eCommerce to your existing business. In the next two posts, we’ll talk about integrating eCommerce with your existing legacy systems and finally we’ll detail the importance of having a mobile shopping experience available to your customers.

 

Your Roadmap to Adding Ecommerce

Obviously, if adding eCommerce to your business was as easy as flipping a switch, everyone, including your competitors, would have already done it. But that doesn’t mean it needs to be overwhelming. With the right plan, some up front work and the right help, you can be up and running, successfully and in very little time.

1) Check out your competition

Whether you are a small mom & pop store or a large B2B retailer, your first step is to check out your competition online. Start by seeing if any of your known competitors have online stores. What do they sell? Do they list all of their products online, or just a portion of them? What is their web experience like? If you search for them, where do they rank?

Once you understand where your direct competition sits in the online world, expand your search to include online stores in your space. Take note of how well they present their products. Check out their design, how they categorize their products and so forth. Make notes of the sites you like best, and exactly why, so you can share that with your design and development partner later on.

2) Decide what you’ll sell online and when

You might want to start by offering all of your products online, or maybe you want to start with a smaller set of items that are most suited to your online audience. If you’re already offering all of your items by catalog, then moving those items online is an easy transition. If, on the other hand, you only offer products in brick and mortar locations, you might want to review your inventory to see if there are items you only sell to your local customers. Those products could still do well online, but you might want to wait until you’ve got the bulk of your stock available to your online audience before you add these long tail items.

3) Find the right solution for you

There is a good chance that this is the step that will be the most outside of your experience and comfort zone. But it is also one of the most critical. Choosing the right platform to display your products and provide your customer’s with the best shopping experience can be daunting. If you have software systems already in place – inventory, shipping, payment processing, etc. – you’ll want to choose a platform that plays well with them. Many shopping cart packages make it sound like it’s easy to add eCommerce to your site, and that might be true if you’re a smaller shop. But if you’re a larger company or you have many products, you’ll want a solution that can handle your business without adding more work than is needed. This may seem overwhelming, but finding a good partner to understand your needs and help you choose the right solution can make this step infinitely easier.

4) Prepare your inventory

The web is a visual place. Customers are significantly less likely to purchase items from you that don’t have a picture along with the description. You’ll need photos of all of your items that you plan to sell online. But more than that, you’ll also need descriptions of each of your products. You might be tempted, if you already have a catalog, to just use those. But you’ll want to optimize your descriptions for your online audience and, more importantly, for SEO. In addition to using keywords, your product descriptions should be persuasive. You won’t be there in person to sell the item, so your copy will have to do it for you. Hiring a photographer and a copy writer with experience in eCommerce is a good idea, as they will know how to best present your items for an online audience.

5) Check your usability

You may not know why a site doesn’t work well for you – why you find the navigation cumbersome, why the layout seems to keep you from finding what you’re looking for and so forth. But you know it when it doesn’t. Don’t drive away customers just because they don’t enjoy using your website. Make your site user friendly, not user hostile. Web and application usability is an entire discipline within IT, but you can start by using the list you made from the first item in this post to get an understanding of what doesn’t work and what does. Remember, the site isn’t about making it easy for you to find products. It’s about making it easier for your customers to do that.

6) Make sure you have the usual suspects in place

These may not seem important when you’re in the middle of building out your eCommerce division, but don’t forget to take the time to create pages for your site’s Terms of Service, Return Policies, Shipping Policies, Sizes (if applicable) and so forth. These pages may get a low number of visits but they will answer many questions that you and your customer support team won’t have to, and will keep your customers from being confused or frustrated when it comes to returns or knowing when their items will arrive.

7) Be ready to support all your customers

Your customers will come to you from all over once you are online. They will also come to you using different browsers, from different screen sizes and on different operating systems. While you don’t need to support every browser ever built, you should be sure your eCommerce site works on the top three or four (as of the writing of this article they are, in order, Chrome, Firefox, Internet Explorer and Safari). We’ll talk about it more in our third post in this series, but you’ll also want to make sure your eCommerce site supports mobile users, including tablets and phones.

In our next post, we’ll talk about integrating your eCommerce solution with your existing legacy systems, so you don’t have to rework everything before you start down the path to online sales.

The post 7 Steps to Adding Ecommerce to Your Business originally appeared on the Curotec Blog

Your iPhone is at Risk – Apple Releases Critical Update

Apple released a critical update on Thursday, August 26th, to address a series of flaws in the iPhone 6. The flaws, while individually of little concern, combined to allow hackers to remotely jailbreak the iPhone.

The vulnerability was discovered and reported to Apple about a week and a half ago, after a United Arab Emirates human rights activist was targeted by the attack. Ahmed Mansoor reported the issue to researchers at the University of Toronto’s Citizen Lab, who in turn found and reported the issues to Apple.

Mansoor received a text message containing a link. Following the link would have installed a program that would have allowed remote access to his phone, thanks to three previously unknown flaws in the iOS operating system. Once installed, the hackers would have had access to a number of iPhone services, including being able to control the camera and listen in on conversations using the microphone.

The spying goes beyond those services, however. Once the exploit is installed, hackers have access to the location of the phone and can listen in and record conversations. Even apps using end-to-end encryption, like Whatsapp and Viber, would be subject to access. Additional assets at risk include stored photos, files, and messages in mobile chat apps.

As the number of features available on smartphones increase, so do the number of potential risks. Each of the flaws in iOS flew under the radar – Citizen Lab stated they believed these flaws to have been part of the OS since 9.3.3 or before. (iOS 9.3.3 was released on July 18^th, 2016.)

It was the combination of several flaws that enabled the creation of the larger – and far more dangerous – exploit.

At this time the reported cases are limited to Mansoor, a Mexican journalist and a minority party politician from Kenya. But now that the flaws are known, it is only a matter of time before the larger community attempts to use the security hole on a larger scale.

This is why it is critical that iPhone users ensure they update to the new patch, version 9.3.5. With the smartphone becoming the holder of our credit card information and other personal data, anything providing unfettered access to your phone is a major concern and an opening for identity theft, credit card fraud, and even, with this current issue, corporate espionage.

In 2015, there were over 94 million iPhones in the hands of users. Many of these are in use, on a daily basis, by executives and leaders in enterprises across the country, and the globe. With an unpatched iPhone company files and messages could be harvested from your phone. Even meetings could be eavesdropped on with a compromised phone using the device’s mic.

And this goes beyond executives, to all levels of the organization. It is critical for your IT security teams to encourage all iPhone users, whether issued by the company or not, to update their phones.

Consider having your security teams send an organization-wide message alerting users to the threat and including simple instructions on how to apply the update to their phone. Also, remind your users about good security practices. Reinforcing messages should be an important part of your enterprise security training, especially when the opportunity to do it in the context of a real world example presents itself.

One last note. As of the time of this writing, the vulnerability has not been found in iOS 10 beta. So an alternative is to upgrade to the new OS. But because it is still in beta, the usual caveats and cautions for early adopters apply.

The post Your iPhone is at Risk – Apple Releases Critical Update originally appeared on the Curotec Blog

The Basics of Domain Driven Design

Stop me if you’ve heard this one before.

A developer walks into a requirements review and after a few minutes says “But this is just like part of the application we wrote 6 months ago.”

The lead says “Can we reuse that code?”

The dev says “It would take longer for us to abstract it than to just rewrite it. It’s in there with other functionality specific to that app.”

And no one laughs. We’ve all been in this meeting, felt the frustration bubble up. The business doesn’t understand why it will take so long to build. The IT leadership is shaking their heads because we’re not able to leverage what’s already been built. And the developer is grinding their teeth at having to solve the same problem, again.

For those of us with experience and background in software development, we know this isn’t how it’s supposed to work. What happened to breaking problems down, building re-usable objects, abstracting functional layers?

There are lots of reasons good development practices fall to the wayside. Lack of understanding of the business problem, crunched timeline, and budgets are all excuses for setting aside properly engineering a solution.

Domain-driven Design would like to change that. It’s not a methodology, like Agile, or a process like RUP (Rational Unified Process). Instead it “provides a structure of practices and terminology for making design decisions that focus and accelerate software projects dealing with complicated domains.”

Like all tools, DDD has a time and a place. But when used in the right context, at the right time, and applied correctly it can bridge the gap between the business and developers and lead to efficiency in enterprise development.

What is Domain-Driven Design?

DDD was introduced by Eric Evans in 2003 in his book of the same name. In it, Evans outlines a systematic approach to understanding complex business problems and applying domain models to those problems to create organized and focused solutions.

The intent, of course, is to build better, more re-usable, more cost effective software, especially in the face of highly complex business systems. Evan’s approach enables developers to better understand the business problem and communicate more effectively with their business counterparts.

It is also intended to help developers to better size down problems and fence in what they are building. As the old saying goes, you eat an elephant one bite at a time. But thanks to the evolution of software solutions and network computing, those bites speak to modern software architecture.

As enterprises continue to adopt and adapt to software services, having an approach that maps out how to break a business need down into service, and even microservice components that become useful and re-usable. But starting with services encourages a bottom-up design.

DDD, on the other hand, starts at the top. It directs teams to create a common language with the business before solving the business problem. To understand how it does this, let’s look at the basics of DDD.

 

DDD 101

Clearly, the first thing to understand with Domain-Driven Design is to define what we mean by a domain.

The domain is, basically, the business area we’re talking about. It’s the area of the business relevant to the solution needed, and to help you define and find your domain experts.

Are you talking about a new CRM? You’ll want someone from sales. New call center software? You’ll want a call center manager. A new CAD system? Bring in an engineer.

What you want is someone with a business understanding of the problem you’re trying to solve with a software implementation. That’s your domain expert.

But a common problem with humans in general, and in business to IT communications, is making sure you are all speaking the same language. That’s where the next step of DDD comes in – creating what Evans calls a Ubiquitous Language.

This will be the cornerstone of communication for everyone who works on the project. It will define the language the team will use to talk about the project. And it will evolve and grow over time, through trial and error.

For instance, if you were asked to build a car, you might think “sports car” while the product manager means “family sedan”. So you define that, for the purposes of this project and this domain, “car” means “family sedan”.

It’s a bit of a contrived example, but you can see where not having that definition in place would lead to some costly trouble.

Once everyone is speaking the same language, developers can break down the domain into smaller sub-domains and bounded contexts. A bounded context is like a miniature application, and has its own domain.

Think of an eCommerce system. By itself, it is a context – one where people use the application to shop. But, within that context lie smaller domains, like customer information, payment processing and inventory. Each of these is a bounded context, with one domain.

There is more detail within Domain-Driven Design, much of which is outside of the scope of this article and begins to dive into more technical nitty-gritty.

But the above describes how DDD begins to handle the parts of a project with the greatest potential for complexity – what the business needs are and how to build an understanding across the team.

Breaking the project down, bit by bit, allows the teams to develop highly modular pieces of code. Code that can be re-used. Code that can be refactored without upending an entire system.

 

Benefits to the Enterprise

The greatest gains to the business for DDD come from highly complex applications and domains.

First, the organization as a whole has a greater understanding of the domain, thanks to the need to model it for the ubiquitous language and bounded context.

The enterprise also creates a common language that can be used within the context of building out the solution, but can also be carried throughout the domain and the organization.

Better code can be created because the domain experts are an integral part of understanding the problem, and the solution.

The solution is better organized and focused thanks to the defined contexts.

The enterprise gains re-usable services that can be iteratively improved and changed without taking down entire business systems.

 

Not a Silver Bullet

But DDD is not a silver bullet that will solve every issue in your enterprise.

First, it can be overkill on smaller and less complex projects, or projects with a limited life span or usefulness to the organization.

And while building a domain model can be helpful in and of itself, it isn’t DDD, but only a part of it.
Domain models are time consuming to build and require resources from IT and the business. Likely from multiple business units.

There is much effort at the start required to define the domain, subdomain, contexts and ubiquitous language. And that means greater cost to the organization, up front. With the possibility of the return on that investment being months or years down the road.

Domain-Driven Design is an effective set of techniques for complex, enterprise level software projects that will have years of life within the organization. And principles of DDD, individually, have merit for the organization that is willing to commit resources early on. But just like holding a daily stand up meeting is not the same as implementing Agile, creating a domain map isn’t the same as following DDD.

And yet, for those projects that fit the mold, DDD is worth deeper investigation as a means of bringing greater understanding and more modular development.

The post The Basics of Domain Driven Design originally appeared on the Curotec Blog

HTTPS Exploit Can Steal Your Secure Data – Black Hat 2016

IT security is top of mind for many enterprises these days. And with the announcements coming out of the Black Hat Conference that won’t be changing anytime soon.

On Wednesday, August 3rd at the Black Hat 2016 conference in Las Vegas there was an eye opening demonstration on the need for updated Internet security protocols. At a briefing entitled “HEIST: HTTP Encrypted Information Can be Stolen Through TCP-Windows”, researchers Mathy Vanhoef and Tom Van Goethem demonstrated a set of techniques that would allow hackers to listen in on secured traffic directly, without the need for an intervening network.

Used to transfer information over
the Internet, HTTP is the foundational protocol that enables communication over the Web. HTTPS uses this protocol combined with Transport Layer Security (TLS), or its predecessor, Secure Sockets Layer (SSL), to provide secure communication over the Internet. Using HTTPS authenticates the connection between a user’s browser and a web server to protect private information that is passed between the two.

One of the purposes of using HTTPS is to prevent a man-in-the-middle atttack – an attack in which a hacker impersonates each of the end points in the communication. The user’s web browser thinks it is speaking directly to the web server, and visa versa, while the messages are actually being passed through a third party. Because of the end to end authentication with HTTPS it is difficult to impersonate or even eavesdrop on the data being passed back and forth.

With the newly discovered HEIST technique, a man-in-the-middle attack is no longer needed. In fact, as described in detail in this article on Ars Technica, the user only needs to “encounter an innocuous-looking JavaScript file hidden in an Web advertisement or hosted directly on a webpage”. This code can then be used to find out information about the file sizes transmitted from TLS or SSL secured pages and use that information, combined with another attack, to tease your information out of the HTTPS encrypted responses. These could even be small pieces of data with a big impact – like your email address or social security number.

Once HEIST has the files size, it partners with other exploits to use HTTPS’s security measures against itself. You see, most websites use compression in their responses by not repeating text strings within the data. Exploits like BREACH, being discussed on Thursday at the Black Hat conference, use this information to play an intelligent game of true or false. The exploit guesses part of the string, and if it’s right, the response doesn’t grow in size. Instead, the repeated strings are removed by the compression. If it’s wrong, the compression can’t eliminate the string, and the response grows. And now, thanks to HEIST, the exploit knows the file size of the data.

The good news is that a number of tools are being released this week to help teams assess their vulnerability to BREACH. The bad news is that the only way known, at the moment, to mitigate HEIST is to turn off 3rd party cookies. These are on by default in most browsers and will cause a number of online services not to work.

Expect to see recommended changes to your applications to reduce the potential risk associated with these issues and even changes to best practices on how sensitive data is exchanged in Web response messages. With no blanket fixes, these exploits will take time and resources to mitigate and new policies outlining how you’ll handle data going forward. But ignoring the changes could be devastating for businesses and their customers.

The post HTTPS Exploit Can Steal Your Secure Data – Black Hat 2016 originally appeared on the Curotec Blog