The article demonstrates how easy it is to hijack’s someone’s phone number. And of course, once this is done, you can get the authentication SMS and get in. The article points to a solution that really makes your phone a second factor, such as the Google Authenticator application. It generates a one-time password every 30 seconds, without depending on any communication: you simply need to run the app.

But SMS-based second factor isn’t that bad, and it is definitely better than nothing, and Wired fails to tell us why:

• In the case of a big leak of a few million passwords, any second factor works to protect you against the robots who will check that the password is working before putting it for sale.
• However, it doesn’t protect you well from that guy who is chasing YOU. In that case, the SMS is definitely easier to hack than other methods that require physical access.

Unless you are famous or you are being unfriendly to hackers, it is quite unlikely that you will be targeted personally by a hacker (at least these days, this may change in a few years…).

So,if you are using SMS-based 2-factor authentication, you may think about other methods if they are available (Fido is great). But if you don’t use 2-factor authentication at all, please start by using this SMS thing, it will protect you at least against the major leaks that we are seeing these days.

Wondering which services you can protect with 2-factor authentication? Check this page and realize that most of the sites you use can be protected.

The value of the first wave was in the information itself (static Web, a.k.a. Web 1.0); the value of the second wave was in the sharing of information (social web, a.k.a. Web 2.0); the value of the third wave will be in the personalization of the Web experience. One of the key points is here the selection of information, the curation of information, as we are increasingly overflowed with information and content. Companies like Louis Ray’s my6sense are proposing to do just that.

On his post, Doc Searls compares the client-server relationship to a calf-cow relationship, with a strong dependency relationship between a service provider and its users, as exemplified by Facebook, Twitter, and many more. This kind of relationship puts the entire control in the hands of the service provider, which seems very wrong. Doc Searls’ example of Apple’s App Store conditions is the perfect example of this flawed relationship.

Everybody agrees that the personal Web includes personal mobile devices like smartphones and tablets, combined with contextual information, in particular location information. Personal devices will be important for building the personal Web, but not every application running on these devices belongs to the Personal Web. Old-style social services and information feeds will still be around, but making them “personal” on a mobile device is not sufficient.

A personal application needs to truly aim at providing the user with the best possible experience. In this best possible experience, of course, spam, unwanted ads, and other useless content should be gone. This can of course be considered as a threat to a flourishing business model by mobile marketers around the world. However, some other guys will see that as a wonderful opportunity: how to work with the users to bring them commercial information that they value? After all, most of us are actually considering a few purchases at any given time, and timely information about the offer would have a wonderful conversion rate. Let me take an example: I am currently looking for a bed for my son, because his bad quality bed broke. Today, I have two solutions to get information about beds: (1) take my car and drive around the area looking at furniture stores, or (2) Google what I am looking for, and search individually on each site. Both approaches are terribly ineffective, I just want to find a “bed for a 5-year-old boy, including plenty of storage, and if possible a small pull-out desk”. Well, this search is almost intractable, and I can’t find what I am looking for.

Of course, that is what VRM is about. Together with personalized curation, this is an important part of the Personal Web, but there is more into it. In particular, I want to regain ownership on my data, because it is mine. And I want to decide with whom I want to share it, and be able to change my mind.

If we go beyond VRM applications, the Personal Web will affect all aspects of computing. Let’s consider one of my favorite examples, Java Card 3.0 Connected. So far, this technology has failed to find a market. The main idea was to sell super-SIM cards to MNOs, allowing them to push more (static) content and more (social) services to their (captive) users. It didn’t work, for many reasons, but mostly because “smartphones ate our market”.

Java Card 3.0 Connected has some advantages, though: it is local, it is secure, it provides a Web interface. And it is really personal, in particular when it sits in a mobile phone. So, maybe that we can try to find someone (MNO for a SIM, but maybe also a phone manufacturer for an embedded SE, or anybody else for a secure SD Card) who would like to exploit this personal, interactive, secure token to bring elements of the Personal Web to their users. Plenty of applications are possible; the business model don’t necessarily exist today, but the space will be taken before the business model is ready.

So, let’s see who takes the space …

On the good side, Oracle has shown some commitment to a Java roadmap, and this enormous conference has proven that Oracle plays at a different level; this may be very good for some technologies, if Java is able to find its place in the Oracle offer.

On the bad side, mobile did not look very good. Strong words were spoken about commitment, but the roadmap is not clear. Even worse, there were few exhibitors from the mobile world at JavaOne (a few at Oracle OpenWorld, but that’s another story), and it basically left me uncertain about the technology. The only message seems to be that Java is dominant on low-end phones, and that LWUIT and the upcoming Web extensions will bring smartphone apps to all these basic devices. I guess that we will have to wait to see how these features get supported by major OEM platforms.

In technical terms, the main tendency has definitely been the integration of Web applications with Java applications. HTML5 renderers and JavaScript /REST oriented tools/APIs were everywhere, from servers to mobile phones. Of course, JavaFX was also mentioned in almost every talk, but since I did not hear anybody boasting deployment/usage numbers, I guess that it’s still going uphill.

Now, if anybody from Oracle strongly disagrees with these candid views, feel free to provide an alternative view in comments. I would love to be proven wrong on my mobile feeling.

These sessions have been very different, but their combination gives a very strong orientation to the direction where mobile Java is heading:

• Nice apps for everybody. Java is available on low-end and feature phones, and these phones can enjoy nice applications, like smartphones, thanks to Java. The LightWeight User Interface Toolkit (LWUIT) is the future of Java, a library that can be ported across many devices (I have doubts, but I want to believe; something to check at the Java demos).
• Tight integration with the Web. Now, when talking about mobile apps, we need to mention HTML5, using Web Services (RESTful services, JSON, and more), and mention “tight integration”. All three speakers mentioned interesting things, in different ways.
• New APIs to access hardware. This one sounds stranger, since the availability of such APIs already is a good point for Java. However, the sheer number of JSRs is staggering, so modernizing all this makes sense. NFC was mentioned by Kurian, and payment APIs have been announced by both Blackberry (with details) and Oracle (no details).

Finally, a few highlights from the presentations. Terence Barr’s show was nice, although he ran into network problems. He has shown an example called “Meet me for Dinner”, combining locatoin-based stuff, consulting many Web services, and even using a Twitter library for using OAuth. He also promised to publish the full example, so I will wait for that. Well, maybe that in the mean time I will look at the Twitter API ME.

The keynote was the occasion to get a few numbers. The estimates are now 1.1 desktops with Java, 3 billion mobile phones, and 1.4 billion cards every year. Naturally, Thomas Kurian didn’t get the full power of Java Card yet, and simply mentioned a total of 1.4 billion cards (somehow, they all do that). We also learned from Intel that combining hardware and software improvements allowed them to make a 40 times performance increase over 5 years, which beats Moore’s law by a whopping factor 5. I guess that proper optimization can yield results.

On the mobile front, we have been announced a total revamping of the mobile platform in Project Java Mobile.Next, and I guess that we’ll have to wait for that. There are many more projects happening, including Coin, Lambda, and Jigsaw, but these are not really new (just Google the trio to find out).

OK, that wraps the day. More news tomorrow. I will also try to spend a little time looking at demos.

a) Is ‘mobile cloud computing’ a distinct domain in itself? Or is it more about ‘Web Cloud providers going mobile’
Mobile cloud computing relies on the same principles than standard cloud computing, with one major differences at the client level: Mobile clients a link btween the real world and the virtual world, because they are always connected, and they are with us. The consequence is that our requests are very often about where I am now, what I am doing now, who I am with, and similar things. Basically, mobile cloud comuting is about “Here and Now”

b) Do mobile providers have any advantages over web providers (like Amazon)?
Yes, if they take advantage of specific mobile characteristics to actually establish links between the cloud and the world we live in. Things like location and proximity (for instance, the ability to exchange with a neighbor). Otherwise, no advantage.

c) What are the key issues and key advantages for mobile cloud computing?

• Issues: Leveraging the available information. Connectivity Issues (i.e., local caching) Adequacty of user interaction (quantity, presentation).
• Advantages: Availabiliy of the user. Link with physical interaction.

d) Will mobile cloud computing be about privacy in addition to security?
Privacy is a big issue for cloud computing in general. Adding information like location, proximity of others, or similar information, makes privacy more important, but the principles remain the same.

e) What are the biggest privacy and security threats to mobile cloud computing?
I see two levels of problems: first, we need to define the proper access controls. Cloud computing is can be made more interesting by making some information available to services/ partners/ friends, but both service providers and end users must ensure that the proper access controls are defined.

The second level is to properly enforce these controls. At that level, the easy part (maybe) is to implement software correctly on servers and mobile devices. The hard part is to make all users understand the importance of privacy and access controls.

g) Will providers use Mobile Cloud computing to ask payment for granular features(like access to voicemail) aka the Ryanair business model for Cloud computing!
The Ryanair business model can work for a few crucial services, and possibly in some professional settings, in exchange for a better quality of service. Micro-payments (or better, micro-accounting), would be far better.

h) Will enterprises be the key drivers for Mobile Cloud Computing?
As users, most likely not. Most enterprise jobs are static, but we all move around in our personal lives. As service providers, it would be nice to see “classical” businesses being able to do something.

i) Mobile Cloud computing can be implemented at many levels in the Telecoms stack: The Device/Platform, the Operator; The Mobile Web; Infrastructure; SIM. Any more potential ways in which mobile cloud computing can be implemented? And what are the pros and cons of the approaches?

This is a crucial question, and I would love to read other people’s answers, because mine are still confuse at this day. Among the other ways to implement mobile cloud computing, there may be some things to do with small embedded servers (Java Card 3.0 of course, but not only); also, the Device/Platform category may be too vague, because there are several actors there, including the application framework, the Trusted Execution Environment, and more.

j) Which applications would be most likely to benefit from Mobile Cloud Computing?
Most likely not the obvious ones, like mapping or very obvious uses of local information. Combinations of social aspects with location, content sharing are sound to me like winners, but I can’t really see how.

k) Would PCs/Sub netbooks and other ‘non phone’ devices covered by Mobile broadband be impacted by this trend and if so, how?
If they are able to include the information about “Here and now”, why not? It’s not the device that counts, it’s the connectivity. Other devices, like cameras or MP3 players, could also get involved. If they are connected to the network (directly or indirectly) and if they know about “Here and now”, they can do things.

l) Many providers use ‘data backup’ as a stepping stone to cloud services. Will these services evolve beyond the ‘data backup’ i.e. for instance will customers trust their backup providers with personalized information leading to other services
Data backup is a first step, which could/should/will be reversed. The main copy of the data is in the cloud, and there is a cache on the device. However, it should be possible to protect some information (for instance, by only storing it encrypted in the cloud).

Another question is about the “ownership” of the data in the cloud. Users would benefit from having much more data in the cloud, potentially shareable with others. Think about shopping lists, medical files, and much more. Of course, if we consider such sensitive data, then filtering and presentation becomes very important. But then, by giving more data to be correlated in the cloud, we also increase the potential value of services.

j) How important is end to end security for Cloud computing?
End-to-end? Of course, it’s important. And it basically depends a lot on the data to be protected.

k) How important is the management of the client on diverse devices important for end to end cloud security?
Very important, but not more than for any other kind of mobile application. The data may be in the cloud, but some of it is likely to be cached, making it available through standard vulnerabilities.

l) Is the Mobile Web a good client for Cloud computing?
Is Mobile Web good enough for enforcing access control? Maybe not, unless it is complemented with mobile apps, or with high-level widgets.

m) Will emerging markets adopt Cloud computing services?
Yes, most likely not the same ones. The fact that in many markets, mobile phones are more prevalent than any other high-tech device makes mobile cloud computing a good candidate for a lot of new applications, adapted to the needs of every market, including emerging ones.

n) Will low spec devices (ex feature phones) benefit from ‘thin client’ cloud computing services?
Yes. More than the device, is issue is the connectivity offered by the operator. The price of mobile connectivity can be a strong deterrent, but it is likely to go away, in particular if it is restricted to a limited number of cloud services.

o) Identity and the Cloud.
On a mobile device, the username/password model is even more broken than on a PC. So, mobile devices may push strong identities on the cloud. Another important thing is that identity is not only useful between a user and a service provider, but also between two users, before to trust each other.

I now hope that Google will be up to the challenge, and that a few guys at Google are using their “free” time to develop such a game using Google Maps data. I guess that, if these things don’t come, it must mean that 3D programming is indeed difficult; or it could be that gamers expect full 3D game with nice models of the buildings, trees and scenery. For me, the idea is not to have the best 3D experience with the exact buildings (although that would be nice too). The precision I want is on the road itself and on the simulation, because I know the road very well in real life.

Another reason may be price. The use of Google Maps is free, but I am not sure how much Google would charge to build a game with Google Maps data. After all, all these mapping companies are supposed to be worth a lot of money.

This kind of ideas are funny, because they remind us that execution is sometimes very hard. I am sure that some game executives already had the idea to develop such a game. But it hasn’t happened yet, and I am still waiting to be able to race up La Gineste with a few friends from the good ol’ time. Until then, I will keep racing in San Francisco or London with two kids sitting on my lap.

The Leyio has been launched a few months ago, and it is of course a Personal Sharing Device. The videos on the site explain it better than I could do it, but the idea is to have a device that can contain some data (16Gb in the standard version), and share it with many other devices. Here are some examples of what it can do:

• Share files with USB keys. You connect a USB key on the USB port, and hop, you can exchange files.
• Share files with phones. You connect the phone on the USB post, and hop, you can exchange files (well, I guess, only if your phone is able to exchange files with a PC without any additional driver.
• Share files with iPods. You connect an iPod, and hop, you can exchange files. Wait? All files? In both directions? I don’t know, but if this is the case, then welcome to the wonderful world of Palm Pre and to the war of updates between Apple and Leyio (if Apple thinks that you are significant enough).
• Share files with PCs. You select the files that you want to share, and they are copied into a small USB key that you transfer to the PC. Now, that sounds like a good feature, allowing one to select the files to be shared.
• Share files with PCs (2). You connect the Leyio to a PC, and you can see all its content, organize it, etc.
• Share files with another Leyio. The Leyio includes a radio link that allows two Leyio to share data. This is done by shaking the device, like you are throwing the content at the other guy.

This is a nice device, but is it worth it at 129€?

Of course, one of the issues is security. On that part, Leyio is innovating by using a fingerprint scanner for authentication (you can also use a password if you don’t trust biometry). I really like the fact that the scanner is also used as input device. In terms of security, I just hope that there isn’t any loophole left wide open, but this device definitely is a step forward when compared to standard USB keys.

Here is a grabbag of remarks:

• Wishful thinking. Sharing with another Leyio is nice, but a Leyio ain’t an iPod, and the probability to find another one nearby is low. If that device could connect in WiFi/Bluetooth to my iPod Touch and transfer data through a free iPod application, things would be much better.
• Gadgetry. I hope that the radio link and the accelerometer don’t cost much, because in practice, they are likely to be of little use.
• No online backup. Although 16Gb is a bit small, this is a nice little backup device. In that case, associating it to storage on the cloud would ne nice.
• No wireless. What? You think that you can be cool without being wirelessly connected? This radio interface really needs some work.
• Where are my files? My files are usually on my PC somewhere. I would put on a Leyio the files that I think I am most likely to share. The question is: is 16Gb enough? Possibly, but I don’t know.

Now, will I buy one? No, not at 129€, for sure, because I am not that desparate to share. But then, even if I share more than some people, I am not a teenager, and I can’t say what teenagers would say about the device (the Leyio also offers ways to share avatars and internet links, but I have the feeling that they would find other problems to it).

To close this, here are a few suggestions for the future of that device:

• Make a corporate version. With a professional look, a strong focus on security a little less gadgetry, and a few more features, this could make it in the corporate world, at least as a more secure way to share things.
• Combine it with other features. A Leyio/Yuuwaa/Kindle combination would be nice. A thing that manages sharing (Leyio), is automatically backed up on line (Yuuwaa), and comes with a Kindle-like “free” 3G subscription so that the communication is completely transparent. Nice!

Of course, making the device disappear altogether, or get to the form factor of a standard USB key would also be nice, because I am already carrying an iPod Touch and an Android phone, so this third thing is too large.

Note to self: when launching a data-related service/object, think about using names with (almost) no consonants; smooth sounds are required, like Yuuwaa or Leyio.

Looking at my favorite blogs, I found a cool gadget that would have helped me a few times in the past weeks: a pocket light that shows maps. Definitely the best gadget I have seen in a while. I love to walk randomly in the cities I visit, and this little thing (which projects a map of your current location on any good surface) would allow me to take more risks.

Of course, I can’t help giving a bit of advice to Samsung: if I could use this device a s a secondary screen to a mobile device (Blueetooth screen?), that would be really, really cool.

I am just back from JavaOne, and my major headache during that trip has been connectivity (yes, this was a trip to San Francisco and the Silicon Valley, one of the most connected areas of the world. I also happen to be quite a connected guy, as I traveled with a WiFi-enabled PC, a WiFi-enabled iPod Touch, and a rather old Windows Mobile-based GSM phone (also WiFi-enabled).

In such a context, I did not really anticipate connectivity issues, I have accumulated a number of different issues over the week, all different:

• Roaming. My data connection worked rather well on various networks, which is a big difference from a few years ago. However, roaming fees are far from cheap, and it is very difficult to follow them, which really limited my use of that phone.
• Bad service. My hotel was supposed to deliever free WiFi service, but that service turned out to be really unreliable. Most of the time, my PC was not able to access the Web in good conditions. However, the service always worked on he iPod Touch, for some reason unknown to me.
• Overload. I was attending the JavaOne conference, trying to blog live from the show. Well, this did not always work, because JavaOne is a geek conference, and WiFi endpoints can become saturated at times. You then get this “Cannot connect” message, and no network access.
• Software compatibility issues. That’s another problem that I knew about, and which turned out to be a bit painful. I once got a bit lost in San Jose, in a car, and with my phone connection being the only connection to the world. I tried two sites, but both of them told me that my phone was an antique, and that they did not support my browser. Also, in my hotel room, I ran into problems while painfully surfing on my iPod Touch, because I encountered a few Flash-based Web sites (not supported on the iPod Touch).

The only thing that did not occur in that trip is the most obvious connectivity issue: No connection. At all times, I was always connected, at least through the GSM network.

Beside significant headaches and an unwanted in-depth knowledge of WiFi connection management, all these problems allowed me to learn one important thing the way: Don’t take connectivity for granted.

This of course implies that there is an opportunity for local servers, and that this opportunity will be around for a while. It definitely justifies initiatives like the PlugDB project, but there are also many other things that can be performed there.

• First, it is a warehouse. It means that Sun’s objective is to help others build actual stores. So, Sun will take care of the application screening and selection, and of the actual distribution and installation.
• Then, Sun will provide applications not only to mobile phones, but also to desktop PCs. And PCs definitely is a market where Java is strong.
• Sun will provide a preview mode, in which the application is temporarily installed on your PC. Their main claim is that it makes it simple to remove an unwanted application. This is really nice, but I sure hope that even after buying an application, it will be easy to eventually remove an app. Also, I wonder if I will be able to preview a mobile app on my PC; that would be cool.

Of course, the information is very incomplete: no word on app selection criteria, no word on DRM, and other fun things. I will definitely take a look at the store, which is currently in Beta mode.