21 August, 2025

Annoying SPAM source - Instiller.

 Most days we get annoying SPAM email via https://instiller.co.uk/  Despite their statement otherwise, they do not honour unsubscribe requests. Their clients, using the Instiller services, are automatically and permanently blacklisted by our system. We usually file a bad IP address report with the on-line monitoring agencies too.

It is an absolute zero-tolerance policy. Unless we have previously done business with the organisation, and if we continue to receive unsolicited email after one "unsubscribe" message, we then blacklist the sender, their originating IP Address, their company, quoted phone numbers, and the person signing the letter. 

15 August, 2025

Why Companies House Director Identity Verification is not reliable

 The current approach by Companies House to Id Verification is to have the Director's email address cross checked by GOV.UK One Login System. If that process checks out with the supporting identity documentation, the Director is issued with a personal identity code. It is sent to the Director's registered email address. The Director is then supposed to tell Companies House the detail of the personal code  tied to the director's registered email address.

Here's the problem; the email address is not proof of identity. It can be hijacked, and the "Personal Code" can be learned by social engineering over the phone. The Companies House system should use a physical token, such as a Yubikey to store an encrypted digital certificate to identify individual people. The token should be plugged into the PC/Phone and verified when the Director is filing documents on the Companies House website.


Here's a story:

The Day the CEO’s Email Wasn’t the CEO’s Email

It started with a routine request.
Our client needed to verify the identity of a company director. Nothing unusual — just send a secure link to the director’s official address, ceo@bigco.com, and wait for the confirmation click.

A few minutes later, the “CEO” replied. The system marked the verification as complete. The paperwork moved forward.
Everything looked fine.

Except it wasn’t.


The Silent Switch

What no one realised was that, a week earlier, the company’s domain name — bigco.com — had been quietly hijacked.
The attacker had gained access to the registrar account where the domain was registered. With just a few clicks, they redirected the company’s email hosting to their own server.

Now, when someone sent a message to ceo@bigco.com, it didn’t go to the real CEO. It went to the attacker’s freshly created inbox.
From the outside, nothing looked suspicious. The address matched. The email arrived. The link was clicked.

The attacker had just passed identity verification with flying colours.


Why Email Alone Isn’t Enough

Email verification checks one thing:

Can this person receive a message at this address right now?

It doesn’t check:

  • Whether they’ve always owned that address

  • Whether the domain has been compromised

  • Whether someone inside the company created a fake account

If the domain itself is taken over, email verification becomes a rubber stamp for the attacker.


How to Stay Ahead of the Trick

Here’s how to make sure you’re not fooled by the same move:

  1. Don’t rely on email alone — Combine it with phone verification, government ID checks, or live video confirmation.

  2. Monitor domain history — Flag sudden changes in registration, transfers, or name servers.

  3. Use domain security — DNSSEC, SPF, DKIM, and DMARC make some attacks harder.

  4. Bind identity to a digital certificate — Once verified, use cryptographic keys instead of just email for ongoing trust.


The Lesson

In this case, we caught the problem — but only because another system noticed the domain had been altered days earlier. Without that extra layer, the attacker could have slipped right through.

When it comes to verifying someone’s identity, email is a useful tool — but it’s like a lock on a screen door.
If the whole doorframe can be lifted off, the lock isn’t doing much.


.

07 August, 2025

Tuning a local NAS network adaptor on your PC.


🖥️ Lessons Learned: Optimizing Network Performance Between Windows and Synology NAS

If you've ever found yourself wondering why your lightning-fast Synology NAS isn’t delivering the speeds you expected to your Windows PC, you’re not alone. I recently went down the rabbit hole of **multi-NIC networking**, **Windows routing quirks**, and **Synology access issues** — and came out the other side with a surprisingly lean and fast setup.

Here’s a breakdown of the lessons learned — and what actually worked.

🚧 The Problem: Speed Bottlenecks & Wrong Interface Routing

Even with a high-performance Synology NAS equipped with a 10GbE card, and a PC connected via a 2.5GbE LAN port, I was seeing inconsistent performance — and even security alerts from the Synology when accessing the NAS web interface.

Turns out, the culprit was simple: **Windows was routing NAS traffic over the wrong network adapter** — often defaulting to Wi-Fi or a secondary Ethernet port on a different subnet.

🔧 Lesson 1: Understand the Windows Routing Table

Windows doesn’t always choose the fastest interface — it chooses based on **metrics** (priority numbers), and these can change on reboot or reconnection.

To view your routing table:

```bash

route print

This shows which interface Windows will use for a given destination. If the wrong adapter is prioritized, even local NAS access can go through Wi-Fi, causing unnecessary latency or even subnet mismatches.

### 🛣️ Lesson 2: Add a Static Route to the NAS

To ensure that all traffic to the NAS uses the correct (fast) adapter, add a **persistent static route** targeting just the NAS IP address:

```bash

route -p ADD [NAS IP] MASK 255.255.255.255 [NAS IP] IF [Interface Index] METRIC 5

```

* Replace `[NAS IP]` with the actual NAS IP.

* Use `route print` to find the `[Interface Index]` of your fast LAN adapter.

* The gateway and destination IP can be the same when the NAS is directly connected (e.g., via a dumb switch).

This route forces Windows to send all traffic to that NAS through the correct interface — no guesswork.

📉 Lesson 3: Stop Letting Windows Auto-Assign Metrics

Windows uses **"Automatic Metric"**, which attempts to prioritize interfaces based on link speed and other factors. It's often wrong — especially with mixed wired/Wi-Fi environments.

Manually set the interface metric:

```bash

netsh interface ipv4 set interface "[Interface Name]" metric=50

* Use a **lower metric** (e.g., 5) for your fast LAN adapter.

* Use **higher metrics** (e.g., 50–100) for Wi-Fi and fallback links.

* You can check existing metrics with:

```bash

netsh interface ipv4 show interfaces


This ensures Windows consistently prefers your high-speed link.

⚠️ Lesson 4: Subnet Mismatches Can Trigger NAS Security

If traffic to the NAS web interface comes from an unexpected subnet (e.g., your Wi-Fi network), Synology’s security features may block or flag it as a potential intrusion.

Routing all NAS traffic through the correct interface **eliminates false positives**, avoids login delays, and keeps the experience seamless.

⚡ The Result: Instant File Access, Stable Connections

After applying these fixes:

* JPG previews and media access became noticeably faster

* File transfers reached expected speeds over 2.5Gbps

* Synology no longer flagged normal access as suspicious

* The setup stayed stable even after rebooting

And no extra hardware was needed — just a better understanding of how Windows routes traffic.

🧠 Final Thoughts

You don't need to upgrade everything to 10GbE immediately. By tuning your **network routes** and **interface priorities**, you can unlock the full potential of your existing hardware — especially in mixed environments with multiple adapters or subnets.

If you’re running Windows and a Synology NAS, take an hour to review your routing table and metrics — it might save you hours of unexplained slowdowns or weird security behavior.


20 July, 2025

MagNex : Magnets without Rare-Earth

MagNex: The AI-Discovered Magnet That Could Change Clean Energy


A UK startup called Materials Nexus has created a new magnet called MagNex — and it might be a big deal for electric cars, wind turbines, drones, and robots. What makes it special? It was designed with artificial intelligence (AI), and it doesn’t use rare-earth metals, which are usually expensive, hard to get, and bad for the environment.

Even better — it only took three months to create, which is about 200 times faster than normal.


Why This Is Important

1. No Rare-Earth Metals

Most strong magnets use rare elements like neodymium and dysprosium. These are mostly mined in China, and the mining process is harmful to the environment. MagNex doesn’t use any of them.

2. Cheaper and Cleaner

Making MagNex costs about 80% less than traditional rare-earth magnets, and it produces 70% less carbon pollution.

3. Fast Discovery

Using AI, the Materials Nexus team tested over 100 million combinations of metals on a computer to find the best one. Then they made and tested it in a lab — all in just a few months.


How They Did It

Materials Nexus worked with scientists from the University of Sheffield and the Henry Royce Institute in the UK. The AI system looked for materials that were:

  • Strong magnets
  • Cheap to make
  • Easy to find
  • Environmentally friendly

Once the AI found a few good options, the scientists made them and tested them to find the best one: MagNex.


Why It Matters

Fixing Supply Chain Problems

With the rise of electric vehicles and renewable energy, the world needs more magnets than ever. MagNex could help solve the problem of relying too much on rare, expensive metals.

Helping the Environment

Because MagNex uses more common materials and produces less carbon, it’s better for the planet.

A New Way to Make Materials

This is just the beginning. Materials Nexus plans to use the same AI technology to discover better semiconductors, superconductors, batteries, and more.

Their CEO, Dr. Jonathan Bean, said:

> "This is just one example of how AI can help us create materials that support climate goals."


What’s Next?

MagNex is promising, but it’s still new. It needs to prove that it can work as well as (or better than) current magnets in real-world products. It also needs to be made at a large scale.

But if it succeeds, it could help make green technology cheaper, faster, and more sustainable — and change how we invent materials in the future.




18 July, 2025

Silly supplier mistake, Costs them an order

 We're in the process of upgrading our Network Attached Storage (NAS) to protect our data. We've had to buy some NAS hardware, disks and network upgrades. 

We placed two orders with BroadBandBuyer, about 1 hour apart on the same day, for a 10 GB LAN card, some network patch cables, and LAN Switch. They fulfilled one of the orders promptly, but appeared to have overlooked the second order. Its status was stuck at "awaiting stock allocation" even though the items were marked as "in stock" at the time of order.

When we queried the order status a couple of days later, we were given the line that despatch would be timed in line with the despatch method specified at the time of order, i.e. it's going to sit untouched for a couple of days even though the stock is available.Essentially arrant nonsense when the first order had the same method of despatch as as the delayed one. 

We subsequently decided we wanted to increase the capability of the NAS units with extra (ECC RAM) memory. BroadBandBuyer had the memory modules in stock, but they didn't get the order from us. We chose instead to order directly from the NAS manufacturer.  They've now been moved down the pecking order when it comes to selecting suppliers. We don't appreciate lies from their helpdesk. It also caused us to check their rating on Trustpilot.  They were preferred suppliers.

GDPR Red Flags in the Companies House

 Blog Update: GDPR Red Flags in the Companies House Identity Verification System


In my ongoing efforts to comply with Companies House's new director identity verification requirement, a recent development raises serious concerns under UK GDPR.

Following a Subject Access Request (SAR) to Companies House, I have now received written confirmation that they hold no records relating to my identity verification attempts via the GOV.UK One Login system. Specifically, they state they cannot see:

  • Any verification outcome or status,
  • Any login identifiers linked to me,
  • Any audit trail or escalation records,
  • Any way to associate a One Login attempt with a named director.

In short: the government department mandating legal compliance through a digital system is unable to access or confirm whether the process it enforces has even been attempted.

This raises three fundamental GDPR issues:

Lack of data traceability – If no record links a login ID to a director, how can Companies House enforce or prove compliance?

Opaque automated decision-making – GOV.UK One Login is effectively a black box. Users are not informed why they fail verification. No explanation is given, and no human review appears available — potentially breaching Article 22 of UK GDPR.

Shared controller confusion – Companies House refers all identity processing responsibility to GDS/Cabinet Office. Yet it is Companies House that imposes consequences based on that process. This blurred boundary undermines accountability.

With SARs now also submitted to GDS and DSIT, I intend to escalate to the Information Commissioner’s Office if these concerns are not addressed. Legal obligations should never be built on systems that are opaque, untraceable, and immune to oversight.


Edit 8th Aug 2025 - relevant to the issue:

A UK court has ordered HM Revenue & Customs (HMRC) to disclose whether it used artificial intelligence in deciding to reject research and development (R&D) tax credit claims. The ruling came after tax expert Tom Elsbury filed a Freedom of Information request in December 2023, suspecting AI involvement based on rejection letters. HMRC initially refused, citing concerns about aiding fraudulent claims—a stance later upheld by the Information Commissioner’s Office.

However, the first-tier tribunal ruled that the public interest outweighed those concerns, giving HMRC until 18 September to respond. Judge Alexandra Marks found Elsbury’s arguments “compelling,” noting that HMRC’s refusal to confirm or deny AI use risked undermining public trust. Elsbury warned of potential dangers if public large language models like ChatGPT had been used for tax assessments, particularly where sensitive defence-related innovations might be exposed.

The case comes amid heightened scrutiny of R&D tax credits due to fraud concerns, though critics argue HMRC’s approach has unfairly penalised legitimate businesses. HMRC said it is reviewing the decision and considering next steps.

Attribution:
Based on reporting by Emma Agyemang, Financial Times (© The Financial Times Limited 2025).

14 July, 2025

Is the GOV.IT One Login programme failing?




The Trouble with GOV.UK One Login: What You Should Know


The UK government’s new digital identity system, GOV.UK One Login, aims to make it easier for people to access public services online. It’s designed to replace older systems like Government Gateway and Verify. But while the idea is promising, the rollout has been far from smooth.

Here are the key problems that have come to light:
 

1. Serious Security Risks

Independent testing revealed that hackers could gain high-level access to the system without triggering any alerts. That means someone could break in—and no one would know.

This isn’t the first warning. Since 2022, multiple government bodies have flagged issues with how secure One Login really is. While the government claims it’s fixed most of these, trust is still shaky.
 

2. Not Meeting Cybersecurity Standards

The system still doesn’t fully meet the government’s own cyber security standards.

As of April 2025, One Login passed only 21 out of 39 security checks set by the National Cyber Security Centre. That’s an improvement over last year, but still not good enough, especially for something so critical.
 

3. Lost Trusted Identity Status

In May 2025, One Login lost its official certification under the UK’s Digital Identity and Attributes Trust Framework (DIATF). This happened when one of its main suppliers failed to renew their approval.

This means One Login is no longer on the list of trusted digital ID providers, a major credibility blow.
 

4. Hard for Some People to Use

A government study found that up to 9% of people can’t verify their identity using One Login. That includes people without passports, driving licenses, or a strong financial history.

Young people face even more problems:
  • Only 4% have a big enough financial “footprint”
  • Nearly half don’t have a mobile phone
  • 1 in 5 don’t have an email address
  • Many need help using online services at all
This raises questions about how “universal” the system really is.
 

5. Concerns Over Development and Oversight


There are also red flags about how the system is being built and managed:
  • A whistleblower claimed that large parts of the work were offshored to Romania, without proper oversight or cybersecurity checks.
  • Key security flaws took months to be addressed.
  • Internal governance has been criticised for being too slow to act on known risks.

6. Industry and Political Pushback


Industry groups say the system should only be used for public services and not expand into the private sector. They fear it could harm private digital ID providers and distort the market.

Meanwhile, MPs and peers continue to question the government about security weaknesses, insider risks, and lack of transparency.
Government Response

The Government Digital Service (GDS) says it is fixing the issues. Measures include:
  • Stronger monitoring
  • Tighter access controls
  • Independent risk assessments
Ministers also say that some of the security concerns are “outdated,” and that full compliance is on the way.
 

Final Thoughts


GOV.UK One Login was supposed to be the future of digital identity in the UK. But with ongoing security issues, adoption challenges, and lost certification, it’s facing real questions about its readiness.

Until the government proves it can make the system secure, inclusive, and fully trusted, many people, rightfully, remain cautious.


Update 6th Aug 2025:

Issue: Despite the voluntary IDV period starting April 8, 2025, only about 200,000 out of 7 million individuals (less than 3%) have verified their identities so far, suggesting low awareness or reluctance.

Impact: The low uptake could lead to a last-minute rush as the November 18, 2025, mandatory deadline approaches, potentially causing delays in filings, rejections of incorporations, or penalties for non-compliance. Non-compliance is a criminal offense, with risks including fines, disqualification, or public annotations on the register that could harm a company’s reputation and access to finance or insurance.