We needed a way to record these sessions, and I got inspired by these guys. But I wanted to come up with a way to record in person mobile tests in a mac environment.

First, get yourself a fancy HueHD webcam. Then strap the webcam to a regular ol’ kitchen clip that you can find at Bed Bath and Beyond with a fat strong rubber band (I used the one from my Field Notes shipment).

Plug the webcam into your mac using a USB extension chord and clip the rig to the top of your mobile device, and position the webcam so you’re capturing the whole mobile screen, including the home buttons.

Open Photobooth on your mac and it will display what the rig sees. (Tip: if it shows your face instead, unplug the webcam and plug it back in.) This will act as a video monitor, so the user can see if their device has migrated off camera.

Open Screenflow and set it to “Record Video from: Built-in iSight” and to “Record Audio from: Built-in Microphone.” This won’t show what Screenflow is recording, so the user won’t be distracted by their own facial expressions on camera. Screenflow will be recording the full screen view of your monitor, so you’ll be capturing the feed from the webcam through Photobooth, and the user’s facial expressions as well as audio conversations through Screenflow. (Tip: have a blank background and pile all your desktop icons out of the way, or create a snazzy non-distracting background for your tests.)

Once you’ve got Photobooth and Screenflow running perfectly, you’re ready to record. This setup isn’t very heavy, so it’s easy to encourage your tester to use their device however they usually do, including switching to landscape—whatever’s normal for them.

After recording, you’re going to have two layers of footage: one for Photobooth and one for Screenflow. Go ahead and shrink the wee box with your user’s pretty face in it and move it kind of out of the way, but not off screen.

You’ve probably noticed that the video from the phone is upside down and backwards, but it’s an easy flip in Screenflow. Just select the Photobooth layer and change the Y and Z axes to 180. Then you can expand this layer larger than life so that the mobile phone is the center of attention in your recording.

Once everything looks good, you’re ready to export your recording from Screenflow. Exporting at 75% is going to be plenty high enough for a good quality video that you can share with others.

Again, it’s our scrappy little DIY method, but it’s been working out great for us. Let me know if you have any questions about our setup, or any ideas you’ve had!

Better reports:

• shows tweets and retweets of your campaign
• see opens by location
• track eCommerce orders (warning: highly addictive)

• see recent subscribers
• list member view with gravatars
• user-agent stats (show you what email program they use)
• subscriber geo location

Miscellaneous enhancements:

• supports multiple MailChimp accounts
• passcode lock screen for security
• log in with API key and phone’s camera (especially handy for our Google Apps users). Only supported on iPhone for now, but Android coming soon.
• Android app has support for widgets, and iOS has a “report card view” for your 5 recent campaigns

Install it free:

Most importantly, the first version of MailChimp Mobile was outsourced (to a great mobile dev group, but still – it was outsourced). Since then, we started an in-house mobile lab. And now that they’ve re-written this app from the ground up, we’ll be able to iterate a lot faster on it.

 iPhone Screenshots

List view:

Viewing a subscriber profile:

Campaign report detail:

“Recent 5″ report cards:

Android screenshots

Widget on your home screen gives you quick stats on your most recent campaign:

Chimp chatter:

Campaign report detail:

List detail:

MailChimp Mobile v2 runs faster and feels smoother than v1, and is absolutely evil if you’re a recovering email stats addict like me. Every time you hit the MailChimp send button, you’ll want to pull up the mobile app to watch your stats on the go. Evil, I tell you.

Download it free:

Be sure to check out all the other mobile apps we’ve created, like Pyow (laser kitties!), gMonkeys (screaming monkeys in your pocket!), AlterEgo (vikings!), and Chimpadeedoo (weeeee!)

The Email Beamer
Every list in MailChimp has a private email address. You can send a message to that private address using Gmail, Outlook, Apple Mail, or even your iPhone or iPad, and we’ll automatically forward it as an email campaign to your list.

This means you can publish MailChimp campaigns while you’re away from your computer, on the road, or sitting in your makeup chair before the show (yep, someone asked us if this was possible).

In the past, this feature only allowed you to “beam” emails into MailChimp as drafts. You then had to sign in and hit “Send” from within MailChimp. Also, once your draft was beamed into MailChimp, it was a little difficult to tweak (unless you could code HTML).

In v6.3 of MailChimp, we changed all that.

Now, when you send an email to your list’s private email address, we’ll send back a confirmation email that looks like this:

All you have to do is reply with the word “send” in your message…

…and we’ll deliver your campaign to that list. You never have to log in to MailChimp to do anything.

But if you want to log in to check the campaign, or if you wanted to beam a rough draft into MailChimp then tweak it later, you’ll find it saved as a draft in your MailChimp account:

Click “edit” and you can modify the campaign with MailChimp’s built-in visual editor:

Using MailChimp’s Email Beamer

There’s really not that much to using the beamer. If you can send an email, you can use the beamer. The work is in the setup process.

Setting up

First, find your private email address.

1. Sign in to MailChimp, and click the Lists tab.

2. You’ll see links for “Email Beamer.”

3. Click to get the Beamer address for the list you want:

On the next screen, you can grab the list’s private email address:

You can either copy-paste this into your address book, or click the handy vCard link to download it to your address book.

Tip: When you add your Beamer email to your address book, be sure you give it a nice description so that you can easily recall it or autofill it whenever you’re ready to send:

Send some tests!

You don’t want to be getting acquainted with this feature when you actually need to use it. Practice with it a little first.

1. Setup a test list, with just a few of your test email addresses, or some friends or co-workers
2. Grab that test list’s Beamer address, and add it to your address book (follow the steps above)
3. Beam some campaigns. Attach images, or drag and drop them into your email app. See what happens in MailChimp when you use Outlook vs. Gmail vs. your smart phone.
4. Use the Inbox Inspector to test any complex templates you’re beaming into MailChimp. Some HTML email templates that you beam will work great. Others, maybe not so much.

Try composing an email on your smart phone that includes photos, and beam it to MailChimp:

You’ll notice that we don’t do much to change the email, other than adding a footer with all the spam-law-required stuff (unsub link, mailing address, etc).

Verify your domains

For security purposes, we can’t accept a beamed campaign from just any email address. You’ll need to send us campaigns where the reply-to is from a verified domain (learn more about Verified Domains and see how to check yours in MailChimp). We’ll only send the confirmation message to your account’s verified email address. So let’s say you’ve set up an account for “Acme Bananas” and you want to let your Marketing Manager beam campaigns into MailChimp from her Gmail. That’s fine, so long as she uses a reply-to from ____@acmebananas.com. But she’ll need to be able to get the confirmation messages that we send back to “____@acmebananas.com”

A note on attachments

Some email apps, like Gmail, don’t let you drag and drop inline images into your content. Instead, you have to attach your images to the bottom of the message:

When this is beamed to MailChimp, we’ll display attachments below your content:

So do some testing from the email app(s) you plan to use, so that you’re familiar with how Beamer will translate your emails.

One interesting note is that all images from beamed campaigns get stored in your MailChimp account’s image gallery for future use. Which, if you think about it, is kind of an interesting way to quickly beam images straight into your gallery. Hmm.

Perfect for Travelers, Noobs, and Hot Tubs

The Email Beamer is great if you’ve got a client or co-worker who wants to use MailChimp, but hasn’t got the time or inclination to sign in and learn our app (ba-humbug!). Or maybe it’s someone who is always on the go, and prefers to use Gmail to compose their newsletters. Maybe there’s someone in your organization that needs to send simple letters out to your email list, but you don’t exactly want them inside MailChimp and tweaking your settings and stuff.

Set them up with their Email Beamer private email address, and bam — they can send from whatever and wherever they want.

Yep, you could even send words of wisdom to subscribers with your Blackberry while taking a hot bubble bath:

Loosely Related:

• Got ba-humbug users in your company that would like Email Beamer? They’d probably like our co-branding features too
• Aaaand they’d probably be good candidates for our sharable VIP reports too.
• Email Beamer’s great for occasional mobile campaigns, or for some users who need simplicity. But if simplicity is all you want, try TinyLetter instead of MailChimp (it’s free, and it’s ultra-simple and easy)
• If you’re the always-on-the-go type, check out MailChimp’s various mobile apps

We just added some new features to AlterEgo, our free 2-factor authentication app that we launched back in May.

These features are similar to the security notifications we’ve built into MailChimp (which you should activate, if you haven’t already). Basically, if you (or someone else) logs in to your AlterEgo account and change your email address or password, we’ll send you an email alert. And if you enter your mobile phone number into AlterEgo, we’ll send you an SMS notification too. For the SMS notifications, we’re using Tropo, which supports international mobile numbers as well. If you haven’t activated 2-factor authentication for your MailChimp account, here’s how.

For those of you who don’t know, Golden Monkeys is a simple little app for stat freaks that sends real time push alerts whenever VIPs (we call them “golden monkeys” here at MailChimp) open and click your emails (you can read the original blog post about it here).

Here’s a breakdown of what’s new…

More Powerful Searching

Previously, you had to search for VIPs on your MailChimp list from within the mobile app. And you could only search by email address. That’s no big deal if you know *exactly* who your VIPs are, and you enjoy sifting through long lists on tiny screens. But this got cumbersome.

So now, we moved the searching process to MailChimp. Just log in to MailChimp like you normally do, click into your list, hit “View all subscribers:”

and then build a segment based on whatever criteria is important to you. Look for the “segment” link to open up the search options:

This changes everything, because instead of entering VIP emails that you already know, you can actually search your MailChimp lists to discover new Golden Monkeys.

For example, you could build a segment of “nearby fans” using our geolocation data and member ratings based on criteria like this:

Or, if you run an e-commerce store and have our eCommerce360 plugin installed, you can segment based on customer purchase activity:

Another advantage to using MailChimp’s search tool is that you can use our bulk add functionality for selecting multiple Golden Monkeys:

For example, if I want to select all members above a certain klout score, I’d bulk add like this:

Boom, I can add all of them as Golden Monkeys in one fell swoop. Note: the bulk add interface will not show any Golden Monkeys options unless MailChimp detects that you’ve installed and setup the app on your mobile device. 

We’ve also added the ability to add someone to your Golden Monkeys list from each subscriber’s “member profile” screen:

There’s a subtle little Golden Monkey icon underneath Jim’s strikingly handsome gravatar (thanks, Jim).

The icon is grayed out when it’s set to off:

and golden when it’s on:

When it’s set to on, that means the Golden Monkey will automatically sync to your mobile device and alert you to email activity.

Updated Activity Screen

We’ve also updated the “Recent Activity” screen to be more of a chronological feed (kinda like Twitter, or our own Chimp Chatter).This way, you can get a nice birds-eye view of all activity from all your Golden Monkeys:

Setup via Camera, Security Settings

We made it a lot easier to get set up, because you can now just snap a picture of your API key’s QR code (we recently added this same setup functionality to Chimpadeedoo2). Using API keys is generally recommended over plugging your username and password in, because it’s a little more secure. If someone were to steal your iPhone, you could log in to MailChimp and revoke the API key. It’s just that API keys are really long, and hard to type on your phone. Snapping a pic with your camera is easy, though.

Choose the API Key login option:

Then snap a pic:

Speaking of API key security, you might also want to activate SMS security alerts in your MailChimp account settings. We’ll TXT you whenever anyone logs in to your account, downloads a list, creates an API key, etc. If you’re interested, check out: MailChimp TXT Security Alerts

Stuff Under Settings

Click the gear icon to get to Golden Monkeys Settings screen:

From here, you can setup a passcode to lock the app. This is a good idea in case your phone is ever stolen.

We’re talking about customer data here, so you should lock this baby down:

You’ll also notice a little Truste privacy badge on the Settings screen:

This is a new service from Truste designed to address concerns specific to mobile apps, and also explains things in an easy-to-digest, mobile-friendly way (with icons and stuff):

We’re proud to be among the first mobile apps to be Truste certified.

v1 Users Must Upgrade

If you’re a current Golden Monkeys v1 user, you’ll need to update the app because v1 will not work anymore after today. Don’t worry, though. Any Golden Monkeys you’ve designated in v1 will show up when you upgrade to v2.

More to come from the Mobile Lab

We’ve come a long way since we first started tinkering with mobile technology. We built an iPhone friendly web app in 2008, then hired Pinch+Zoom to build our big native iPhone app in 2009, and launched it early 2010. By the summer of 2010, it became crystal clear it was time to invest in mobile for the long term. In July, we started our Mobile Lab. Because mobile technology is changing so rapidly (hey, who knew those crazy iPad tablet things would actually catch on?), our strategy was to build apps fast, iterate fast, and learn fast. We launched Chimpadeedoo, Chimpadeedee (on Adobe AIR), Pyow, ChimpKit and ChimpBot (for mobile developers), built our mobile optimized web app, and built ChimpNews as a way to tinker with the Android platform (which was at version 2.2 then, and now we’re already up to version 3.1). Not to mention our mobile-optimized AlterEgo web app (yeah, we’re planning a native app too). Mobile’s changing fast. So we’ve always wanted to stay flexible and just build on top of the MailChimp API (thank goodness we invested so heavily in that department), without committing too much or integrating too much with “MailChimp Proper.” Moving forward, we plan to keep iterating fast, but you’ll see things integrating deeper as our Mobile team works more and more closely with our product team. You’ll also see us launching iPhone and Android apps simultaneously. Exciting times! Our next big project is an update to MailChimp for iPhone and Android. Finally, if you’re interested, the Mobile Lab has a newsletter you can subscribe to (check out their most recent news here).

For those who don’t like videos: AlterEgo provides an easy way for consumer web applications to extend their security just a little bit beyond the standard username/password combo.  Unlike more traditional two-factor authentication solutions, AlterEgo is designed to be simple, easy, and free for both users and applications.  Using AlterEgo, you add an additional layer of security to your accounts by generating simple one-time codes that must be entered before allowing login into an application.

Presuming that you don’t use the same credentials for AlterEgo that you use for your protected account (and ideally access them from different machines), it makes attacks on your account harder – not impossible, just a bit harder.

Why Multi-Factor Auth

Multi factor authentication is a relatively simple way to increase the amount of work an attacker needs to do before they can break into your account.  It accomplishes this by adding a completely independent system that the attacker must also breach before being able to get in.  Because the two systems are separate, with different designs and potential vulnerabilities, it reduces the likelihood that they both will be vulnerable to the same attack.  This is particularly important with the current system of usernames and passwords.  People tend to use the same username and password for all or most of their accounts online, for practical reasons.  A side-effect of this is that any attack on a service that grabs usernames and passwords will allow attackers to break into not only the application that had a security vulnerability, but also any other service that those users have ever used.  Adding an additional layer of authentication before login helps reduce this possibility, and it may be easier than getting all users to start using unique usernames and passwords for each site they visit.

Diversion: typically, two-factor authentication refers solely to two independent methods of authentication: things you know (username/password), things you have (key cards, phones), or things you are (fingerprints, biometrics).  The intended way to use AlterEgo is to access it from a separate smart phone solely, but it does not lock accounts to the phone alone and it does allow username/password logins.  This was enabled for the sake of ubiquity and cost, but opens the argument on whether AlterEgo is “real” two-factor authentication.  In many ways it isn’t, but two-factor authentication is the closest category we could find to what AlterEgo is, so we’ll generally refer to is as 1.5 factor authentication.  As AlterEgo matures, we’ll add more features to make it behave more like a traditional two-factor authentication product, but release early, release often and all that.

Backstory

A few months ago, a major blog network was breached, and about 3 million usernames and passwords were lost.  But this time, the usernames and passwords were published to the Internet in a way that anybody could download them.  This made the attack much worse for the blog network, but it was great for us because it allowed us to run an experiment.  We downloaded those 3 million accounts, then tried to cross reference those accounts with MailChimp accounts.  Once we found a matching username or email address, we cracked the password from the blog network and compared it to the MailChimp account password.  This gave us a very targeted list of users that we could force to reset their password, and it gave us a good idea of how big of a vulnerability these sorts of username/password breaches are for us.

Of the 3 million accounts, about 25,000 of them also matched a username or email address in MailChimp.  That wasn’t too bad, and we calmed down somewhat about the possibility of hundreds of thousands of accounts being hacked.  Then we started cracking and comparing passwords, and our calm dissipated.  Of those 25,000 accounts, about 7,000 of them were using the same password in MailChimp as they used for their blog commenting account.  This was a much larger percentage than we were expecting.  We immediately notified those users and forced them to reset their passwords, but this was just one breach.  Breaches like this occur all the time, and we frequently don’t get to download and compare their accounts.  Do we force all of our users to change their passwords every time we hear of a breach like this?  No, that’s absurd and users would rightly revolt.  But we can’t force all our users to not re-use passwords, either.

Two-factor authentication immediately came to mind as a possible feature that might help with some of these issues, as well as being a decent security feature anyway.  So we started looking for consumer-level two-factor authentication providers that had a free or cheap API we could piggy-back off of.  However, as we investigated the options, it became immediately clear that the two-factor authentication products on the market were very much not designed for consumer-level web apps.  The APIs were written in enterprise-speak.  The app registration process was complex and long.  The cost was too high without significantly reducing how many of our users would be allowed to use it.  It became clear that we required a different balance than what the market seemed to be providing.

AlterEgo provides that different balance.  It’s designed solely for protecting web apps and other online applications, which makes the security of the algorithms somewhat simpler.  Registration is free for both applications and users.  The API is dramatically simple and easy to integrate with.  In every design decision we made, there was a focus on making it easier, simpler, and free for users and apps to be able to use AlterEgo.  In some cases, even at the expense of the security it provides.  If you truly want to protect something sensitive, don’t use AlterEgo; go with VeriSign or RSA (who we use to protect some of our important backend assets).  But if you want to offer something that lets users have just a little bit more peace of mind in your authentication or if you’re a MailChimp user looking for a way to protect your account a bit more than your MailChimp username/password, AlterEgo might be just what you’re looking for.

Create an account at AlterEgo, then you can activate it from the Integrations screen inside MailChimp:

and then AlterEgo will ask for permission to allow MailChimp:

Neither AlterEgo nor any other multi-factor authentication system can completely protect your account from attack.  AlterEgo itself certainly has vulnerabilities that could be used to help break into your account.  Not to mention phishing attacks or trojans that can get your AlterEgo credentials in much the same way they can get your MailChimp credentials.  Notifying users when security-sensitive actions have been taken and watching traffic for “hacker-ish” patterns are also necessary, and thing’s we’re working on.  AlterEgo is just a way of making attack a little bit harder and a little bit less likely to happen by increasing the number of layers some attackers needs to break through before they can get in.

• A login to your account
• An API key has been generated
• An Account Key has been created
• The contact info for your account has been changed
• Someone attempts to download your list(s)

We’ll be adding more “triggers” over time. This feature is free (though your cell phone carrier may have their own TXT charges), and we strongly recommend that you activate it. Here’s how…

1. Log in to your MailChimp account

2. Click to your “Password & Security Settings” screen

3. Under the “notifications” section, fill in your mobile number. You can also enter your email address in order to get an alert emailed to you:

Now, whenever a security event is triggered, you’ll get a TXT message that looks something like this:

Note that we’ll include the IP address and approximate geo location, so you can get some idea of where the access is coming from. For example, if you share access to your account with your manager, you might not be too freaked out when you see a login from the same city as you. But if you see a mysterious login from some other country, you might want to lock your account down asap and tell our support team.

Related:

• Account Key security email notifications
• MailChimp’s Security Information Center
• Free Email Security Guide

You might have noticed that we updated the mobile version of the app when we redesigned the app earlier this year. The original mobile web app was released back in 2008—it was time for an update.

Support for More Devices

There have been a bunch of mobile devices released in the past 3 years. How can we build an app to support all of them? We can’t. But we’ve decided to pursue the most popular devices and keep an eye on our analytics to determine what people are using to access their MailChimp account.

Report Detail in Mobile Web App

This new release of our mobile web app looks and works best in WebKit-based browsers. Some supported operating systems include:

• iOS (iPhone/iPod Touch)
• Android (2.0 provides the best experience)
• webOS 2.0
• BlackBerry 6
• Palm Pre 2.0

Here’s a current feature list:

• View Chimp Chatter
• View Reports (Overview stats, Tweets and Facebook Likes)
• View a Click Report
• Add Subscribers to Your Lists

Our mobile web app is a nice on-the-go version of MailChimp.

My Phone Isn’t Fancy

The mobile version of MailChimp will run just fine on your phone, but you’ll have a text-only experience for now. We’ll continue to add content and style for other mobile devices as we look at usage numbers.

If you’re looking for an app you can install on your device (native apps), you may want to check out MailChimp for iPhone or MiniChimp for BlackBerry.

QR codes are neat because they store information, like a website address or string of characters, that you can then retrieve with your smart phone’s camera and an app that’s able to read them.

There isn’t yet an option in any of our mobile apps requiring an API key to use your QR code instead, but our Mobile Labs team is working on the next piece of the puzzle as I type this. The idea is that initially you can use your favorite app to scan the code, then copy/paste your API key into the application.

These new templates help newbies and pros alike make some pretty sophisticated designs quickly. Since these templates are so useful, we’re releasing the source of all 36 of them as an open source project called Email Blueprints on GitHub. You can download them and use them as a starting point for every email you build. If you’re a coder designing and building templates for your clients or even just yourself, these starter templates will help you big time. Here’s how:

• they’re tested in all major email clients
• they use our template language to tie into the MailChimp template design interface your clients will use to customize design
• they contain all of the hooks for new MailChimp template controls like repeatable modules, hideable modules, and module variants
• they contain merge tags to generate dynamic content like archive and unsubscribe links, address, and all the CAN SPAM requirements
• the have social networking links for Facebook and Twitter built right in
• they use Facebook’s Open Graph so your campaign can be shared on Facebook more elegantly

In this set of 36 templates, we have examples of basic newsletters, sophisticated photo gallery layouts, stationary style layouts, and even mobile specific layouts among others. With all of the hard stuff already done for you, you can focus on making really great designs and writing content that’s going to get you and your clients better results from your campaigns.

Download the source or checkout the Git repository.