Posts in Secure IT Practices
Page Content
Who do you trust?
In my earlier posts on passwords, I noted that I approach on-line password “vaults” with caution. I have no reason to doubt that the many password services, secure email services, and other encrypted network services are legitimate. However, I am unable to adequately verify that such is the case for anything I would truly want to protect. It is also possible that some employee has compromised the software, or a rootkit has been installed, so even if the service was designed to be legitimate, it is nonetheless compromised without the rightful owners knowledge.
For a similar reason, I don't use the same password at multiple sites -- I use a different password for each, so if one site is “dishonest” (or compromised) I don't lose security at all my sites.
For items that I don't value very much, the convenience of an online vault service might outweigh my paranoia -- but that hasn't happened yet.
Today I ran across this:
MyBlackBook [ver 1.85 live] - Internet's First Secure & Confidential Online Sex Log!
My first thought is “Wow! What a way to datamine information on potential hot dates!” :-)
That quickly led to the realization that this is an *incredible* tool for collecting blackmail information. Even if the people operating it are legit (and I have no reason to doubt that they are anything but honest), this site will be a prime target for criminals.
It may also be a prime target for lawyers seeking information on personal damages, divorce actions, and more.
My bottom line: don't store things remotely online, even in “secure” storage, unless you wouldn't mind that they get published in a blog somewhere -- or worse. Of course, storing online locally with poor security is not really that much better.....
A great example of how NOT to save passwords
See this account of how someone modified some roadside signs that were password protected. Oops! Not the way to protect a password. Even the aliens know that.
ZUG: Comedy Articles: Electronic Road Signs and Me:
Shiflett on the danger of cross-domain AJAX scripting
Chris Shiflett has posted a good piece in his blog on the potential danger of cross-domain AJAX scripting (digg here). When Chris and I discussed this at OSCON, I was pretty surprised that anyone would think that violating the same-origin restrictions was in any way a good idea. His post gives a good example of how dangerous this would be.
The biggest mistake of Myspace
Myspace, the super-popular web site that your kid uses and you don't, was once again hit by a worm, this time utilizing Macromedia Flash as its primary vector. This was a reminder for me of just how badly Myspace has screwed up when it comes to input filtering:
- They use a "blacklist" approach, disallowing customized markup that they know could be an issue. How confident are you that they covered all their bases, and could anticipate future problems? I don't trust my own code that much, let alone theirs.
- They allow embed HTML tags. That means letting folks embed arbitrary content that utilizes plugins, like... Flash. While Myspace filters Javascript, they seem to have forgotten that Flash has Javascript interaction and DOM manipulation capabilities. If you're a Myspace user, you may have noticed Javascript alert()-style pop-up windows appearing on some profiles -- those are generated by embedding an offsite Flash program into a profile, which then generates Javascript code.
Hacking the MacBook for Biometric Security
Via Infinite Loop, I came across an interesting post from a hawdcore MacBook Pro user who bellied up to the bar and retrofitted a Sony fingerprint scanner into his precious Apple laptop.  No indication that the hardware actually interfaces at all with OS X, but it's pretty cool, and maybe Apple will get some inspiration from this. 8)


