1 minute, 34 seconds

As a fan of security and strong passwords, I read with interest Lifehacker’s article about how easy it is to hack passwords. In general the article is right on the money and I agree with it’s message. However, I took issue with the article on two points.

The first point they’re talking about how easy it is to either guess or brute force your passwords. Guessing and forcing passwords can be done over the Internet with out needing to compromise your (the victim’s) computer. However, the last step is “simply” to get at the cookies on your local machine:

But wait… How do I know which bank you use and what your login ID is for the sites you frequent? All those cookies are simply stored, unencrypted and nicely named, in your Web browser’s cache. (Read this post to remedy that problem.)
– Lifehacker Mar 30, 2010

For me this is crossing the line from informative into fear mongering. Yes, once you have logged into some one’s computer as the user they surf the internet as, it is indeed trivial to read cookies. No, this can not be done over the Internet. No this is not a simple step to make.

The second point (now that I’m not drafting this on my phone and am using a real computer) I see that the original article was published in 2007! Just about all the info in the original article still holds true 3 years later, but I find awkward when the article on Lifehacker has items like this in the article:

EDIT: You might also want to listen to my interview on Connecticut Public Radio about password security.

Which made me think it was a Lifehacker edit in 2010, but was in fact an edit from John Pozadzides in 2007. Speaking of Pozadzides, his blog looks pretty right on and I don’t really have any beef with him (in that totally anonymous Internet beef kind of way), but I mainly take issue with fear mongering, especially when in comes to cookies.

Update: This article seems to be making the rounds on a lot of sites.

Update 2: There’s a great comment from Wangston below.

1 minute, 13 seconds

I just read internet’s famous Cory Doctorow’s very interesting post about how he got phished (!). What struck me was not his whole parasite-perfect-timing-phone-reset scenario. The take away for me was that on a small screen you can’t see the entire URL of where you’re going. I can imagine a scenario where phishers look up your friends on facetwitt, send you a “personal” note with a perfectly crafted URL to fit you iphonedroid’s browser. Your phone would hide the fact that you’re not logging into the site you think you are. Yikes!

I’m currently abstaining from all social networking sites. They’re totally awesome and fun and a great way to keep in touch with friends far and near. However, my security hackles go up too high with them, so I’ll have to be happy with my blog and its 4 readers instead of an intensely well read facebook wall (that’s what the kids call it, right?).

Phishers often depend on super popular site like twittface to spam you with a note from a service you’ll likely be using. I laugh these off because I don’t use any them. But if I was a phisher, I’d programmatically crawl the feeds to figure who your friends are and who you actively communicate with. I’d then watch out for nouns and verbs you’d expect in a message based on the vernacular your lil’ group uses, and then I’d phish you like a bunch of mom’s on their iMacs (my mom and her iMac excluded, of course!).

This post largely written on WordPress for Android in casual carpool. Fun!

0 minutes, 46 seconds

One of the laptops in the house died recently. The svelte new Dell Latitude 13 showed up as its replacement, and it’s great. However, it’s running a factory set up version of IE8. I don’t use IE8, opting for the fox (for debugging) or the goog (for speed) instead, but I noticed that the totally awesome plip 404 page was being usurped in IE8. This will not stand! Just as I will not have my ISP taking over DNS for domains that don’t resolve, I will not have my browser decide what a 404 page should look like.

At first I found some sites that suggested a different header or that you could make your 404 page more than 512 bytes. While this will work, and will work every *every* user, I was curious about a client side setting. Enter “show friendly http error message” check box:

Just uncheck that guy in your IE settings and welcome back fugly plip 404 messages. Interesting enough, there’s all kinds of wackiness in Microsoft land about this. Read on if you care!