Hall of Shame: Office 365

When testing the brand-new Microsoft Office 365, I ran accoss this error:

All I can say: Why? Why would you restrict password length?  This is a new product, so you cannot use the old "We need to be compatible with legacy accounts" on me here.

There is no good reason to do this. Especially when you are securely hashing my password. 
You are storing the password securely, right?  Right?

New snooping bill: What could possibly go wrong?

House panel approves broadened ISP snooping bill :

"Internet providers would be forced to keep logs of their customers' activities for one year--in case police want to review them in the future--under legislation that a U.S. House of Representatives committee approved today.

The 19 to 10 vote represents a victory for conservative Republicans, who made data retention their first major technology initiative after last fall's elections, and the Justice Department officials who have quietly lobbied for the sweeping new requirements, a development first reported by CNET.

A last-minute rewrite of the bill expands the information that commercial Internet providers are required to store to include customers' names, addresses, phone numbers, credit card numbers, bank account numbers, and temporarily-assigned IP addresses, some committee members suggested. By a 7-16 vote, the panel rejected an amendment that would have clarified that only IP addresses must be stored."

Let's think this through (hey, somebody has to!):

•  This is billed as a "protecting children from pornography" act.   Where is the official double-speak justification on this?  What part of this could even theoretically protect any kid from pornography? Did the spin-doctor on duty call in sick?
• This is going to be made available for "police investigating any crime and perhaps attorneys litigating civil disputes in divorce, insurance fraud, and other cases as well".   Are we feeling secure yet?
• Every other monitoring system of this sort has been abused on a systematic basis.  
• Who is going to be paying for this?  I see a $6.99/month "snooped data retention" fee coming to a statement near you soon!
• The ISP is supposed to be capturing credit card numbers, bank account numbers, personal information, which begs questions such as:
• Who is going to be responsible for storing and safeguarding this information?  
• Can you imagine what kind of tasty target it would be for a criminal?  How may credit card transactions are flowing through Comcast's network every day?
• Are the ISPs going to be held to the same data confidentiality laws as everybody else?
  I see PCI, HIPAA and a few others jump out as being applicable here.   Who is going to audit these systems to ensure compliance.
• (Luckily) nearly every website these days uses HTTPS from credit card transactions.  How is an ISP supposed to capture this information on the wire?

There are so many things wrong with this idea, and they haven't even started implementing it yet.

Seriously? A.k.a. "My adventures with "ePolicy Orchestrator"

From the why-oh-why-do-you-hate-me department:

Seriously? We have to break the official IT computer naming policy because you product refuses to be installed on a system that has a (perfectly legit) underscore in it's name?

I usually don't get frustrated with a product until after I install it.

It only after I change the computer name, that I get this error on my Windows 7 professional installation:

Of course, that document is not part of the installation, only the "product guide" is. 

Update 1:
I now have a super duper "Windows Server 2008 R2 - 64 bit" installation.   Guess what I get when the installation starts?  A new error!

"8.3 naming convention"?  Wait...  Didn't you just force me to upgrade to "Windows super duper"? And then you complain that you don't have the features from DOS in 1981?  And no, the "installation guide" doesn't mention anything about this.


Update 2:
After some Googleing, a registry change, installing MS SQL, configuring port, choosing various passwords (whose complexity requirement are kept a secret), the installer finally got running.

And I was awarded with....

At this point, only 1 comment makes sense:

Update 3:

Wondering if I was running the latest version, I found out

• McAfee's beta portal is seriously broken
• it refuses my (stored) password 
• it doesn't really execute password resets (although it says it does)
• That doesn't really matter, since there is a an open FTP server from which one can download any beta software they ever released.
• That also doesn't really matter, since I was already testing with the latest version, EPO 4.6 RC3.
• The beta seems to expire really quickly, in this case: May 31, 2011 (it was released mid march)

So, saying in the spirit, I used an ancient "hack" technique from the 80s.  It's called "setting the clock back".
Result:

30 minutes of installation dialogs later:

Allow me to say:

It takes a govermental agency to be this security clueless!

Recently, I had to look up something on website ran by a local college. Of course, the site broke (the pages did not load within the session timeout), so I fired off an email to their listed support email.

Here is what I got back:

Auto-Reply

We have received your email enquiry. Please try one or more of the suggested solutions below. Web help is available Monday through Friday 8am - 4:00pm (not available weekends and holidays). If you reply to this email, please provide your full name, Soc. Sec. No., birthdate, and your current address.

Quick help



New Applicants: you will be able to login to the WebAdvisor one business day after you have submitted your application.

Step-by-step Web Registration Instructions:

http://(removed)/spring09/fullSchedule.pdf


Account Lock-out:

Wait 10 minutes and try again

Password and login help:

If necessary, please go to the WebAdvisor web page and select "What is my User ID?" from the Student Menu. Provide the required information to obtain your User ID.
Then select "What's my password" from the Student Menu.
Select "I don't remember my password" and provide the required information.
A new password will be emailed to you.

Password must be 6 to 9 characters in length and include both letters and numbers, no special characters

If you are still having problems, please contact the appropriate
Admissions & Records Office
(Contact Information removed here)

Thanks

Class assignment: List all security violations in this reply, discuss.

On Kafka and child porn

Interesting application of child porn laws:

In the Pennsylvania case, a school official seized the phone of one of the boys after he was caught using it during school hours in violation of a school rule, according to local police Capt. George Seranko. The official found the picture on the phone, and after some interrogation, discovered that two other girls had also e-mailed photos of themselves in the nude to friends. That's when the school called police, who obtained search warrants to seize the phones and examine them. Police showed the images to the local district attorney, who recommended they bring charges.

I've seen this happening so many times: An ambitious politician creates a law "for the good of the children" and before you know it people with pitchforks are setting libraries on fire.

Imagine this:
You are alone in your room. You look at yourself naked in the mirror. You take a picture of yourself, and you instantly are sex offender, branded for life. Any friends you send it too, instantly are too.

Or...

Two kids having consensual sex. Legally. The can invite kids of their own age to watch. Or even join in. When they watch through a window, they are legally OK. When they watch using a web cam, they all are instant sex offenders.


Or how about... you are surfing myspace and stumble across a profile page of a teen posting nude pictures of him/herself. Yes, that teen would be in violation of (amongst other things) the TOS. But still your browser dutifully downloads and stores the offending JPG. From then on, any computer forensics package run on your PC will provide the proof to convict you of possession of child porn.

Personally, I don't know what is scarier these days. The "evil hackers on the internet" or the "knights that protect us".

One group will try to to rip you off, and steal your money. The other can take away your home, freedom, custody of your kids.