Let's see:
You have a nice "password strength" meter, but once one submits the form, it repeats back the password in the clear, complains that its too long, and can't have any "special" characters.
Why would that matter, since the password hash would be the same regardless of length? You are securely hashing the passwords, and not storing them in the database as plain-text, right? Right?
Also, can you tell me exactly what the difference is between a special character and a non-special one? Is it "special" when it causes a SQL Injection vulnerability (which of course you would defense against by properly escaping database inputs), when storing it in the password in plain-text (which of course you don't do) ?
BTW: I don't think I will be trusting you with access to my Facebook account just yet. Hope you don't mind.
Update:
I have proof that they store password "in the clear": The password test is case-insensitive!
You can try this out yourself:
If your password is "joshua", you can log in using "JOSHUA" or "JoSHuA". This is only possible if the site doesn't use any password hashing at all. Security 101 FAIL!
Just saw this on one of my favorite sites:
How to Encrypt and Hide Your Entire Operating System from Prying Eyes:
Over the years, we've written about loads of different ways to hide and encrypt your private data from others, but if you're really serious about protecting your data, you can actually hide your entire operating system. Here's exactly how to do it.
To accomplish this task, we'll be using TrueCrypt, our favorite free and open-source disk encryption software that runs on all platforms, supports hidden volumes, and can even encrypt your entire hard drive."
I just discovered "DirecTv2Pc", an application that is supposed to let you display your DVR'd content on your PC. After and exciting download, I ran the installer.
Note that the installer doesn't install, it "verifies and assists" the poor hapless user in making sure his systems is blessed enough to receive the holiest of holy, (a.k.a. last nights episode of "dancing with the stars").
Can you guess what the result was? Both my high-end gaming laptop and my shiny new Windows 7 systems where deemed unworthy.
But no worries, there was a link to fix the problem! Let's see, I only need to "upgrade" my graphics driver... and graphics card... and monitor. And while I am at it, also the cable and connectors.
The "Joe User" in me thinks immediately: Wait a second, this is the exact same machine which smoothly runs Hulu. And Netflix. And DVDs. And games. Oh! And high-def movies rented from iTunes.
In short, the real reason that Directv wants me to burn several hundreds of dollars on new hardware is not to increase performance for me. It's to add copy-protection (user restrictions) features for them!
This is a great example of the fallacy of DRM: I can download and view a pirated copy of any blockbuster movie in a blink, but I can't watch legitimate content that I paid for. Wonder what the moral lesson here is?
Oh.... I just noticed that my Directv contract is almost up for renewal... Maybe that dish can be a nice bird bath for the garden?
Yesterday, I experienced something that many people are already familiar with: A jury summons.
The paperwork explained how I was randomly selected from the DMW or voter database (which I am not part of), and to present myself on October 10th at a particular courthouse. It came with apologies, helpful information and a parking permit.
There is only one big problem:
I am not a U.S. citizen, hence not legally allowed to be a juror.
Yes, I could send in the form, with proof of my non-citizenship, and I would be "excused" from this duty.
But that is not the point.
Think for a second what would happen if I "played stupid", and showed up at the requested time and place, Californian drivers license in hand? Would anybody have checked anything at all? I strongly doubt it. Then continue the thought: What happens to a court case if one of the jurors turns out afterwards to be "ineligible" ? IANAL, but "instant mistrial" sounds like a likely outcome.
Lessons here: Don't re-use database information for other purposes, especially if the authorization levels are different. Being able to recognize a stop-sign is not the same as being able to judge a serial killer.
Luck has it that I found a picture on a lolcat-related site that illustrates some points better than any presentation I could give.
When asking somebody to manage your security, think about bacon and eggs, and ask yourself: Is this person a pig (committed) or chicken (involved)?
So, when you have the lowest bidder managing your critical systems, don't be surprised to get exactly what you asked for.
Recently, I had to look up something on website ran by a local college. Of course, the site broke (the pages did not load within the session timeout), so I fired off an email to their listed support email.
Here is what I got back:
Auto-Reply
We have received your email enquiry. Please try one or more of the suggested solutions below. Web help is available Monday through Friday 8am - 4:00pm (not available weekends and holidays). If you reply to this email, please provide your full name, Soc. Sec. No., birthdate, and your current address.
Quick help
New Applicants: you will be able to login to the WebAdvisor one business day after you have submitted your application.
Step-by-step Web Registration Instructions:
http://(removed)/spring09/fullSchedule.pdf
Account Lock-out:
Wait 10 minutes and try again
Password and login help:
If necessary, please go to the WebAdvisor web page and select "What is my User ID?" from the Student Menu. Provide the required information to obtain your User ID.
Then select "What's my password" from the Student Menu.
Select "I don't remember my password" and provide the required information.
A new password will be emailed to you.
Password must be 6 to 9 characters in length and include both letters and numbers, no special characters
If you are still having problems, please contact the appropriate
Admissions & Records Office
(Contact Information removed here)
Thanks
I just rediscover this very entertaining post about a man's quest to have his signature verified when making a purchase.
So when does anybody look at the signature on the back of your card.
The short answer: Almost never.
Automated systems don't read it.
Humans never look at the paper receipt.
Most waiters only pick up the signed statement after you left the building.
And don't get me started on these "electronic signature" pads at grocery stores:
At first, I (quite naively) expected them to do a fancy AI signature comparison on the fly. That would be logical, since most of the time, the cashier does not even see what you wrote on her own screen.
After a lot of experimentation, I have reverse engineered the complex algorithms in these machines that decide on whether a signature is accepted or not.
It goes something like this:
10 DRAW(Blank_Rectangle, Buttons)
20 WAITFOR(Ok_Button_Pressed)
30 IF (NumPixelOnScreen < 20) THEN
BEEP
GOTO 10
40 ELSE
50 ACCEPT SIGNATURE
60 PROCESS(Transaction)
That's it. So a blank screen or a single dot wont be accepted. A straight line or any drawing that you can come up will.
Again, that's regardless of what is on the back of your card. Even if it says "SEE ID".
Side note: The whole idea behind "SEE ID" is that is would somehow be harder to fake a driver's license than a signature. If that is true, how come all those teenagers are using fake licenses to get alcohol?
So should you or should you not sign your real signature?
Let's run the scenarios:
When you sign your real signature:
- The shop has proof you made the purchase, can hold you liable.
When you don't sign your real signature:
- You gain time, since a quick swipe of the pen to draw a line goes a lot faster.
- The shop can never prove you made the purchase. If the purchase ever gets contested, their "image proof" will be laughed out of court.
I'll let you decide on this one...
The updated numbers are in! Currently there are over 755 thousand people on the terror watch list. All these people are deemed by our benevolent leaders too godless communist liberal dangerous to fly (but not enough to be arrested).
Other number: The current population of the US of A is 301,139,947.
A little math tell us that this translates to roughly 0.25% (1 in 400) being a "bad guy".
Personally, on any given week, I see hundreds of people. Dozens in the office, dozens in at the grocery store, hundreds just walking by. So... mathematically, I must have missed pointing out terrorist right next to me on several occasions!
This blatant personal carelessness about national security is shaming.
Henceforth, I hope you will join me in making our streets safer by publicly wrestling down and reporting to the police anybody who looks "suspicious", "dangerous", "different"!
I leave it to your personal threat assessment to choose what particular appearance attribute to discriminate guard against: Mustaches, skin/hair color,..
All is fair in love and war!
Only with your help can we make things safe and clean again! Do it or the terrorists win! Think about the children! God is with us!
