Posts by Danny

winning bid...

Just for the record the winning bid was £14,500.10. They must really have a sweet tooth. (Okay, it was all in aid of the Retail Trust charity.)

£10m bid? Oh, how the hoax bidders must have laughed.

csrf is suble

@Anomalous Cowherd

Nothing technical about it. It can be coded either way. The server has all the same information. With broadband, conventional page reloading is not the tedium it once was with dial-up. I'm in agreement about the slick interface for an app feel. There are some very good ones out there. For the discussion of the article, however, the former does not demand JS, the latter cannot function without it. And JS opens up the prospect of CSRF...

@James Butler

It has nothing to do with phishing nor input validation. It is impersonation and forged requests. My website can be perfect but can still be the target of attacks from another site with XSS holes. But (and it's a big but) the requests are from my customers. I cannot distinguish real requests from forged ones unless I make user access such a pain that nobody wants to visit. With CSRF you'll realise there is almost no easy defence against it /and/ keep all your users. Hence the doom and gloom of the article.

To recap, it happens like this. We have four agents in this scenario.

- Bob, at home, using his browser.

- SiteA, perfect, with no XSS holes or anything. Perhaps a bank.

- Sid the bad guy who want to rip off Bob's account at SiteA.

- SiteB that hosts the malware created by Sid. A forum or blog perhaps. Could be a site owned or 0wn3d by Sid and/or has exploitable XSS holes. The malware is a combination of html (iframes etc) and javascript as needed to execute the CSRF.

(1) Sid puts malware on SiteB.

(2) Bob visits SiteA and logs into his account. SiteA sends Bob a cookie (a random token or nonce) so that further requests from his browser do not require him to re-enter his password for every requested page (a convenience feature).

(3) While still browsing SiteA, Bob opens up a new tab and surfs into SiteB.

(4) His browser downloads a page from SiteB along with Sid's malware. Remember, the browser will not allow SiteB to access SiteA's cookies. Not now. Not ever (bugs in IE excepted). His browser displays the page. The html part of the malware open a 1x1 pixel iframe to http://SiteA/... Bob can't see it as it's so tiny and tucked away. The javascript part of the malware has access to the cookie for SiteA and any request from within the iframe to SiteA will include this cookie (same-domain rules). The malware builds a request and sends it to SiteA, say a form POST. (GET attacks that do damage should be a thing of the past now.)

(5) SiteA receives this request. It is coming from Bob's browser at his IP address along with the Bob's cookie for SiteA. The server checks the cookie and sees that it's a valid cookie for Bob's current session and executes the request. Fill in the blanks of what the request could be. SiteA logs the request, IP address etc.

(6) Much later Bob complains to SiteA that his bank account is now empty. SiteA examine the logs and sees that it was Bob who made the request and tells him tough bananas.

Hopefully it will be clear now why the various solutions in the article have been given. It's the result of using iframes, xhr and javascript to sidestep same-domain rules set up to protect cookies (themselves used to overcome the limitations of stateless pages).

While it is up to SiteA to do all they can to thwart this (they don't want customers being ripped off) you need to be aware of what might be going on while browsing. If you browse one site at a time, logout and delete cookies before going somewhere else then leaving JS on is just fine. If you like to have many tabs open (I do) then you need to make the necessary security adjustments. You could keep one browser strictly for online banking.

A long post but I hope it clears up why this is important. It's not that I hate JS (or Web 2.0), it's that it's too dangerous to just give it free reign for no really good reason.

late great bill hicks

@Hud who? Too true.

@Hud. Check out YouTube. You know the drill.

Looking at this optimistically, this can only be a good thing - a whole new generation will be turned on to his works and begin a journey of enlightenment and clearer thinking.

ID Cards are not about security

As we all know ID cards have nothing to do with security. The security experts all say its about control. And a big fat gravy train for Herr Brown and chums.

'A National ID Card Wouldn't Make Us Safer'

http://www.schneier.com/essay-034.html

'Ex-MI5 Chief Calls ID Cards "Useless"'

http://www.schneier.com/blog/archives/2005/11/exmi5_chief_cal.html

and many others...

UCE vs spam?

I always thought the first spam (vs UCE) appeared on Usenet (early '90s?) where two US lawyers cross-posted advert-laden messages across thousands of groups. Cross-posting on its own is a capital offence on Usenet but advertising as well! Regardless of the flame war they created, the two mother lovers were proud of their stunt.

My point is at the time there was differentiation between UCE (what is now email spam) and Usenet spam. I don't really see the need myself but some pedants at the time were quite adamant about insisting on the correct terminology...

Oh yeah, clicking on and/or buying from a spammed link should be punishable by public boilng.

Farewell

Farewell Arthur C.,

You've been an inspiration. Now you'll know if it's full of stars.

An interesting idea

So many times when searching all I get is a blizzard of directory sites. Usually when looking for odd behaviour of product X and all that shows up is sites informing you of sites flogging product X. Excluding these sites from the search would be brilliant.

I guess they don't want to affect the global status of links thus the need to be logged in. Google won't spy on us surely? Nah. If we have to log in then maybe be able to create preset search parameters to make similar searches a breeze. (If Google are reading this!)

It would be useful to be able to tag or categorise sites and be able to include or exclude them when doing searches. Or be able to specify the type of site one is looking for. User tags might be more useful (and avoid sites keyword spamming) with some kind of evolution of the fittest process so that weak tags (left by some ranter) are eventually culled and the strongest appear first. Hey, sounds like a patent idea (TM).

why?

Windows Live - Why?

Windows Live - Don't even think of visiting using Linux

Windows Live - When we suck, you suck too.

Windows Live - The world is not enough.

Windows Live - Assimilate and extend.

Windows Live - We are not a commodity.

Windows Live - Better dead than Windows.

Windows Live - You'll wish you were dead.

Windows Live - You'll wish M$ was dead.

Windows Live - Spam, not content.

Windows Live - Only one ActiveX plugin away...

Windows Live - Where clear thinkers dare to tread.

Windows Live - A World of Pain.

Windows Live - Abandon all hope.

outdated business model

Religion is nothing more than an outdated business model and, much like other businesses we've seen, its CEOs are clinging on to old ideas and suing all and sundry around them to have their way.

In its time it was the law when there wasn't law. It was about controlling the plebs. A commentary on how to behave in social situations and the like. Not eating swine is handy health advice in hot climes before the invention of the refrigerator. Now we have 'fridges it's redundant advice. Now we have our modern-day laws. Now we have science and understand there is no god or gods. Only atoms and the universe.

Science has demonstrated time and time again the fallacies in the various Good Books. Earth-centric universe anyone? Earth created 6kya? Total lack of mention of dinosaurs? How about the various "acts of god" demonstrating there is nobody out there or He is indifferent to human suffering. And while religious intolerance has caused more killing than anything else in human history I think the psychopaths in society will just find some other reason to kill each other.

I've read most of his books I can see Dawkins is an astonishingly clear thinker. People are opening their eyes and seeing that the indoctrination they were subjected to as kids is just nonsense.

Religion is dying concept. Get over it.

tragedy

It's ironic that the two who thought they had a hot young date turn out to be both middle aged. The sadness is the guy then couldn't see the funny side and have a laugh over it and maybe make a good online friendship and instead became obsessed to the point of killing.

The BBC Worldservice podcast go into some detail about the incident. Get 'em while they're hot (only kept up for 7 days.) Look for chatroom murder 22 Nov 2007:

http://www.bbc.co.uk/radio/podcasts/docarchive/

There must be some moral point to this story that presently escapes me...

secure

By "one secure location" you mean "central location unencumbered by passwords or encryption or anything allowing easy access by all and sundry."

I get it. The best way to prevent passwords being compromised is dispense with them altogether. Hurrah! We're secure!

biometics

Some people will never learn. Using biometrics for identification is a fatally flawed concept. A compromised password or bank account details is hassle but they can be replaced at the drop of a hat and normal life resumes. If the biometric hashes for your id are stolen what do you do? Get a new id? New fingerprints? Iris? Humm. Thought so. And it only has to be compromised once by some minimum-wage flunky...

This compromise demonstrates that no government department is fit to hold this data regardless of how much they promise to look after it.

Go and read Bruce Schneier's books (and others) for the grisly details.

I can only think that some chums of the current and previous Junta are setting up a big fat IT gravy train and they've seduced enough ministers into the ridiculous notion that it will somehow make the world a safe and happy place.

FAB

I remember some of the older geezers (the real UNIX grey beards) reminiscing over the PET when the Amiga was still king. They had fond memories. I was a bit too young at the time and was still drooling over Princess Leia (or was it R2D2) at the time. I love the Deep Thought photo.

A built-in cassette deck? How modern. Clearly Commodore didn't want any of this mucking around with cassette leads like we had to with the Speccy. It wasn't until the CPC when Sir Alan slapped a deck onto the side of his carbuncle.

I still have a Tatung Einstein and several Speccys and ZX81s around somewhere. The Amigas are still a joy to use. Doing stuff the upstarts of today can only dream about. Linux is the closest I'll ever get to the robustness and flexibility of the Amiga...

When I were a lad we used to 'ave to squeeze subroutine in't 100 bytes, graphics, sound an all, using hand crafted assembler, an't use ROM image for random numbers. And still have bytes left. Try you try telling that to the kids of today... and they won't belief you.

Rabbit?

The rabbit commercials. That takes me back. I remember some spotty oik (was he from Grange Hill?) that said you can make calls whereever you see the 'rabbit' (sounds trippy now I say it).

My first 'phone was the Motorola v3688. I seem to remember it was call the v.small and the ads had a tiny baby tortoise crawling on it or something. Still pretty small but not as slim as todays models.

Octoskin

This mucking around with cameras, projectors, metamaterials and other advanced technology is altogether unnecessary. All one would need is a large octopus skin (or several sewn together) within which to enclose the tank and an octobrain as the central cloaking control mechanism. How hard can it be?

Who did what to whom?

I know Japanese names all look the same but there seems to be several switcheroos in the article regarding suicidee and genders. No?

Darwin Awards

At least bad drivers will be quickly and efficiently culled from the herd.

It sounds like a fab idea. Likely huge repercussions for society. Think of the mayhem as the paparazzi chase celebs around the sky. Weekend in Paris? Customs? Pah! Mobile phones won't work properly though (maybe a good thing). How will the speed Taliban persecute the motorists now? No more getting stuck on a windy road behind some dodery airhead towing a caravan...

Sky-loving Shill Alert!

Who's been suckling on Murdoch's oily teat then? Normally I'm not one to attack a person for their misguided views but such a brazen and offensive DTT hit piece could not go unremarked.

Analogue vs digital? Do you think anyone other than us geeks know or care about the underlying technology? Your fixating on the tech. To non-geeks it's just a TV channel. Nothing else.

Sky subscribers are a sad bunch of sheep. they get shafted paying an outrageous subscription for trash channels and are still inflicted with adverts! Rupert Murdoch is laughing in your faces.

Handing the TV monopoly to megalomanic Murdoch? I guess you get your OS from Microsoft too? If we allow such a monopoly all we will end up with is shit on every channel targeted at the lowest common denominator (see Sky).

I take it you must be a marketeers dreamboy. You eat at McDs, holiday at Disneyland, watch Sky and buy your jewellery from QVC (I'd say watch The Peter Serafinowicz Show but we know how much you hate the BBC).

I'd happily pay the TV licence just to fund the BBC and Channel 4. They are the only ones with (mostly) excellent and interesting programming. And I'll never give RM even a single penny. Ever.

gun>foot

<sigh> yet another case of self-inflicted foot in mouth disease. Anyone who wants to rip the movie will have done so. Punishing the users who are *actually paying money for the stuff* will end up with them return the crap for a refund.

To Sony: remember this at your peril. Destroying customer's expectations will be rewarded by them being scared away from making furthur purchases. And in this market there is competition. Remember the Memory Stick incompatibility fiasco? I do.

@John Carter

yes, windows software shrinks your willy. Linux gives you 25% (or more) prowess power. That's a fact.

John C. Dvorak and crankygeeks.com

"John C. Dvorak talked about this in his column weeks ago.

http://www.pcmag.com/article2/0,1895,2188281,00.asp"

OT but, there's a link from the pcmag site to JCD's crankygeeks.com where he has a video magazine thingy. Watching the latest episode now (#83) and noticed there's some guy on the show called Drew Cullen from The Reg...

Why?

Amazing. Let's see if I've understood this.

(A) Use Google or OpenOffice giving unrestricted access to your files using standard open file formats.

or (B) Use a service that requires MS Office or restricts access to your files and uses non-standard closed proprietary file formats.

Humm, difficult choice.

rules...

@Sam

>>"(5) You must point out spelling, grammer, calculator gaffes and other faux pas. Try not be overly smug."

>"...It's "GRAMMAR", you peasant!"

Oh, the irony.

(10) Do not ever forget this: your computer hates you. Features such as, say, the spell checker, will bite you back at a moment precisely calculated to be the most inconvenient and embarrassing.

(11) You must blame the computer for suboptimal processing of data in the vain hope of diverting attention away from one's failings.

just say no to js

XSS and Javascript: Or why you shouldn't just let arbitrary code run on your machine.

Just switch it off and let sites that demand javascript be enabled know why you aren't shopping there anymore. Ditto Flash. Or if that's a hassle, have a separate browser for these sites and set it to delete all cookies on exit, and only visit one site at a time. I keep Mozilla for this purpose. Konqueror with js off and no plugins for general browsing.

Of course, XSS, can be prevented if the sites in question are ruthless with input filtering and html quoting. If. Having some js to do frame breakout will make iframe injection attacks pretty obvious. Ahh, frames. Don't you wish you could go back in time and give that smartarse at Netscape a good kicking. It would have been nice for a site to inform the browser than js should be disabled for this page regardless of any other setting or outer frames. But it's way too late for that.

CSRF is a trickier beast. It's your site (which naturally is perfect) being attacked by a badguy or compromised site. As the request comes from a legitimate user of your site, or technically from their browser, discriminating a genuine request from a bad one is a knotty problem. A solution being to ask for their password to confirm serious actions.

Or, ironically, have some js detection code to say "This site best viewed with JS off."

The joys of unintended consequences...

You know what to do...

This is just one of the many reason why 98SE was my last Windows. It's been said often enough and I fail to see why everyone is surprised when MS screws them, again.

Get Linux. Be in control of your own destiny.

metabolism

I heard that chilli also speeds up the metabolism so you lose weight, or don't put it on, or something. At least that's how I understood it. Sounds as amazing as that wonder-cure-all herb, garlic.

Right, that's tonight's menu sorted then.

trippy

Hey, they're pretty cool if a little geeky. Would be a talking point at a party and depending on the type of party you could get twice the trip. And if they come with headphones, Terminator sound effects, real time object identification system and list of handy responses for when one's grey stuff is off playing with the pixies...

uSSD size

With only shillings and their ilk for size comparisons, just how many the-area-of-Wales is George Washington's head?

@ashley: typo

"...Google could care less about that though..." should be "couldn't care less" - it doesn't make sense otherwise, unless Google do want to release their code?

Google wanting to keep their own code as a trade secret is completely understandable. So long as it is in-house I don't see why there should be a problem. I guess they figure that such things like the search and ranking algorithms are part of what makes Google different from other search engines. I wouldn't be expected to release the code for my website just because I'm using a LAMP setup?

Of course, nobody's forced to use Google, Gmail etc, unlike, say, wanting to play the latest game, which pretty much demands Windows. (Though I do have Quake III for Linux.)

As for moving from Google webmail to Yahoo webmail (which I think is what you're suggesting) why would one want this? Sign up for both (they're free). Tell people one or the other depending on whichever has your favour that month. If it's not being tied to a single ISP that you're after get your own domain and redirect email to whomever you like.

Deep Trouble

Humm, would the RN submarine system be Deep Trouble?

http://www.bbc.co.uk/radio4/comedy/deeptrouble.shtml

Broken Calculator

"The system is now being run on 32 IBM HS21 high-density, dual-processor, dual core Blade Servers, which gives it 68 processors and 128 cores..."

That would be 64 processors, surely? (and don't call me Shirley)

Use Knoppix

As well as the usual stuff of not using IE nor Windows, if you need access to your online bank the simple solution is to boot from Knoppix. It being a live-CD that doesn't touch the hard disk you can use it with confidence even if you are uncertain about what may be lurking within your OS.

Connection to Ethernet modems is easy-peasy with DHCP - no configuration required. Your milage might vary with a USB modem (throw it away and get a real modem). Even though I'm a happy Debian user I still use this technique to access my bank, just to be sure. Rebooting the machine is a hassle but it is *your* money that's at stake.

http://www.knoppix.net/