Square Galaxy » Security

New type of address encoding

Jacob — Sat, 09 Dec 2006 13:52:30 +0000

I got this phishing attach in my inbox. You know, one of those that look like they are from paypal or someone, but they really aren’t. They give you links that they ask you to click on, except that the links don’t go to paypal’s server, they go to some other site that looks like paypal and tricks you into providing your login credentials. None of this is new.

What is new is how they are providing the address in the link. They provided the IP address in hex. So if I were to represent the address to my server, it would be: http://0xcf.0×2d.0×41.0×24/

I thought this was very interesting, so I tried it in Firefox and Opera on my mac, and neither were tricked. Both browser’s didn’t convert the hex to the real IP address, so it didn’t work. But it makes me wonder if there are browsers out there that might be tricked by such IP address encoding.

NBCOlympics gave away my email address Before the 2008 Olympics, I was at NBCOlympics.com looking for...
Shrink that URL The web is built around addresses to web pages, often...
BYU’s new website theme fosters identity theft On February 15th, BYU will launch a new look and...

Is the logout button obsolete?

Jacob — Wed, 22 Nov 2006 10:18:22 +0000

I must be a nerd because web site security worries keeps me awake at night. Tonight I was worried about particular web site designs that might discourage users from logging out and I was curious about how many users were actually logging out.

I checked a couple of systems that I have access to, and the numbers aren’t good. I sorted through the web server access logs and counted (using the unix wc program) the number of times that the login script was accessed verses the number of times the logout script was accessed.

The ratio of logins to logouts isn’t good. One website I checked only had logout numbers that were 2% of the login numbers. Another site did better, but the percentage only went up to 20%. This means that 4 out of 5 users aren’t logging out through a logout button.

The number of users who logout through clearing their cookies, either manually or through quitting their web browser application, is a much more difficult number to ascertain. It is also hard to gauge how may users may be the only user with access to a computer and are thus not even interested in logging out.

Websites which integrate the logout button as a critical element of their web site security plan should re-evaluate their plan.

Adobe Error Today, Adobe announced a new product: Adobe Air. The basic...
BYU releases new web site look Today, BYU released a preview of their new look for...
Broadband usage grows ldsWebguy recently blogged about the growth of broadband usage. He...

Using GPG For Signing Messages on a Mac

Jacob — Thu, 12 May 2005 03:21:18 +0000

GPG is a way to digitally sign email messages so that other people can know that they came from you. It can also be used to encrypt messages. Getting GPG to work is easy if you know the right way to do it, or difficult if you don’t. Here are some steps for the Mac user to get started with GPG:

http://macgpg.sourceforge.net is the best place to start off. If you want to understand in great depth about all the stuff, you should read the FAQ document (RTF).

First download and run the GNU Privacy Guard installer. This will install all the GPG tools onto your system. However, unless you like using the command line, you probably want to install a couple of graphical programs. I suggest GPG Keychain Access which will help you create and manage keys. I also suggest GPGPreferences which will help you configure the GPG tools, although you probably won’t need to do much with it.

You will probably want to create yourself a key which you will use to sign your emails. You can do this in the GPG Keychain Access program.

Next, you will want to make sure your email program is configured to use your GPG key. If you are using Mozilla Thunderbird, then you can install the GPG plugin called Enigmail. If you are using Apple’s Mail program, you should download, install, and use a plugin available here.

Follow any of these instructions at your own risk. I am not responsible if you or these programs screw up your computer.

Cleaning out the inbox I think we all probably manage our email in different...
Cyberduck Despite having a pretty cool name, Cyberduck is a pretty...
NeoOffice ships version 2.1 I’ve been using OpenOffice.org on macs long before I even...