Warm and Fuzzy

It's nice to hear about some new online scam or phishing method, worry slightly because it's really clever, but then realize that I'm actually not exposed to it. Well, not as exposed as I could be.

Here's an explanation of a new type of phishing attack. Basically a tabbed malicious page can tell when it's not in focus, and when you're not looking it will change itself to look like a familiar login screen, Gmail for example.

Distracted users click over to that tab, assume they left Gmail open and enter their credentials without thinking about it.

So why am I not exposed? Or as exposed? 2 reasons:

1) I use No Script, the Javascript and Flash blocker for Firefox. You can block or unblock sites. I have Google unblocked, so if I got a notification that Java or Flash were being blocked that would be a helpful yet easily missed clue that I'm not on the site I think I am.

2) I use an in-browser password management plugin. If my user name and password aren't already entered in the form (and it wouldn't be because the domain has to be right for them to enter information), I'll know something's up.

Three password management plugins I have used (and like):

Xmarks - it's decent, I currently use it for bookmark syncing but not password, though I have used it for pasword syncing with no trouble. Xmarks also allows you to view open tabs on other computers a la Weave.

Mozilla Weave - for Firefox only, it syncs passwords, bookmarks, open tabs and history. I stopped using it as it would regularly lock up my netbook during it's scans/syncs.

LastPass - A fairly secure (I hope) password safe that works with most major browsers, and there's a bookmarklet to use in browsers that don't support it.

Another reason to drool over the N900 (Mobile Weave)

I had a N800, the first or one of the first mobile devices to use the Mozilla web rendering engine. I really didn't notice any difference between Mozilla's engine and the N800's stock engine, so it wasn't a big deal to me.

In addition, it wasn't a big deal to me when I heard that Firefox for Mobile would be used on the N900, either. Until I heard that it supports Mozilla Weave.

Weave is an addon for Firefox that syncs bookmarks and passwords like Xmarks, but in addition it also syncs history and tabs that are open on your other devices. I just started using it today (on my desktop and netbook, I don't own an N900 yet), so I'll have a more in-depth Weave post in a few days. Watch this short video to see Firefox's mobile browser in action on the N900 (Weave is only touched upon briefly), I'll talk about more after.



Imagine you're at your desktop, reading an article online, waiting for a friend to come pick you up. You get a text, your friend is outside. You go to a restaurant where there's a 30-minute wait. You can now pull out your phone and resume reading the article you were reading at home. After that, you can continue your browsing in full on the N900, because it supports the full web.

That's really cool. Another reason to buy one.

David

5-minute Soapbox (Passwords)

You know, it really pisses me off when services make me jump through hoops when setting up a password. Hey site whose name I won't disclose, I just gave you a 20-character password using a random combination of letters, symbols, and numbers, but you won't accept it because I didn't include an uppercase letter?

Maybe sites need a check box saying, "I am capable of assessing the risk of my own password." Or, "I know I shouldn't use my middle name as a password." Or, "I do not need a babysitter at this particular time in my life." I understand why Facebook might want to enforce a certain level of password security, because my grandma uses Facebook and she also trusts every pop-up and banner ad she reads. This site I'm registering at provides advanced services for web administrators, something that requires a certain level of knowledge about the technology being used and it's security risks (yeah, that doesn't guarantee a lack of stupidity, but shut up, I'm being angry).

I also understand that using uppercase letters along with lowercase letters increases the number of possible characters by 26, from 66 to 92 (roughly, just looking at my keyboard). Meaning that with a 20-character password, using lowercase letters only means there's a frighteningly small number of possible passwords:

1,353,669,535,298,323,102,197,037,856,681,569,026,048

But using uppercase letters, too, you get a large, safe, un-guessable number of possible passwords:

1,886,933,291,627,965,536,395,870,951,737,944,702,976

Wow, that safeguard kept my ass out of the fire, for real. Look how exposed I would have been had they not forced me to use uppercase letters! Thanks, web service that will remain anonymous, now fuck off.

David

(BTW I got the numbers '66' and '92' by counting the number of characters available on my keyboard, it was a quick count, and it's probably wrong)