bioneural.net » security

Gearing up for SSL to WordPress with Safari

Bruce — Wed, 17 Sep 2008 10:19:01 +0000

A friend brought an impending WordPress security exploit to my attention, in the form of a CookieMonster. Your data might be at risk if you administer your blog from a public Internet connection (e.g. WiFi in a café). Securing your authentication cookies with Secure Sockets Layer (SSL) provides a defensive countermeasure for your admin loggins, and WordPress.com users now have a checkbox to "Always use HTTPS when visiting administration pages". That checkbox is absent in self-hosted WordPress 2.6.2, but here's how to enable HTTPS and accelerate your admin sessions using Google Gears via Safari. Lock up all your cookies with a secret key You may have already defined a SECRET_KEY to secure the cookies that store information about your visitors, a feature introduced in WordPress 2.5. If you didn't do this visit key generator 1.0 and copy the output into your wp-config.php file after the opening PHP tag, so it looks something like this (don't use this one):

ATMs should be avoided. The Internet too.

Bruce — Thu, 13 Mar 2008 14:59:22 +0000

From http://www.bioneural.net :

Some cretin recently cloned our debit card, in reflection of rising UK and international rates of card fraud despite technological countermeasures like "chip and pin". Of course it makes us angry, and think of doing all sorts of unsavoury things to the perpetrators if we could confront the cowardly faecoliths. But the good news is we will get a 100% refund from the bank because they acknowledge we were victims of a security lapse; our credit rating is unaffected; and new cards were issued promptly with new numbers. Of course we wanted to know if there was anything we could to reduce the risk of this happening again. We asked the bank if it was safer to use the ATM inside the branch rather than the hole-in-the-wall outside. They said probably so, since it would be harder to attach a device to the machine inside without being noticed. But we would be better still to make over-the-counter cash withdrawals and avoid using ATMs altogether, they said. That's reassuring—not. ATM without (top)/ with (below) "skimmer" attached (© APACS) There are still lots of people out there that won't go near online commerce, because they perceive it to be unsafe. I'd always thought someone was more likely to double-swipe or copy my card out the back of a restaurant than commit fraud online, but actually the risk is around 1:2. Figures from 2007 for UK-issued cards show that phone, Internet and mail order fraud (card-not-present fraud) amounted to £290.5 million, while counterfeit (skimmed/ cloned) card fraud ...

An exercise in wireless frustration

Bruce — Fri, 11 Jan 2008 14:17:34 +0000

From http://www.bioneural.net :

Having spent the better part of two half days trying to achieve the impossible, I wish to recount an exercise in wireless frustration. The challenge was to hook up an iMac G4 (Flat Panel) with no Airport Card, located in the attic room, to my home LAN (and thus to the Internet). One purpose of this machine was to serve as a screen for streamed video that could be watched while using the exercise cycle. A TV had provided such distraction, but that had broke. To cement the challenge, the problem should be solved using equipment already to hand i.e. at no additional cost. My "BeBox", the hub of my home LAN, is actually a SpeedTouch 780WL WiFi router/ ADSL modem. The router's wireless access point (WAP) offers 802.11b/g, which is secured with Wi-Fi Protected Access (WPA) encryption—the earlier Wired Equivalent Privacy (WEP) standard is considered insecure. A slow, insecure option that worked It's worth noting that the original Apple Aiport Card appropriate for this machine can still be had on eBay for £30–40. Although this card is WPA-aware, it is only 802.11b (11Mbps) and thus not suitable for streaming. I know this to be so because the first device I tried was the Linksys WET11, a wireless Ethernet bridge. For the record, because it took me some time to discover, this device has a factory-default IP of 192.168.1.225. However, before you can connect to it using Safari (or any other browser), you need to manually assign your Mac an IP address in ...

Stop Gmail sending passwords in the clear

Bruce — Mon, 09 Jul 2007 20:00:17 +0000

From http://www.bioneural.net :

Make Gmail Notifier use a secure HTTPS connection when checking your inbox: hold down Command and Option keys while clicking Preferences in the Notifier menu and enter "SecureAlways" (without quotes) for Key and "1" for Value, then Set before quitting and re-launching (via maxoshints.com).

OpenDNS cure for slow net?

Bruce — Sat, 10 Feb 2007 05:25:01 +0000

From http://www.bioneural.net :

I've been hearing about OpenDNS a lot lately: a solution for slow Xtra connections; Stamatiou calls it über; Lifehacker named it one of the best apps of 2006. Not only faster, but safer (auto-corrects common URL misspellings) and smart (warns against phishing), it's simple to use—just tell your broadband modem the IP addresses of the OpenDNS nameservers.

Secure data exchange from Mac to Pocket PC

Bruce — Sun, 16 Oct 2005 08:09:35 +0000

From http://www.bioneural.net :

Houston, we have a problem. One of the biggest issues facing a Mac user making the transition to Pocket PC is the lack of software to synchronise secure data between the handheld device and a desktop Mac. Until such time as a developer addresses this market opportunity and creates a sync solution, here's a tip for transferring data exported from PasswordWallet for Mac and securing it on the Pocket PC. There are several good secure information managers for the Pocket PC. These include CodeWallet Pro ($US 30) with synchronisation to an optional Windows Desktop Edition ($US 30), eWallet Professional Edition ($US 30) which includes sync to a Windows desktop edition, FlexWallet 2005 ($US 25) which includes sync to a Windows desktop edition, and SplashID (free) which includes sync to a Windows desktop edition ($US 20). The latter company also has a Macintosh Standalone desktop edition ($US 30), but this syncs to Palm devices only: there is no means to share data between the Mac version and Pocket PC version! I've been using PasswordWallet (Selznick Scientific Software) for Mac and Palm (with Hotsync Conduit) for the past four years, upgrading each since my original purchase because this pairing suited my needs well. What this software lacks in features it makes up for in ease-of-use—and that's what makes a good product: Unfortunately, despite the new Missing Sync for Windows Mobile (MSWM) plugin architecture, no one has yet taken advantage of it to develop a plugin to allow the synchronisation of secure data between Mac and ...

Visiting the other PDA platform (first 48 hrs)

Bruce — Fri, 14 Oct 2005 14:31:03 +0000

From http://www.bioneural.net :

Palm or Windows Mobile? I've been firmly in the Palm camp to date, but have just acquired a Pocket PC together with Missing Sync for Windows Mobile. This is not a review of the Dell Axim X50v, but rather a functional comparison with my Palm T3 from the point-of-view of a Mac user. How did a Palm user making a trial transition to Pocket PC fair when pairing the device with Mac OS X? For given applications and functionality, does Palm or Pocket PC have the winning edge? Will he or won't he become a "switcher"? First impressions count, so I decided to document my experiences during the first 48 hours with a Pocket PC. There will be plenty to revisit in subsequent bloggings... The outgoing Dell Axim X50v Now superseded by the X51v, Dell were having a 20% off clear-out of the previous model, now 1 year old. The hardware is the same aside from double the ROM. Buying direct saved £77 over Expansys (shop around!) and avoided having to fight it out on eBay for a similar price. It cost me less than a Fujitsu Siemens Loox 720 "Grade B" stock which seemed like a similar spec alternative. I chose a "Windows Mobile 2003 for Pocket PC Second Edition" device because Missing Sync (see below) doesn't yet support Windows Mobile 5.0 (free update pending); Dell has announced that there will be a WM5 upgrade for the X50v (not free), so I have options. The X50v doesn't match my recent wish-list, but then ...

Using Gmail on a Palm T3

Bruce — Sun, 11 Sep 2005 17:53:19 +0000

From http://www.bioneural.net :

An advantage of using Gmail is that you're not tied down to your ISP's mail servers; sometimes these can't be accessed if you're not using your regular network connection. The Palm T3 ships with VersaMail 2.6, which Palm have since neglected to update (for T3 users). Unfortunately VersaMail 2.6 does not support connections to SMTP servers for sending mail over SSL as required by Gmail (for some reason SSL is supported for receiving e-mail only). Palm clients with SSL-enabled sending include: VersaMail 2.7, $30, but the T3 isn't officially supported; Mark/Space Mail, $30, instructions here; SnapperMail, Premier edition $50, instructions here & here. Of course you can still receive Gmail using VersaMail 2.6. If you also have an alternative POP3 account you can use this to send any important messages if you're not bothered about using a different e-mail address (Gmail lets you specify the "From:" address on outgoing mail). Update 14.09.05: I downloaded a try-out version of Mark/Space Mail and was able to receive Gmail, but unable to send it, with the log reporting "Failed to get proper hello response". I e-mailed Mark/Space Support and was told: This is a known issue with Gmail that has not been resolved. There seems to be a problem with the way our application interacts with the Gmail SMTP gateway. We do not have a solution for you... Update 15.09.05: I downloaded VersaMail (2.7) for Treo-Mac from PalmGear and installed it onto my T3. Despite Palm's lack of official support, it works fine—sending included. The successful settings I'm using are: Account Name: ...

Mac OS X malware and spyware

Bruce — Wed, 06 Apr 2005 13:24:22 +0000

From http://www.bioneural.net :

Every time a potential exploit is discovered in the "secure" Mac OS X operating system alarmists cry "the sky is falling". It hasn't fallen yet: you simply don't hear about OS X viruses and other nasties. But Apple releases a steady stream of security updates indicating there is some substance to the perceived threat. Obviously it makes good sense to download and install these updates promptly, and to use antivirus software (Virex comes with a .Mac account). But is there any need for, or means of, protection against spyware? Problem? What problem? Apple's Support database, as of this writing, is unaware of the search terms "spyware" or "adware". Microsoft's support database, however, is all too familiar with both terms—reflecting the relative size of the problem on the Mac vs. Windows platforms. A quick Google search for links to information about spyware or adware and Mac OS X turned up very little aside from scare-mongering. It did, however, lead to this article on The X Lab that documents the existence of spyware and solutions for detecting it under Mac OS X. Spector is a commercially available spyware application that can be installed on a Mac: Spector automatically takes hundreds of snapshots every hour, very much like a surveillance camera. With Spector, you will be able to SEE EXACTLY what your spouse, kids and employees have been doing online and offline. Most of us are probably more concerned about spyware we can inadvertently download from the Internet, rather than paranoid or voyeuristic partners or employers that have ...

AddressGuard: anti-spam tool from Yahoo!

Bruce — Sun, 04 Jul 2004 13:49:36 +0000

From http://www.bioneural.net :

The disposable e-mail address: it's often the simple ideas that work best... In an effort to reduce spam I give my personal e-mail address only to people I feel I can trust not to sell it. Previosuly, whenever a website asked for an e-mail address I gave them one from an old Hotmail account. But soon that account started receiving lots of spam: had the address been guessed, or was it passed on by some unscrupulous individual? Being one address and many websites, it was impossible to point the finger. Yahoo! (with Yahoo! Mail) and BT Yahoo! Mail (in partnership) came up with a solution I have made good use of: the disposable e-mail address. They call it "AddressGuard": The basic idea is this: you create (up to 500) "aliases" to your real e-mail address, each one of which can be assigned to a particular company or purpose. All of your e-mail arrives in your in-box as normal (or you could set up filters to re-direct it based on the alias). Using the webmail interface you can even use an alias as the "From:" address to send or reply to a message (sadly this doesn't work with your ordinary mail client, unless you manually add an account for each alias). BT Yahoo!'s help pages explain: Each disposable address has two parts: a base name and a keyword. Base name: The base name is the same for all your disposable addresses but it's different from your BT Yahoo! Email address. By using this profile, you ...