Love, Sex, Secret, and … God

This post originally written for my personal blog on January 11, 2009.

This past week saw two high profile security breaches on twitter.com and macrumorslive.com, each one a classic example of poor login management by websites. For full disclosure, I do not know anyone at either site but have read about each here and here as well as other websites. The short version on twitter is that an admin at twitter had a common word password and twitter has no limit on the times you can try your login. The short on Mac Rumors Live is that they either had no password on their admin interface or that the login page was sniffed, either way it was a bummer for them.

As a system administrator it is a constant challenge to keep our systems and the web applications that run on them secure while still keeping the usability that our great developers have created. So when I see things like the twitter and mac rumors issues I get very frustrated because the prevention of this is so simple. If you develop a website with user accounts, and most of them do, please consider the following.

Complex password requirements. Google returns about 232,000 results for javascript to check for strong passwords so you don’t even need to invent the wheel to add this to your change / create password page. If you don’t want to bother your users with this at least take some time to require it on admin accounts.

HTTPS, the S is for secure. Developers, please use ssl to encrypt your login page and use redirects to ensure that users don’t accidentally end up there without ssl. As more of us move out of the office and into the coffee shop we are also moving off of a private network and onto a public one. We log into twitter, brightkite, our blog, our email and most people give no thought to the idea that everyone else in that coffeeshop could now have your account and password, unless we use something secure like https. Webmail sites learned this lesson long ago and it’s time for the rest of the web to learn it too. The worst part of this is that most sites already have an https version of their site and it would be a very simple fix for them to redirect to it. For those sites that don’t ( I’m looking at you brightkite ), it’s time to step up, spend the money and get https going. For you wordpress users, setup a self-signed certificate (or purchase one) and wordpress has a plugin to do all the wp-admin encryption redirects for you.

More services are being provided via websites and as users of these we need to demand that they are secure. Give them feedback asking that logins be secure by default so that what happened with twitter and mac rumors doesn’t happen to you.

Reblog this post [with Zemanta]
2009
01/11
CATEGORY
Security
TAGS






401 comments

  1. Love, Sex, Secret, and … God | J Squared Consulting I was suggested this website by my cousin. I am not sure whether this post is written by him as no one else know such detailed about my problem. You are amazing! Thanks! your article about Love, Sex, Secret, and … God | J Squared Consulting Best Regards Rolf Rolf

  2. Definitely believe that which you stated. Your favorite reason appeared to be on the net the simplest thing to be aware of. I say to you, I certainly get irked while people consider worries that they plainly do not know about. You managed to hit the nail upon the top and also defined out the whole thing without having side-effects , people can take a signal. Will probably be back to get more. Thanks

  3. needless to say, diamonds bands might always be the best kind of wedding bands that you could offer your spouse,.

  4. Tag Heuer Monaco Steve Mcqueen

  5. christian louboutin declic pump

  6. It’s really a cool and useful piece of information. I’m glad that you shared this helpful info with us. Please keep us informed like this. Thanks for sharing.

  7. What’s up to all, I am also really keen of learning Personal home pages programming, however I am new one, I always used to read articles related to PHP programming.

  8. Hi there dear, me plus my mother are as well watch comic videos however after I done my homework

  9. Love, Sex, Secret, and … God | J Squared Consulting I was recommended this web site by my cousin. I am not sure whether this post is written by him as no one else know such detailed about my trouble. You’re amazing! Thanks! your article about Love, Sex, Secret, and … God | J Squared ConsultingBest Regards Lisa

  10. You made some first rate points there. I looked on the web for the problem and found most people will go along with together with your website.

  11. There are various thousands affected by discomfort allergic reaction in addition to basic Non-steroidal anti-inflammatory pharmaceutical allergy or intolerance. Recall, we have a approach to handle it. You have to get the many required safeguards as well as wear Healthcare Identification Jewelry to guarantee that you’re not by chance offered a new probably lethal dose with the drug by simply disaster staff.

  12. This will be a excellent blog, would you be interested in doing an interview about just how you created it? If so e-mail me!

  13. To be a adept drivers would depend read more about the protection areas of driving a car than simply the thought. Autos are like hazardous firearms if you do not realize how to make use of them conscientiously and follow each of the protection processes which can be discussed in this article.

  14. Excellent goods from you, man. Love, Sex, Secret, and … God | J Squared Consulting I have understand your stuff previous to and you are just too wonderful. I actually like what you have acquired here, really like what you are stating and the way in which you say it. You make it entertaining and you still care for to keep it smart. I cant wait to read far more from you. This is really a terrific Love, Sex, Secret, and … God | J Squared Consulting informations.

  15. Virility prescription medication is hormone imbalances supplements that will encourage the actual egg cell improvement along with launch this on the ovaries. This may also secure the ovulation along with early maternity advancement.

  16. Medicine residuals are simply throughout teeny portions inside h2o. Is it harmful? Simply no existing engineering could eliminate individuals footprints. Although troubling, science tecnistions claim there isn’t a instant danger to help human being well being. Additional scientific studies are essential but it really can take financing as well as period.

  17. Excellent goods from you, man. Love, Sex, Secret, and … God | J Squared Consulting I have understand your stuff previous to and you’re just too great. I really like what you’ve acquired here, certainly like what you are saying and the way in which you say it. You make it enjoyable and you still care for to keep it smart. I can not wait to read much more from you. This is really a wonderful Love, Sex, Secret, and … God | J Squared Consulting informations.

  18. Lab blood analyze study is a novel and definitive way in which to acquire strategies to many technically connected queries. Besides are usually this sort of testing utilized in your medical industry, but you are in addition employed in forensics, insurance coverage claims and several far wall, exactly where bloodstream study is required.

  19. Love, Sex, Secret, and … God | J Squared Consulting I was recommended this blog by my cousin. I’m not sure whether this post is written by him as no one else know such detailed about my problem. You’re amazing! Thanks! your article about Love, Sex, Secret, and … God | J Squared Consulting Best Regards Yoder Yoder

  20. A few years previously, this College of Pittsburgh School of Medicine initiated a survey to examine exactly what effects carrying excess fat experienced on diabetes mellitus. The reason for the survey would have been to aid a control party shed concerning 8 per cent with the excess weight along with observe the affect the idea experienced on their own diabetes mellitus signs and symptoms.

  21. This document will concentrate on a lot of the critical factors consider in choosing getting in touch with make use of an agency or even use privately. Your choice might have unintended effects. There exists a real many more endangered than merely how much it’ll cost you.

  22. We are fed a daily diet program involving indiscretions in addition to wrong behavior which includes crimes fully commited by means of both equally expert and school sports athletes. But now, we have a Globe Success athlete, he says that she dissapear as well as downs a couple of awesome types right after his ski competitions so we are meant to end up being amazed along with furious.

  23. In line with an exploration executed because of the David Hopkins Cancers Analysis Center, cancers solar cells cannot prosper inside an oxygenated method. That research furthermore said which the insufficient fresh air may be the cause of many ailments. Not maintaining a wholesome our blood fresh air degree can be quite harmful for your health also to your money. Maintaining a normal blood vessels much needed oxygen stage may be the first of Five methods for cancer malignancy prevention as well as highest overall health.

  24. Should they be allowed to drug test high school athletes? Here is from a recent interview with the head of High School sports in Illinois.

  25. Do you consider there is a proper applying for grants “fact compared to fiction” in terms of cosmetic surgery? Within a preceding post, 12 statements evaluating knowing about it of plastic cosmetic surgery ended up displayed. Test out your information even further together with the twenty far more “True as well as Fake?In . claims made available beneath.

  26. There’s a major drive in order to legalize medications in the us, in case that happens maybe it’s a actual catch-22 for corporations. By way of example, appears to be personnel can medicines and isn’t into their appropriate frame of mind they could produce an crash. If it’s a commercial accident a person may be injured or perhaps pass away.

  27. I wasn’t able to show excessive not the same information on this subject piece regarding content, so it had become great to discover his a. I will come back again to search through and the second postings that you’ve another point in time.

  28. The majority of shampoos as well as other personal maintenance systems do not possess the components screened with regard to safety prior to being distributed. Much better less likely which just about any one-time by using an appearance product or even plastic may cause any quick cause harm to, most people make use of a lot of goods every day, such as shampoo or conditioner, conditioner, make-up, solution, agents, etc., and all sorts of these exposures most definitely will add upward.

  29. Hello.This post was really motivating, especially since I was investigating for thoughts on this subject last Sunday.

  30. Thanks for revealing your ideas listed here. The other element is that each time a problem occurs with a computer system motherboard, folks should not take the risk with repairing it themselves for if it is not done correctly it can lead to permanent damage to all the laptop. It is almost always safe just to approach the dealer of your laptop for that repair of its motherboard. They have got technicians that have an expertise in dealing with laptop motherboard difficulties and can get the right analysis and conduct repairs.

  31. Hi dee hi generally there. Web site favorited the product artecle which i really should certainly look at it then later on on. All of us aplogize after the day it definitely seems to be stupid the truth that My wife and i was initially planning to n almost virtually any could possibly prove to use the proper way to total this site to this fact dekstop. At all, thnks again!!

  32. I wish to express thanks to the writer for rescuing me from such a matter. Because of searching throughout the world-wide-web and getting techniques which were not helpful, I figured my entire life was done. Existing minus the approaches to the issues you’ve resolved all through this guide is a critical case, as well as the kind which may have in a wrong way damaged my entire career if I hadn’t discovered your web page. The training and kindness in maneuvering all the things was very helpful. I’m not sure what I would have done if I had not come across such a solution like this. I can also at this point look ahead to my future. Thanks for your time very much for your reliable and amazing guide. I will not think twice to endorse your blog to anyone who needs to have tips on this topic.

  33. Thanks for all of your hard work on this blog. My mom takes pleasure in going through investigation and it is obvious why. A number of us notice all regarding the dynamic ways you convey invaluable techniques through the web blog and as well cause contribution from other ones on this subject matter plus our girl has always been becoming educated a lot of things. Take advantage of the rest of the year. You’re the one carrying out a superb job.

  34. The president and first lady are not concerned about being invited to those children’s wedding. How ludicrous to have made up “sources say”.

  35. The president and first lady are not concerned about being invited to those children’s wedding. How ludicrous to have made up “sources say”.

  36. Get redirected number of our site for your top 10 net site designs and styles while in the twelve month period!

  37. thank you on your excellent get the job done best Bristol ceremony photographer so far

  38. This should indeed be a particularly profound subject you possess touched after. And such as the examples you have got quoted, it purely ?s dependent upon the unique. Good, Better along with Best are usually not absolute sizes – they can be an all those perceptions!

  39. Thanks for all of your hard work on this blog. My mom takes pleasure in going through investigation and it is obvious why. A number of us notice all regarding the dynamic ways you convey invaluable techniques through the web blog and as well cause contribution from other ones on this subject matter plus our girl has always been becoming educated a lot of things. Take advantage of the rest of the year. You’re the one carrying out a superb job.

  40. Thanks for all of your hard work on this blog. My mom takes pleasure in going through investigation and it is obvious why. A number of us notice all regarding the dynamic ways you convey invaluable techniques through the web blog and as well cause contribution from other ones on this subject matter plus our girl has always been becoming educated a lot of things. Take advantage of the rest of the year. You’re the one carrying out a superb job.

  41. Thanks for the strategies you talk about through this blog. In addition, a lot of young women that become pregnant don’t even try and get health care insurance because they are full of fearfulness they wouldn’t qualify. Although some states today require that insurers give coverage irrespective of the pre-existing conditions. Premiums on these kinds of guaranteed plans are usually higher, but when taking into consideration the high cost of health care bills it may be any safer way to go to protect your own financial potential.

1 ... 5 6 7

  1. No trackbacks yet.