Love, Sex, Secret, and … God

This post originally written for my personal blog on January 11, 2009.

This past week saw two high profile security breaches on twitter.com and macrumorslive.com, each one a classic example of poor login management by websites. For full disclosure, I do not know anyone at either site but have read about each here and here as well as other websites. The short version on twitter is that an admin at twitter had a common word password and twitter has no limit on the times you can try your login. The short on Mac Rumors Live is that they either had no password on their admin interface or that the login page was sniffed, either way it was a bummer for them.

As a system administrator it is a constant challenge to keep our systems and the web applications that run on them secure while still keeping the usability that our great developers have created. So when I see things like the twitter and mac rumors issues I get very frustrated because the prevention of this is so simple. If you develop a website with user accounts, and most of them do, please consider the following.

Complex password requirements. Google returns about 232,000 results for javascript to check for strong passwords so you don’t even need to invent the wheel to add this to your change / create password page. If you don’t want to bother your users with this at least take some time to require it on admin accounts.

HTTPS, the S is for secure. Developers, please use ssl to encrypt your login page and use redirects to ensure that users don’t accidentally end up there without ssl. As more of us move out of the office and into the coffee shop we are also moving off of a private network and onto a public one. We log into twitter, brightkite, our blog, our email and most people give no thought to the idea that everyone else in that coffeeshop could now have your account and password, unless we use something secure like https. Webmail sites learned this lesson long ago and it’s time for the rest of the web to learn it too. The worst part of this is that most sites already have an https version of their site and it would be a very simple fix for them to redirect to it. For those sites that don’t ( I’m looking at you brightkite ), it’s time to step up, spend the money and get https going. For you wordpress users, setup a self-signed certificate (or purchase one) and wordpress has a plugin to do all the wp-admin encryption redirects for you.

More services are being provided via websites and as users of these we need to demand that they are secure. Give them feedback asking that logins be secure by default so that what happened with twitter and mac rumors doesn’t happen to you.

Reblog this post [with Zemanta]
2009
01/11
CATEGORY
Security
TAGS






671 comments

  1. Solid information here. I am continuing to for supplemental ideas on travel electronics and would love any recommendations. Thanks!

  2. Hi! Do you know if they make any plugins to help with SEO? I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good success. If you know of any please share. Many thanks!

  3. The president and first lady are not concerned about being invited to those children’s wedding. How ludicrous to have made up “sources say”.

  4. There are actually plenty of particulars like that to take into consideration. That is a great point to bring up.

  5. Hi, i believe that i saw you visited my website so i came to “return the choose”.I’m trying to find issues to enhance my site!I suppose its ok to make use of some of your ideas!!

  6. Hello! Are you aware if they make any plugins to safeguard in opposition to hackers? I am kinda paranoid about losing anything I’ve worked tough on. Any guidelines?

  7. Outstanding news indeed. My friend has been searching for this information.

  8. Hey there! Do you use Twitter? I’d like to follow you if that would be okay. I’m absolutely enjoying your blog and look forward to new updates.

  9. Solid information here. I am continuing to for supplemental ideas on travel electronics and would love any recommendations. Thanks!

  10. Hello! Are you aware if they make any plugins to safeguard in opposition to hackers? I am kinda paranoid about losing anything I’ve worked tough on. Any guidelines?

  11. Excellent post at Love, Sex, Secret, and … God | J Squared Consulting. I was checking continuously this blog and I’m impressed! Very useful info specially the last part :) I care for such information a lot. I was looking for this particular info for a very long time. Thank you and best of luck.

  12. You’re so nice! I don’t believe Ive go through anything like this previously. So amazing to find person with several unique thoughts on this topic. realy thank you for starting it all up. this page is certainly something is required on the internet, somebody with a little bit of inspiration. valuable position for taking some thing new to the net!

  13. Hey there! Do you use Twitter? I’d like to follow you if that would be okay. I’m absolutely enjoying your blog and look forward to new updates.

  14. You could definitely see your enthusiasm in the paintings you write. The world hopes for even more passionate writers such as you who are not afraid to say how they believe. All the time follow your heart.

  15. It can be too sophisticated and extremely far-reaching in my position. I morning expecting for a another essay, and I enjoy try to be aware of it! Actually the script is actually spreading a wings easily, looking hard…

  16. Hiya! I just wish to give an enormous thumbs up for the great data you might have here on this post. I shall be coming back to your blog for extra soon.

  17. You could definitely see your enthusiasm in the paintings you write. The world hopes for even more passionate writers such as you who are not afraid to say how they believe. All the time follow your heart.

  18. I’ll right away grasp your Gadgets & Tech ? Native Instruments rolls out Traktor 2, Maschine 1.6 update rss feed as I can’t find your email subscription hyperlink or e-newsletter service. Do you’ve any? Please allow me understand in order that I may just subscribe. Thanks.

  19. you are really a good webmaster. The web site loading speed is amazing. It seems that you’re doing any unique trick. Also, The contents are masterpiece. you have done a excellent job on this topic!

  20. Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point. You clearly know what youre talking about, why throw away your intelligence on just posting videos to your weblog when you could be giving us something informative to read.

  21. Everyone loves designer bags but most of them are expensive. Louis Vuitton is a reputable brand for designer handbags. You can get Louis Vuitton designer bags at a great discount at a Louis Vuitton outlet. If you can’t find a Louis Vuitton outlet anywhere near to where you stay you can search for one using Google. Even if the nearest outlet is a few hours’ drive you should try to visit it you can avail incredible discounts at these outlets.

  22. Hi! Do you know if they make any plugins to help with SEO? I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good success. If you know of any please share. Many thanks!

  23. You could definitely see your enthusiasm in the paintings you write. The world hopes for even more passionate writers such as you who are not afraid to say how they believe. All the time follow your heart.

  24. Everyone loves designer bags but most of them are expensive. Louis Vuitton is a reputable brand for designer handbags. You can get Louis Vuitton designer bags at a great discount at a Louis Vuitton outlet. If you can’t find a Louis Vuitton outlet anywhere near to where you stay you can search for one using Google. Even if the nearest outlet is a few hours’ drive you should try to visit it you can avail incredible discounts at these outlets.

  25. Outstanding news indeed. My friend has been searching for this information.

  26. Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point. You clearly know what youre talking about, why throw away your intelligence on just posting videos to your weblog when you could be giving us something informative to read.

  27. Hello! Are you aware if they make any plugins to safeguard in opposition to hackers? I am kinda paranoid about losing anything I’ve worked tough on. Any guidelines?

  28. Great blog. Many websites like yours cover subjects that aren’t found in magazines. I don’t know how we got by 15 years ago with just print media.

  29. Hello! Are you aware if they make any plugins to safeguard in opposition to hackers? I am kinda paranoid about losing anything I’ve worked tough on. Any guidelines?

  30. Wow, superb weblog layout! How long were you blogging for? you create blogging search easy. The look and feel of your web site is amazing, let alone this article!

  31. Love, Sex, Secret, and … God | J Squared Consulting I was recommended this web site by my cousin. I am not sure whether this post is written by him as nobody else know such detailed about my difficulty. You’re amazing! Thanks! your article about Love, Sex, Secret, and … God | J Squared ConsultingBest Regards Cassetta

  32. Does your website have a contact site? I’m having difficulty locating it but, I’d like to shoot you a message. I’ve acquired some ideas for your blog you could be interested within hearing. Either means, great web site and I anticipate seeing it expand over time.

  33. Previous Opinion is bizarre, taa taa Josue Jefcoat – A thank you might do

  34. Love, Sex, Secret, and … God | J Squared Consulting I was recommended this blog by my cousin. I am not sure whether this post is written by him as nobody else know such detailed about my trouble. You’re incredible! Thanks! your article about Love, Sex, Secret, and … God | J Squared ConsultingBest Regards Veronica

  35. I have seen that car insurance organizations know the autos which are at risk of accidents and other risks. In addition, they know what type of cars are prone to higher risk and the higher risk they’ve already the higher your premium fee. Understanding the easy basics with car insurance will allow you to choose the right type of insurance policy that may take care of your requirements in case you happen to be involved in an accident. Thank you for sharing your ideas on the blog.

  36. Too much spam! Website owners, delete some of these.

  37. Very interesting details you have noted , thankyou for posting . “My work is a game, a very serious game.” by M. C. Escher.

  38. Daniel, yea I can see anything you probably did there. I actually favored that part, however hehe I’m not really that harsh like my pops with your things. He constantly informs me loopy stories again inside day and calls me a loser. I suppose it’s about time I leave my mom and dad basement LOL. Aaanyways, why not consider you? just what does your dad think xD Anyway, during my language, prepare yourself for some ‘t be a whole lot good supply like that.

  39. Thank with this post. I get pleasure from reading your article to boost my British

1 ... 10 11 12

  1. No trackbacks yet.