Google
 

Spreading Comment and Trackback Spam Through Zombie Browsers

Tuesday, August 7th, 2007

Since my move to Wordpress, I have been noticing a lot of funny track back hits going back to my old Movable Type installation. First of all, all of these hits were coming back from different IP addresses and different browsers. Second, they all had the same refer. Something was ...

SiteMeter Responds

Tuesday, April 10th, 2007

As seen in the comments of my previous posts and here, Sitemeter decided to respond. Two points: 1. Why wait for over a week before a response? Blogs are there for a reason - its gives companies ability to respond quickly. 2. Why not post about it on their own blog? Setting that ...

SiteMeter and Spyware (Sort of)

Sunday, April 1st, 2007

Tonight word comes from multiple blogs (here, here, here and here) that a popular free stats called SiteMeter made a deal with a third party marketing company called Specific Media to place tracking cookies on ALL sites that use SiteMeter. Sitemeter's privacy policy makes no mention of this fact. Needless ...

When “Photography Forbidden” Really Isn’t

Wednesday, March 28th, 2007

Earlier today, I spent a very unproductive hour at a local Social Security Administration office. On the way in, I noticed an interesting sign with the following language: WARNING Title 41, United States Code, Section 102-74.420 PHOTOGRAPHY PROHIBITED Federal law prohibits pictures taking in or on Federal property without the verbal or expressed written ...

Why Paying People to Crack CAPTCHAs Might Be Good

Tuesday, January 23rd, 2007

Almost four years ago I posted about a spammer that was using a free porn site as a way to get people to solve CAPTCHAs (those annoying images that ask you to type in stuff). Two Slashdot stories from a few months back discuss how spammers might be hiring people ...

Webmin, Rackspace and Securing Servers

Sunday, January 14th, 2007

Last week my company was making some server changes (which hopefully I will blog about at some point) which necessitates a security check. Being a startup, we cannot afford a format ethical hack/penetration testing, so the next best thing is an automated security tool. I tried using Nessus from Windows, ...

Security Breach at EmigrantDirect

Wednesday, December 6th, 2006

I had a high interest savings account with EmigrantDirect for about 1 1/2 years. About July of 2006 this year, Emigrant switched their providers for online banking, resulting in a new interface for their website. Shortly after that switch, I have begun to get spam messages on the email address ...

Anti-phishing “Virtual Keyboards” Cracked

Monday, November 27th, 2006

I recently had the pleasure of seeing someone login into an online bank (HSBC USA), which has recently started to use what they claim is "two factor authentication". In reality, it is simply two passwords - one entered via regular HTML form, and a second entered via a very annoying ...

Appropriate Uses of SSL in Web Applications

Friday, June 16th, 2006

SSL is a nice feature to show off to customers - it has a nice lock icon which reassures users that they are secure. However, it comes at a price - the encryption and decryption process does take up time CPU time on both client and server, in additon to ...

Choosing the Right SSL Certificate

Friday, June 16th, 2006

We are currently working on adding SSL support to my company's flagship product. After I was unable to find an article clearing explaining how to choose an approriate certificate, I am writing down my own thoughts here. PURPOSE OF SSL Every developer should be aware that SSL encryption serves two distinct purposes ...