Javascript is the universal programming language of the web. Almost all web sites use it to some extent, including this site (boot13). Although many users (including myself) use Noscript and similar systems to block Javascript when browsing unfamiliar sites, it’s difficult to use many popular sites without it. For example, I spend a lot of time using Google Analytics, and I’ve configured Noscript to allow JavaScript code to run on that site.
One of the problems with JavaScript is that it’s a scripted language. That means your web browser has to parse JavaScript code, one line at a time. This is a very slow process, and contributes to slow loading times on many major sites.
Various efforts to speed up JavaScript have come and gone, without much traction. Now, several major software developers have teamed up to try again. A new JavaScript assembler called WebAssembly (aka wasm) is under development by Mozilla, Microsoft, Google, and Apple. It’s too soon to know exactly when WebAssembly will start appearing in web browsers, but we’re hopeful that it will become the new standard when it does.
Noted security expert Bruce Schneier provides some insight into the Cloud, weighing its benefits against its drawbacks. Like me, he limits his personal use of the Cloud, but his company both uses and provides Cloud services. Part two of a three part series about the Cloud.
One of the more popular online password managers has been hacked. LastPass’s servers were breached and user data stolen, including hashed user passwords, cryptographic salts, password reminders, and e-mail addresses.
According to LastPass staff, your passwords are still secure, because only the encrypted versions were obtained. Analysts have confirmed that the risk to LastPass users is minimal, mostly due to safeguards employed by the service.
Still, if you use LastPass, you should immediately change your master password. You will in fact be prompted to do so when you log in.
Although LastPass had effective safeguards in place, the fact that they were hacked (again) leaves me wondering whether it’s ever a good idea to use any Internet-based password manager. I strongly recommend using an offline password manager like the excellent Password Corral or Password Safe. Both are freeware.
Public WiFi access points (APs) are extremely convenient. They’re also not very secure. Most WiFi APs are configured to use encryption, which is why you need a password to access them. Most also use strong encryption, in the form of WPA2. That sounds good, but if you’re at all concerned about security, it’s not enough.
Even with strong WiFi encryption, anyone who has the WiFi password and is within range of an AP is sharing the network with everyone else using that AP. That means they can use network sniffing tools to see all the traffic on that network. If you sign in to any web-based service (such as web mail, or your bank site), and that service doesn’t also provide encryption, your username and password can be obtained very easily.
Savvy public WiFi users know this, and use VPN (Virtual Private Network) software to further encrypt their network communications. VPN adds a layer of encryption that is dedicated to your computer and makes your communication indecipherable, even to the hacker at the next table.
To be truly secure, even with a VPN, you need to apply limitations on what your computer can do over public WiFi – especially what it can do during periods when the VPN is not yet active. Unfortunately, this can get complicated. The guides linked below should help.
In the wake of Snowden’s revelations, many people have started using VPN services to encrypt their online activities. Until recently, one popular choice was Hola’s free VPN.
Hola has been scrambling to deal with the public backlash over this news, but so far all they’ve done is retroactively update their FAQ, adding statements about what Hola can do with your computer if you’ve installed their software.
Those of you who monitor traffic arriving at your home or work network are no doubt aware that your network is being constantly scanned for vulnerabilities. Brian Krebs rightly points out that much of this scanning activity is not malicious.
A hidden feature in recent versions of Firefox blocks technologies – including cookies – that would otherwise be used to track your activities on the web.
Currently, the Tracking Protection feature can only be enabled via Firefox’s hidden about:config interface. To access this interface, enter about:config in the address bar. You’ll see a large warning message. Click the I’ll be careful button to proceed. In the search box, enter privacy.trackingprotection.enabled. The setting should be listed below, along with its current value. Double-click the line of text to toggle it from false to true.
Tracking Protection doesn’t appear to block ALL cookies, just those that are associated with activity tracking. According to Mozilla’s description of the feature, the default list of blocked resources is based on information from the security provider Disconnect.
Unfortunately, there’s not much available to the user for managing the feature. There’s no easy way to list or modify the resources that will be blocked. All the user sees is a new shield icon at the extreme left end of the address bar, which you can click to see a small dialog:
Firefox Tracking Protection
There’s not much information on the dialog, and the only options available are to close the dialog or Disable protection for this site.
There is a way you can see exactly what resources are being blocked: click the Firefox menu button (the ‘hamburger’ at the right end of the toolbar), then click Developer, then Web Console. As you encounter blocked resources, they will appear in the list at the bottom of the screen. For example: “The resource at “http://www.google-analytics.com/analytics.js” was blocked because tracking protection is enabled.” Unfortunately, there’s usually lots of other information in that list as well.
By default, Tracking Protection blocks useful technologies, including at least two used on this site: Google Analytics and Feedjit. Google Analytics provides invaluable information to site managers, including how many people visit the site, when they visit, how long they stay, and so on. Feedjit is the technology powering the Live Traffic Feed in the sidebar; I’m only using it as an interesting experiment, so it’s not a big deal if it misses some users, but it’s not in any way harmful.
In the final analysis, Tracking Protection is really only useful for the truly paranoid. But if you hate the idea of anyone knowing what you’re doing on the web, you should probably be using Firefox’s Private Browsing mode.
Tracking Protection was apparently added by Mozilla in response to the fact that the Do Not Track feature is not being honoured by all trackers. A post over on VentureBeat provides additional perspective.
A short quiz, provided by anti-malware software maker McAfee, allows you to test your skill at identifying phishing email.
In the quiz, you are presented with ten email samples, and asked to decide whether they are phishing email.
What is phishing? From Wikipedia: “Phishing is the illegal attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money), often for malicious reasons, by masquerading as a trustworthy entity in an electronic communication.”
Hint: look for links in each of the sample messages. Hover your mouse over each link, and compare the address with the supposed sender. If a link points to a site that’s unrelated to the supposed sender, the email is probably not legitimate.
If you noticed more spam than usual in your inbox in recent months, you’re not alone. You may also have noticed that using your email client to block the sender is typically ineffective. That’s because the spam is coming from thousands of different domains, each corresponding to a different compromised web server.
This is the work of the Mumblehard botnet, which was observed sending mass spam starting about seven months ago by ESet researchers. The Mumblehard code has existed on the web for at least five years, but seems to have started its spamming activities on a large scale only in the last year or so.
Computers infected with Mumblehard are typically Linux web servers. It remains unclear exactly how servers become infected, but researchers suspect that unpatched WordPress and Joomla vulnerabilities provide the key.
A new version of WordPress addresses several critical security issues. Version 4.2.2 also fixes some non-security issues that were introduced in WordPress 4.2.
The vulnerabilities fixed in WordPress 4.2.2 are being actively exploited on the web, so anyone who operates a WordPress site should immediately check whether the new version has been auto-installed, and if not, install it.
boot13