Westelaken :: Blog

IE6, you’ve been livin’ hell to me
You’ve busted me since nineteen sixty three
I’ve seen ‘em come and go and I’ve seen ‘em die
And long ago I stopped askin’ why

IE6, I hate every inch of you.
You’ve cut me and you’ve scarred me thru an’ thru.
And I’ll walk out a wiser, weaker man;
Mister Congressman, you can’t understand.

IE6, what good do you think you do?
Do you think I’ll be different when you’re through?
You bend my heart and mind and you warp my soul,
your stone walls turn my blood a little cold.

IE6, may you rot and burn in hell.
May your walls fall and may I live to tell.
May all the world forget you ever stood.
And may all the world regret you did no good.

IE6, I hate every inch of you.

- Johnny Cash

Apple has altered their privacy policy, stating:

To provide location-based services on Apple products, Apple and our partners and licensees may collect, use, and share precise location data, including the real-time geographic location of your Apple computer or device. This location data is collected anonymously in a form that does not personally identify you and is used by Apple and our partners and licensees to provide and improve location-based products and services. For example, we may share geographic location with application providers when you opt in to their location services.

Some location-based services offered by Apple, such as the MobileMe “Find My iPhone” feature, require your personal information for the feature to work.

So, you can disable customized ads by going to http://oo.apple.com/ , but Apple is still collecting data? This is bad.

@Apple, please ad an option to the phones menu, so that I can disable this feature if i wish to.

More info:
http://searchengineland.com/privacy-location-sharing-opt-out-ads-on-apple-idevices-45022

At last Google has added SSL to it’s search engine, and maps + images are in the making.

http://www.google.com/support/websearch/bin/answer.py?answer=173733

Some devices use local access point names to determine where they are. The iPhone does this for example.

I always wondered how they gathered all those AP names. Well, this is how:
http://www.theregister.co.uk/2010/04/22/google_streetview_logs_wlans/

One way this is scary and potentially an infringement of privacy, on the other hand, you broadcast this information intentionally; everyone can see it. On the other hand, Google could create a massive database with MAC addresses they could link to users when they connect to their services.

So just keep in mind: no sensitive data in your SSID! Or disable ‘Broadcast SSID’ in your AP. And even consider powering up your AP only when you need it; that way you even save on your electric bill.

Yesterday, the Internet Explorer team released a preview version of IE9, along with a very nice set of test cases. The compliancy table on that website shows other browser vendors not supporting W3C standards fully, where especially Firefox lacks behind:

http://samples.msdn.microsoft.com/ietestcenter/

It’s somewhat sneaky though (hey, it Microsoft we’re dealing with ), as they test a preview/alpha version of IE9 only against stable browsers of other vendors. They should have tested against Firefox 3.7, Chrome 5 etc. for a realistic table. Also here and here there’s criticism about Microsoft’s comparison table.

The tests have been set up with the help of the W3C. See also this website, where Microsoft shows off some neat HTML5, CSS3, SVG and Javascript (speed) test suites.

Maybe, just maybe, we’re in for some very good times with IE (but I also thought that of IE7 and IE8, which both turned out to be ugly dragons after all).

Rick.

Maybe this is common knowledge, but I didn’t know it. While looking through my website stats (link at the bottom of the website) I saw several Chinese bots visiting my site. As I run on virtual web space I don’t have access to any logs, so I can’t see what kind of tricks they are trying out here. I did spot their referral URL, and some included a bit.ly link.

I always treat bit.ly links very cautious, as you can’t see where they point to. But it seems you can find out! Just add a simple ‘+’ to the URL and you will see a statistics page, including the URL it refers to.

Check it out: http://bit.ly/cx48Bn+

Rick.

Two things I think need improvement *fast* in the upcoming releases, but where not much attention is going to.

Print.css
Firefox is _by far_ the browsers with the worst print style rendering; even IE has better rendering. So you’ll end up putting many hours in tweaking the print.css stylesheet of your webpage, just because Firefox is fucking about. Just take a webpage without a print stylesheet (f.e. this website) and check their print previews in Firefox, Opera, IE and Safari, and see the differences. Mozilla, please put some effort here!

RSS
Take the Firefox default RSS view. Here again, check an RSS feed in Opera, IE and Firefox. No filters f.e. Again, it’s not that it’s impossible to make Firefox behave the way you would like to see, but I thought we had left those (IE) days behind us, right?

Rick.

Update 15-03-2010: Also Firefox is king in *extremely* old bugs, check f.e. this one: Cannot style INPUT TYPE=FILE completely (date: 13-09-2000) !!

Read this blog recently and I agree with it completely.
http://thereasoner.com/articles/online/why-are-you-not-allowed-to-delete-all-of-your-online-accounts

And I have some sites to add to the list:

• Any vBulletin forum
• Amazon.com
• Bol.com
• Many telcos

Websites should enable this feature, especially because of search engines being able to find this data and may expose you more than you would like.

Rick.

Recently I’ve been doing some tests with Google GeoLocation and it struck me how acurate it is. I have no idea which data sources Google uses for this service, but my boss’ IP-address now get’s the coordinates of my private home address. Now that’s scary!

Wanna know if Google knows your whereabouts? Try it for yourself (use Firefox or Safari, or Safari on your iPhone):

• http://www.quirksmode.org/html5/tests/geolocation.html
• http://maxheapsize.com/static/html5geolocationdemo.html
• http://3liz.org/geolocation/

In the documentation you can read that Google uses a combination of IP-address, telco tower locations (cross-positioning), GPS (if available) and nearby WiFi access points, but I’m pretty sure that other sources are used as well (f.e. the account details of an Adsense account).

Anyway, I found it very scary to see this amount of detail (and accuracy) in their data, and it proves again that privacy on the internet is worth investing in.

Rick.

Even nowadays I regularly spot websites that store (user) passwords in plain text. Examples:
- TNT Post (section Mijn TNT)
- T-Mobile (section My T-Mobile)

When I requested my password at the above websites (forgot password option), I received my password in plain text either by e-mail or sms. Thus those websites either store the passwords in plain text, or they encrypt the password before storing it, and decrypting it before sending out. But if an automated system can do that (and knows where the key file is), an attacker can do so as well.

I hope all websites will change their storage procedure to a secure (hashed) variant, otherwise hacks like these will eventually occur.

Rick.

Recently I did some clean-up work by deleting unused webmail accounts at Hotmail (Windows Live Mail), Yahoo! Mail and Gmail. I noticed that they use different retention durations so I thought it would be handy if I’d place that information here.

When you delete your mail account today, it will take x day’s before your account is actually deleted from their systems:

- Gmail: 60 days
- Yahoo! Mail: 90 days
- Hotmail (Windows Live Mail): 270 days

Reasons for this are mainly to detect fraud, f.e. when an account is used for blackmail and canceled right afterwards. But even then I find Hotmails time-line very long (9 months!). They should lower that number to max. 6 months, which is the minimal legal time-frame to which information such as emails could be asked for by police departments and secret services in Europe. That law in itself is an infringement of privacy, but that’s another discussion.

Lastly a little side-note: only Gmail states explicitly that a deleted e-mail is actually deleted immediately with no way of retrieving it from their systems. It always made me wonder if my deleted message was actually deleted at all (there’s no way to check that, not even at Gmail). Exactly the reason for me to cancel my accounts .

Rick.

Spammers often use random content in their e-mails to fool spam filters. This is an old technique. One I didn’t knew though, is texts that are rendered with random sentences from books, check this one:

Hello Roman!

Now put thy hand here. Where will you take your patriots? Shall I ring and let Mrs. They had dominated me. And I will get thee coffee. Where am I? You must be joking!
And I have about as much more. Was it even true sapphire? Why don’t you get up and dance? He hadn’t known Death could do that! It was what was to be done. They had played tennis. Don’t you see my plan? What do you expect from a murderer? They must have. Oh muck him to deepest hell.
But some would call it murder. Let me help you with that pack. Atlan smiled weakly. Why had he done this? Some female trolls ate their husbands. Joy lit up his eyes. Pretty goin’s on–what? But why show the planes?
But where at the lake? Watson has gone to Coombe Tracey. She had been nude before. Reginald Bell agreed with that as well. I’ve been seeking you for six months! There were scraps of verse. The rescue party had arrived. The idea of a balloon naturally followed. Excuse these tears.

Quite funny to read .

Update: Did some further digging and it seems that at least some of these sentences originate from a German science fiction series called Perry Rhodan (see this character list). Looks like someone ran a script over a book website (notice the sentence cut-off after ‘Mrs.’, a dot used as a delimiter).

For some years now ixquick – a Dutch meta search engine – has tried to become ‘a big boy’; a new Google, a Yahoo! equivalent. But they didn’t succeed. People have their habits and they often stick to them.

So ixquick needed something to set itself apart from Google and the other search engines, something so great that users would switch to their search engine. They thing they brought up touched something that had received a lot of attention by then: privacy.

Ixquick claimed to be the most privacy driven search engine of them all. No IPs are logged, they use the results of the big boys without giving your private information (like your IP address, previous searches etc) to the big search engines. Sounds great, right? Yep, but is it really ‘what it says on the tin’?

I’ve used ixquick for some time now after using Google before. I find Googles search results great, but they are becoming too big. Combine my search engine queries with the data they collect of me at every site I visit through their Google Adsense ads and Google Analytics stats, and any secret service can do their job over a simple ADSL line; no need for fysical taps anymore. That’s why I recently decided to remove Google Adsense from this site. See below for tips to avoid being followed, and watch ‘Das Leben der Anderen‘ for why this is important.

1. The big boys
Ixquick claims to use ‘the big boys’ to collect their search results. If you visit their website you can see the possibility to select and deselect the various engines in the top right corner. It struck me that Google is also included. Google, the advertisement company disguised as a search engine. If people would use ixquick instead of Google, than Google wouldn’t make money anymore because people didn’t get to see the ads. So I started some tests to check if ixquick really searches in Google. I made a test page I knew only Google had in it’s index. I queried ixquick, no results. I queried Google, my hit came up. Conclusion: ixquick does not use Google for it’s search results. I guess Google bullies them, but hey, money has got to be made, right? So the exact same thing people bash Microsoft over (misusing their market dominance) is now used by Google. Do you hear anybody about this?

2. Google
Google is the real culprit here. One, because their search engine is simply the best out there, two, because they have shitloads of money due to their advertisement activities. And as I just pointed out, three, they kick out any meta engine trying to use their search data. All in all people didn’t find what they were looking for using ixquick, so they went back to Google, leaving ixquick with low hit stats. When I thought about this I wondered how ixquick was making money. So I just did a random query in ixquick and lo and behold, there they were: Google Adsense. The thing Google uses to monitor your site visits around the internet sits happily and merrily on the website of their biggest enemy.

I guess ixquick has been forced to this step because they simply needed money. They’re too little to attract sponsor on their own. And almost every company uses Google Adwords these day’s (as I pointed out, this is part of the problem).

I have to say that ixquick implemented the Google ads in a non-standard way. Normally people use a bit of JavaScript to generate the ads on their web page, with which Google can aggregate statistics along the way. Ixquick only uses an URL, example:

<div>
<font size="2" face="Verdana">
<a id="title" class="title" onmouseout="ws(”);" onmouseover="window.status=’TrafficControl.nl/Slipcursus’; return true;" target="_blank" href="http://www.google.com/aclk?sa=l&ai=C3A1hQkT_SuSyIJCu4ga01fiuC9i5vi6W3qXPDsuP1B4QASCX1qcKKAVQpbTP2_r_____AWCRBKABoNqu-QPIAQGpApYDXJhV9Lg-qgQhT9DNcMYEdvWtPwZhGeRFFa-1IPL6N-8k9zdUUPdTDDES&num=1&sig=AGiWqtxtBv1tmGCMs3bcMcExBxWUsEQwjg&q=http://www.trafficcontrol.nl/slipcursus/">Antislipcursus nu €37,50</a>
<br/>
</font>
<span class="normaltext">
Uitdagende & Spannende Kado’s en Uitjes Boekt U Hier Zeer Voordelig!
<br/>
<a onmouseout="ws(”);" onmouseover="window.status=’TrafficControl.nl/Slipcursus’; return true;" target="_blank" style="color: rgb(51, 51, 51); text-decoration: none;" href="http://www.google.com/aclk?sa=l&ai=C3A1hQkT_SuSyIJCu4ga01fiuC9i5vi6W3qXPDsuP1B4QASCX1qcKKAVQpbTP2_r_____AWCRBKABoNqu-QPIAQGpApYDXJhV9Lg-qgQhT9DNcMYEdvWtPwZhGeRFFa-1IPL6N-8k9zdUUPdTDDES&num=1&sig=AGiWqtxtBv1tmGCMs3bcMcExBxWUsEQwjg&q=http://www.trafficcontrol.nl/slipcursus/">
<font class="linkx"> TrafficControl.nl/Slipcursus </font>
</a>
</span>
</div>

This way Google doesn’t generate any statistics about you, but they do after you click on one of these links (and do you spot the nifty mouseover for TrafficControl.nl?). And is it a coincidence that these ads do pop-up when using Adblock Plus? It wouldn’t surprise me if this was designed this way because of that (or at least in part).

Moral of the story: idealism without money is dead, sadly.

Rick.

PS: to ixquick: clean up your frontend code, it’s a 90s-style mess..

Tips to prevent Google’s Mordor eye from watching you, while still using Google as your search engine:
- Use Firefox as a web browser
- Install the following Firefox addons:
1. Adblock Plus – Removes all ads, including Google Adsense, from every website you visit, except ixquick
2. Customize Google – Prevents Googles cookie UIDs and their Google Analytics code to run in your browser, set this in the ‘Privacy’ tab.
3. TrackMeNot – sends out random queries to Google to mask your ‘real’ queries, preventing Google from setting up a profile of you.
- Use an ISP with a dynamic IP address; this way Google can’t fix your queries to your IP. If you have a ‘static’ IP address, turn off your modem during the night every now and then. Most ISPs IP addresses aren’t as static as they make you think (in the morning chances are you have a new IP address)
- And lastly, use other search engines as well, Yahoo!, Bing, and ofcource ixquick (they still have the best privacy of them all).
If you are really serious about your privacy use the TOR network for all your surfing. And the most effective (as always) is the oldest trick in the book: spoof your MAC address and use someones open WiFi connection. Beware, in some countries this is illegal (like in The Netherlands).

Ever bought a book or cd at Amazon or Bol.com? All with the same account? Than Amazon and/or Bol have kept an extensive history of your buying habits.

I’ve known for a long time that such a history is kept by these companies. But I recently found that this history-log is never erased, not even in a way like eBay does, where transactions become anonymous after 3 months. And that (even worse), there’s no way to (force) delete your details from their systems.

I e-mailed Amazon and Bol for the removal of this history from my account, including my details in their back-end systems. This is what they’ve replied:

Amazon:

Hello,

I understand your desire to remove order information from your account. We are, however, unable to fulfill your request.

As the Privacy Policy posted on our website notes, in using and purchasing from Amazon.com you might supply information such as your name, address, and phone number; e-mail address; credit card information; and other relevant information about people to whom purchases have been shipped, including address and phone number.

You can view or edit much of the account information you provide through the Your Account link on our site. However, like most businesses, we keep records pertaining to our business, including the dates, amounts, and types of purchases made, so that we can service your account appropriately and to satisfy other business and legal obligations and needs that we have.

Please note that in accordance with our records-retention requirements we cannot remove this account information from our system until our business need for the information has expired, as it is part of our business transaction records.

Thank you for your concern and for shopping with Amazon.com.

Bol.com:

Geachte heer,

Hartelijk dank voor uw e-mail.

U wilt graag weten hoe bol.com omgaat met uw persoonlijke gegevens.

Wij respecteren de privacy van alle bezoekers van onze winkel en behandelen uw persoonlijke informatie vertrouwelijk. Voor meer informatie verwijzen wij u graag naar onze Privacy Policy onderaan elke pagina op onze site.

Helaas kunnen wij dus niet uw vraag honereren. Het enige wat wij u kunnen zeggen als u de geschiedenis wilt verwijderen is dat u deze account opheft en een nieuwe aanmaakt.

Wij hopen u hiermee voldoende te hebben geïnformeerd.

Met vriendelijke groet,

bol.com Klantenservice
www.bol.com

So Amazon is hiding behind their own business goals and legal obligations (NSA anyone?) and the best Bol came up with is to create a new account for every purchase (problem, you have to call them to cancel your account, and who can guarantee me that the information is also erased from their back-end systems?).

I think it’s time the privacy legislation in both the EU and (especially!) the US will get some attention. I find it very disturbing that this private information is saved while I’m unable to edit and/or delete it, whilst authorities can claim these details for all sorts of dubious reasons.

Rick.

These day’s I regularly spot wireless security cameras in stores. Recently I took a closer look at one and I found out that they often work in the public 2,4GHz band, the same band as WiFi operates in.

At home I had a simple 2,4GHz video transfer set for remotely sending A/V signals. I took the receiver and did a ‘wardrive’ through the city. Although it was a bit hard to find other stores with wireless security cameras, I did manage to receive some of them. I sat in my car, which didn’t help the reception (I took in quite some noise), but it worked after all.

It wouldn’t surprise me if thieves used this simple method to check out a shop from within, before attempting to rob the place.

Moral of the story: check the security of your wireless cameras. If they don’t operate over WiFi (and even then, secure the connection via WPA2, as WEP and WPA are breakable) and the set itself doesn’t mention anything like ‘secure’ or ‘crypto’, simply pull some wires through your store or buy a new set altogether. This might come at a cost, but an empty shop the next morning is even more expensive.

Rick.

Well, it’s not something that you want to read in a privacy statement, but at least one can say that eBay gives a honest answer here.

We treat your information as an asset that must be protected and we use numerous tools (passwords, physical security, logical security, etc.) to protect your personal information against unauthorized access and disclosure. However, as you probably know, third parties may unlawfully intercept or access transmissions or private communications. Therefore, although we work very hard to protect your privacy, we do not promise, and you should not expect, that your personal information or private communications will always remain private.
Link

May other companies take this as an example.

Rick.

While doing my thing online I often spot unencrypted e-mail forms when contacting companies. The solutions are quite simple (a simple SSL certificate costs about € 15,- per year) would help a lot. But even that is lacking at many websites.

And those websites aren’t just the small, amateur or hobby style one’s. For example, check this list below:

• Conrad | Large online electronics supplier: Link
• DSB Bank | Dutch bank: Link
• Ministerie van Economische Zaken | Ministry of economic affairs: Link
• Marktplaats (via CustHelp) | Dutch version of eBay/Craigslist: Link
• Hyves (via CustHelp) | Dutch Facebook-like social networking site: Link

I could go on and on, but this gives an overview of the (in my opinion) severity of this issue as those forms can contain private data, all sent in plain text. And I haven’t even touched the American bank websites who often use static codes with no transaction verification… At those sites the security of their e-mail forms should be the least of their worries.

I hope all the large websites will add security to their e-mail forms. Or if they can’t for some CMS or other impact reason, just place an e-mail address so I can sent the e-mail to them via my own Secure SMTP server (although that doesn’t mean that the POP/IMAP connection at their end is secure, another issue that points out the importance of end-to-end security online).

Let’s hope for better times.

Rick.

I knew the MasterCard SecureCode check but only recently I found the first online shop that actually used it. When sending my credit card information a screen of my bank came into view: SecureCode. I had to create a password for my MasterCard. I’m sick and tired of these passwords all the time. I took a credit card because it was supposed to be dead easy to use. You already have to use a PIN-code, and now even an online SecureCode. But let’s not forget that it’s all for a good cause, security. Right?

Wrong! I entered a password an continued with my purchase. Yesterday I bought another item and — lo and behold — the SecureCode was there again. By this time I had forgotten my password as I had used a new one specially for this service (using the same passwords over different services is not recommended, to say the least), so I clicked the ‘forgot password’ link. To my great surprise I could just enter a new password, click next, and my transaction was sent!

Ok, let’s take a look at this again. SecureCode is supposed to be a service that I can use to identify myself when purchasing something online. So if someone else gets hold of my credit card, even with details like the CVC code, they still can’t buy things because they don’t have the SecureCode password. But if one can reset that password at the spot, then what is the actual function of SecureCode? In that case it’s just a useless extra step annoying customers in their buying process.

I even think that we ‘annoyed customers’ are the reason why this service can be reset so easilly: if it’s too difficult, people will start complaining at their banks or people might even resist buying online, thus causing the webshop owners not wanting to implement SecureCode. Well, what’s the point of implementing a service that doesn’t even work?

So SecureCode is broken by design. Another lame ‘security’ layer trying to convince people that using your credit card online is safe. Well, security always breaks at the weakest link and that’s still the user itself. A little bit of online buyer awareness would help a lot more I think.

Rick.

Update 30-11-2009: My latest transaction showed that they’ve altered the SecureCode flow a bit. Now, when you want to change your password, they ask for the secret question. As long as the answer has nothing to do with the actual question, you’re relatively safe. If there is a relation though, you might end up with the Sara Palin syndrome.

What? Yes, Google is one of the slowest search engines I know of. Not for displaying search results (that’s lightning fast) but when it comes to crawling sites, it’s slow, slower, slowest.

This used to be a common remark to Google. Companies often put up a demo website months before the actual release, just to make Google aware of the domain. A lot has changed since then and by now the harvesting of new domains goes quite fast (I guess due to the fact that they continually spider websites that display new registered domain names). The trouble starts when you want your site to be removed from the Google index. Remember the recent issue with the MI6 chief’s wife? The Facebook account was removed very fast but remained in the Google cache for quite a long time.

Google does have a ‘website removal tool‘ at their ‘webmasters tools’ section, but the problem with that tool is that you actually must own the domain in question, or at least have admin access to it. You need to add a certain meta-tag to your website or add a randomly generated file to your websites root. This way Google can check if you’re really the owner of the website. What’s the problem you might ask? Web 2.0 social community websites.

Sites like LinkedIn, MySpace, Hyves, Facebook, Netlog, Twitter etc. have very widespread use these day’s. But they also (potentially) contain lot’s of personal info you might one day want to delete (f.e. when applying for a new job). Canceling your account or altering the view-ability of your profile page is a good thing to do but that isn’t the problem here; it’s Google’s cache. Google seems to spider pages more often as their content changes more frequently. That’s a good thing as far as optimally using their resources. But that poses a problem for the people who want their profile data removed from the index. The website removal tool can’t do it’s job here because you don’t have admin rights to the webserver your profile is hosted on. Also, you can’t add a robots.txt file for the same reason. For the moment, the only thing you can do is simply wait. And that can take a long time. One profile I have did change a lot content-wise and disappeared from the Google index within three weeks (and that very quick for Google). Another one I had didn’t change that much (read: never) and to this day is still present in the search index, after being removed over 6 months ago! I do understand the difficulty Google is facing here when it comes to misuse of an extended removal tool, but this has got to change for the above example shows. Until then, simply don’t put up any information about yourself that you likely want to remove sometime in the future. Search the Internet for examples of potential employees not being hired after a review of their personal profile pages.

And there’s another thing Google is slow at: robots.txt. These files, known to disable certain files and folder for the search engine spider, can be altered to keep spiders out of places they shouldn’t be. The problem starts when you change this file. When Google first starts to index a website, the robots.txt file is read, and Google acts to it. But after that, Google only rarely checks the robots.txt file for changes. I’ve had multiple issues with this. On one website, I forgot to disable a certain page so I added it to the robots file. After that, it took over 6 weeks before Google actually removed the page from it’s index. On another occasion I was goofing about with a domain of mine when I made a mistake in the robots file. Tip: a crawler/spider will always act upon the last robots.txt entry it encounters (and to which it matches), overriding potential previous ones it matches to. This resulted in my website not being added to the index. So I changed my robots file, but now (over 2,5 months further down the road) my website still isn’t visible in Google. Google’s help pages point out that they do this because they had received issues from webmasters complaining that Google generated too much traffic checking their robots files. So now they alter their check-rate to the content in the file (Disallow: / results in very low spider traffic from the Googlebot). Very unfortunate for those who make a mistake here and besides that, what’s the use of a robots file when the search engine doesn’t check it often enough? So remember: triple-check your robots.txt before putting it online.

I hope Google can do something about these issues. Google makes great services, but sometimes they seem to ‘forget’ privacy issues.

So Google, toss some more beach sand and palm trees in your offices and up to the brainstorm!

Rick.

UPDATE: Just after posting this story I found out that Google has added a new option to their website removal tool. Now you can also remove websites that are not yours, when they reply with a 401 or 404 HTTP status code. I’ve checked it by removing my deleted Twitter account and it works within 24 hours. Props to Google but there are still two small issues: 1) the website has to give a 401/404 status code (if it doesn’t the party ends here) and 2) if you only alter the viewability of your profile page (restrict access etc.) you still dependent on the slow Google spider. In that case you simply can’t remove your info from the cache. By the way, if you want to remove your personal info from the Google cache, how much sense does it make to be forced to create an account at Google in order for you to remove your own content? There’s still work to do…

An often overlooked aspect of web security lies in the above protocols. Why? Because they rarely ever use any encryption; everything is send in plain text.

This practice is resulting in traffic that can easily be intercepted and (mis)used. F.e. someone uses Outlook in the train to retrieve his e-mail while using the in-train WiFi network (unencrypted). If I’m in the vicinity of that person I can simply sniff all the passing information and see that in plain text, including user-names and password. I can easily misuse that information for personal gain, or use it to create more evil things (Gumblar anyone?).

That’s why I’m urging ISPs, hosters, mobile providers, software manufacturers and web developers to act on this matter: create a secure layer on top of all your existing protocols. Protocols that are susceptible are (among others):

- FTP
- SMTP
- POP
- IMAP
- MSN Messenger Protocol*
- HTTP (public websites that require _any_ personal information)

Solutions are widespread, but a simple SSL or TLS layer on top of the above protocols would help a lot. My current webhoster is one of the few I know of (besides Gmail) that uses FTPES (FTP over explicit TLS/SSL) and a secure SMTP, POP and IMAP server. But most mom-n-pop providers simply don’t offer such security and require you to collect and send your e-mail unencrypted, with all consequences coming with it. I guess (work)overload at the customer support desk is what many providers fear. That fear isn’t valid as you can easily run an encrypted and unencrypted service side-by-side, so you won’t break a customers existing setup.

So, up to the revolution, and let’s make the web a bit safer!

Rick.

* I haven’t checked the MSN protocol for actual secure connections, but for the articles I’ve read it’s not encrypted. Skype f.e. is fully encrypted, end-to-end.

Some people certainly will remember the (painfull) security issues they had over the last few years. Remember the hack at T-Mobile USA where pictures from mobile phones of celebrities were stolen? Or the huge database theft more recently? Not the slightest hacks for a large company like T-Mobile.

The issue I found isn’t by far as huge as the above examples, but still shows that T-Mobile doesn’t seem willing (or able) to fix the root issues in their systems. It’s about the My T-Mobile passwords. They are stored in plain text. Que? Yes, in plain text (!!).

How did I find out? Easy, just go to the T-Mobile website and click the ‘Request new login data’ link (you have to be a T-Mobile customer). Choose the ‘My T-Mobile’ section and enter your mobile number. You will receive a text message with your username/password combination in plain text. I was ‘not amused’ when I found out and I quickly isolated the password from the ‘medium secure’ one I normally use for these websites to a ‘only for this website’ password. Even if they get hold of my user/pass combo, their joyride will end there.

How can a large corporation like T-Mobile have such a great flaw in their system? I mean, I receive the sms text with plain text info (not to mention the recent attempt to crunch the GSM A5/1 crypt), that means it has to be stored that way on some kind of system. No hashes here! Even if those systems are technically 100% safe, you still have the danger of ‘moles’ or ‘rogue employees’ who can steal this information (combined with all my other data) and believe me, I know first hand that this happens more often than people realize (or detect!).

The password doesn’t have to be in plain text. It unsafe in case of theft (on all levels) and a request can just as easily generate a new (temporarily) random password. Simple sollutions for this (in my view) major flaw.

So T-Mobile, can you fix this issue?

Rick.

Update 18-11-2009:
This is what I meant with rogue employees: T-Mobile staff sold personal data

Does the title sound like a flame-post in the making? Well, it shouldn’t, because I am a happy Mac user for some years now and until yesterday I was a confident iPhone user (except for the fact that I still can’t shoot video with the damn thing, but that’s another story). Until yesterday you say? Yes, and I’ll tell you why.

On the 17^th of June I – like many others – downloaded the new 3.0 firmware for the iPhone 3G. The validation took a while, thus my conclusion that it was pretty crowded at Apples servers. The update overall went smoothly and the new features were very welcome.

Last Sunday I hooked up my iPhone to my MacBook and I started iTunes to make a well needed sync (I had a new F/W version after all). As always I got the text-box asking me if I wanted to sent off my statistics- and crash data to Apple. I never ticked the ‘don’t ask again’ box, so I still get this message every time I hook up my iPhone. I like that, because I’m always curious for what to find in it’s logs; I often look around there. This time was no exception and to my surprise I found a new set of log files, all named like this:

log-bb-2009-06-20-15-40-04-csi.txt

Great I thought, let’s see what’s inside of them. At first I saw some normal logging of the signal strength and drawed reception bars, nothing special:

236830.449 reg: Reported signal strength is -101, smoothed -97
236830.449 reg: telling UI to draw 5 bars, -97 signal
236830.449 evt: Sending event kSignalStrengthNotification (15)
236833.450 reg: telling UI to draw 5 bars, -98 signal
236833.451 evt: Sending event kSignalStrengthNotification (15)

A bit further in the file I saw something else I just could not believe. I checked it, and I checked it again:

238596.436 evt: Sending event kCallStateChangeNotification (1)
238596.437 recv[call]: RING
238596.437 recv[call]: +CLIP: "073XXXXXXX",129,,,,0
238596.437 clm: GS01 Submitted
238596.437 clm: Current caller id info is 073XXXXXXX
238596.437 evt: Sending event kIncomingCallerIdNotification (9)
238596.438 recv[reg]: RING
238596.438 recv[reg]: +XDRV: 5,9,0,0,3115,3137
238596.438 recv[reg]: OK
238596.438 recv[sms]: RING
238596.439 recv[low]: RING
238596.439 recv[pdp_ctl]: RING
238596.439 reg: starting temperature notifcation watchdog timer for period 20
238596.439 recv[pdp_0]: RING
238596.440 recv[pdp_1]: RING
238596.440 recv[pdp_2]: RING
238596.440 recv[pdp_3]: RING

That 073XXXXXXX number was a number I had recently received a call from (obfuscated for obvious reasons). Did my iPhone suddenly log all my incoming caller id’s? Confused as I was I looked a bit further and I found this:

240596.786 reg: Reported signal strength is -103, smoothed -102
240597.787 reg: telling UI to draw 4 bars, -101 signal
240597.787 evt: Sending event kSignalStrengthNotification (15)
240599.347 recv[reg]: +XCIEV: 7,
240599.348 reg: Reported signal strength is -99, smoothed -101
240600.044 clm: dial "073XXXXXXX" ()
240600.044 clm: Clearing DTMF queue
240600.046 evt: Sending internal notification kEventCallActive (0) params={0, 0, 0x0}
240600.046 evt: Sending internal notification kEventDataMode (36) params={3, 3, 0x0}
240600.046 evt: Sending event kDataModeNotification (113)
240600.047 clm: Submitting GS02: state = 2 (mapping 3)
240600.060 clm: REDIAL: Checking status 4 2 0 0 1

A number I recently called. So outgoing numbers are logged as well!

I canceled the transfer to Apple and copied all the log files for further analysis and that’s where I am now.

Why does Apple do this? I can understand why these log lines are there; they are key during development of the software, but what is their function now? I mean, if this is really what I think it is, namely that I almost send a plain text file to Apple containing my incoming calls, outgoing calls, timestamps, my iPhone ID, combined with my iTunes account this adds with my address, phone number and credit card number, than there are only two sensible options left:

1. Apple has become the Google squared when it comes to privacy infringement and someone at Apple shares a board function with the NSA, or

2. Apple is so naïve that they actually think that we trust them beyond any doubt

Well, call me paranoia, but I find this a strange development to say the least. Furthermore, I see these logs because I haven’t checked that ‘don’t ask again’ check box one normally gets (plus I have a boring day every now and then). I guess a lot of people only saw this box once and are now unknowingly sending off their caller id’s to Apple. That’s bad!

I’m interested to hear your comments, so please, post them below. Has anyone seen this log file in the 2.x F/W? Has anyone spotted these log-lines before? Can anyone confirm if these log files are sent to Apple over HTTP (thus without encryption, adding to the cause)? And who can tell me how long Apple can keep these files before they are obliged to destroy them?

And if Apple reads this: please remove these logs! Let me sent you the crash-/statistics data you want, but please respect my privacy!

Rick.

UPDATE 24-06-2009:

I found out that these log lines were already there in the 2.x F/W (link). So that would mean that I’ve already send off almost a year of calling data back to Apple, yikes! It becomes even more interesting to learn how long Apple may use these send files and what they are doing with them (especially with the caller id’s).