Password Security in the Cloud Computing World

Image courtesy Travis Goodspeed

Image courtesy Travis Goodspeed

The recent cloud computing security issues including the possible security breach at Lastpass in May 2011 and now the major breach of the RSA SecureID system leading to an attack on major US military contractor Lockheed-Martin has many of us wondering how safe central password repositories are.

I have been using Lastpass, but with a less than perfect password. I was using 10 random characters. I have decided to fall back to a local solution. I am now using Keepass. KeePass is a local application for Windows, Linux, Android, iPhone, Palm, Blackberry, Mac and pretty much any other platform. It can be used as a portable app, carried on a USB stick.

I keep my database stored in a Dropbox folder and synchronized across my computers. The database is encrypted, and stored in an encrypted state on Dropbox.

I can access it anywhere I can connect to dropbox, or run a Windows app from a USB drive.

And it has one other benefit over Lastpass – Lastpass tends to wind up with multiple versions of passwords (if you change them) and knowing the current one becomes a management problem. Keepass keeps one password, and you can group them. For example I have three WordPress logins for different Blogs. With Keepass I can create three groups, one for each Blog, and keep all relevant information for that blog or personality.

 

Internet Explorer flaw used to Hack Google Mail Accounts

The attack by Chinese hackers on Google mail accounts belonging to persons of interest to the Chinese government have been widely reported by others. That attack included more that Google mail accounts, it also targeted a number of military contractors in the U.S.

The common link is an exploit of yet another flaw in Microsoft Internet Explorer. After initial denials Microsoft has now admitted the flaw, and is working to patch it. In the meantime they have published an advisory on how to work around the problem on their web site.

A number of Governments including Australia, France and Germany have issued advisories to users to stop using Internet Explorer.

I have urged people to switch to Firefox for years. As the IT Manager at the University of Sydney Security Service I disabled IE and switched users to Firefox beginning with the Beta 0.9 version, and had few problems. I have offered to install Firefox on the computer of every customer, and many have accepted the offer.

Complacent and Non-technical Users


One of the biggest problems with Windows and Internet Explorer is that to many computer users, Windows is the only operating system and Internet Explorer (IE) IS the internet. The concept of using another browser than IE, which came pre-installed is simply to much effort to even understand.

These same non-technical users are also easy prey to phishing scams and viruses via e-mail.



Geeks Arise, Help the Users Throw Off Their Chains!

It is easy for those of us who know how to secure our systems to roll our eyes and laugh at the average person as they flounder around accepting advice from equally clueless sales staff in department stores and spending money on software that cannot fix already compromised systems, and is often worse than the threat.

It is the responsibility of the geeks and technically minded to help those around them to understand that internet security IS important, it DOES affect everybody and it CAN be fixed. A few steps, simple for those of us with technical minds can provide a reasonable level of security for these non-tech. users.

John Sawyer on the Dark Reading “Evil Bytes”  Blog posted his six things to do to secure your computer. I agree with most of these suggestions, although I would put switching to Linux as a real possibility for many average users. I would also suggest if you want to go to the extent of using item 6, a Virtual Machine is better, but that is beyond the scope of this article.

I will discuss some of the plugins that make Firefox a safer browser soon.

Making Blogger Templates adjust to Page Width

It will come as no surprise to readers that this Blog is created by Blogger. It is, after all, shown on the links and in the bar across the top of the screen. I edit in Blogger, and then the pages are loaded onto the serentycomputing.com web servers automatically.

My one big issue with the Blogger system has been that it caters to the lowest common denominator. the 640 x 480 screen that was the original IBM VGA screen resolution. 640×480 went the way of the Dodo years ago. But then it came back with netbooks like the Asus Eee PC. I own the Eee 702, with a screen resolution of 800×480.

This makes a web site difficult to design. You do not want to make it impossible to browse with a netbook, but using as much screen space as possible is a goal. Blogger uses a format (for almost all templates) the uses a narrow format suited to 640×480 but is a narrow “neck tie” down the middle of the screen on better monitors.

I was inspired by a Youtube video about customising your blogger template. It gave me clues, and I went fishing in my template file. If you use blogger, when you edit a post or manage your dashboard you have a tab for “Template”. This site is based on the “Rounders 3″ template. It narrows the page to fit 640×480 browsers. The “Neck Tie” I spoke about above.

First be sure to copy the content of the template to a safe place. save a copy to your local machine using a text editor.

I went through the template and deleted all references to “url(http://www.blogblog.com/rounders3/corners_cap_xxx.gif)” these are the grapics that round the corners of each box on the screen. If you want a fixed format, you can fix these, rather than deleting, but I simply removed them.

Then I found @media all { and changed it from a number of pixels to 95%.
I found
#sidebar { and changed it from 220px to 25%
I changed
#main { from 485px to 72%

The result is a “Rounders 3″ template that re-sizes to fit the client screen size. It is not perfect, but I am very please with the result.

I just HATE wasting pixels!

Enjoy!