This is my article from “The Scroll” for the October 30th, 2007.

When on the internet the only thing between the computer and a virus is the web browser. (This point could possibly be argued, but for all intents and purposes, it is basically true.)

The problem is that web browsers are notoriously bad at protecting users. New security exploits are found on a weekly basis. Internet Explorer 6 alone has over two dozen un-patched security flaws, dating back to 2004! Since IE7 was introduced in 2006, it has eight un-patched security flaws. Firefox isn’t much safer either, it has six un-patched vulnerabilities, three of which have been found this year. Even Safari has three un-patched security flaws since 2005.

The security flaws vary with respect to danger, but most are ways for a bad guy to run specific code on the computer, and take the machine over. If a bad guy can take over a computer, he can use it for sending spam, or finding the usernames, passwords or credit card number stored on that computer.

Some browsers, however, are better at protecting the user, and almost all of them can be properly configured to make excursions onto the web much safer. It is good to note a very important concept at this point. Security never equals convenience. Locking doors is not convenient, but it is secure. Similarly, locking down a web browser is going to break some web sites, some features from some web sites will not work, but this is the compromise between security and convenience.

The biggest example of this type of inconvenience is Javascript. Javascript, also called AJAX is the language that lets web sites like Facebook.com do cool things with fading alert boxes, on-the-fly profile editing and drag-able profile sections. Allowing a browser to run javascript is letting the browser run code from the server, on the computer itself. (As opposed to most web sites, where the code is run on the server and the result is shown on the web site.)

All web-browsers will allow Javascript to be turned off. However, most web sites these days rely heavily on Javascript, and some will break if it is turned off, which is why IE7 now allows for a concept of zones.

The concept of zones is really a common sense policy. IE7 allows a set security level for the internet security and privacy. But it also allows the user to set the security level to different heights for different web sites. For example, to be really safe online, a user might set the IE7 security slider up to “High” which means that all the stuff that could possibly be bad will be blocked, whether it’s bad or not. But, the user likes all the features that Javascript offers when he is using Facebook, so he wants to turn Javascript on, but only when he’s on the Facebook web site. Well, IE7 allows for a separate security setting for “trusted sites.” Since the user trusts Facebook, he adds Facebook.com to the list of trusted sites, and then sets the security for the trusted sites to, say, medium. Then whenever he’s on Facebook, the javascript works and everything is just dandy.

IE7 isn’t the only browser to offer this though. Firefox has an add-on called “no-script” which does basically the same thing. Other browsers have similar capabilities, and offer different kinds of protection.

Setting up this type of security is not always easy, but again, secure does not mean easy.

It is also very important, to keep the operating system and browser up-to-date. Many of the extremely critical security flaws are fixed on a relatively timely basis, and simply updating the software can protect from the bad stuff online.

This is my article from “The Scroll” for the October 16th, 2007.

Online sites hacked, data stolen. Customer information leaked onto web. News stories like this have been popping up fairly regularly for the last several years.

People are becoming hesitant to shop online simply because online security is notoriously bad with leaked customer information and hacked accounts. Sites like PayPal have an uphill battle to gain customer’s trust, and while they are not perfect they are making great strides.

Recently, PayPal has introduced a new product, which will most likely become a very popular item over the following years. It’s called, the PayPal security key. This small little fob is about the size of a keychain, (it is a little bigger than the BLC Fob.)

This little security key has an LCD screen with a button on it. When the button is pressed a pseudo-random six-digit number is displayed on the screen. What’s really cool about this is that the number changes every 30 seconds. This number is then used along with a PayPal username and password to log-in to PayPal.

Here is how it is used. After activating the key to a PayPal account, the user would go to PayPal to log-in. PayPal would ask for the username and password, so the user enters the username and then when entering the password, the user enters the six digit random number at the end of the password to log-in. If the user would forget to add the six digits to the end of the password, they would be redirected to a page which would ask for the current six digit number on the security key.

So why is this so cool? Well, every time the user logs into PayPal they are using a one-time-password that will never be used again. Even if the customer data was leaked onto the internet, the password would not be correct because it would not contain the current six-digit number. Since the number changes every 30 seconds, even if someone else sees or is told the six-digit number, they can’t use it unless they also know the username and password to the account, and even if they did they would have 30 seconds to use it.

How does it work? When the key is activated, PayPal asks for the serial number on the back of the key. This let’s PayPal know who has what key. Once PayPal knows the key they know what number the key should be displaying at any given time. Then when logging in, PayPal checks the number against what the number should be and if it matches, the log-in is successful.

There are a few other things about this fob which are really neat. First, since PayPal is owned by ebay, this fob can be activated for both PayPal and ebay accounts. Secondly, PayPal is concerned enough about their users security that they are currently selling these fobs for $5 from their website. (https://www.PayPal.com/us/securitykey)

To find out more information there is a really good podcast (online talk-show) explaining how this all works called “Security Now.” The episode about the PayPal Security Key can be found at http://www.twit.tv/sn103.