POST vs. GET for HTML Form Security (and The Back Button)

At the last GreenJUG meeting, we talked about how you should always use POST instead of GET for any secure web sites. But when you use a POST form on an HTTPS site, navigate away, and click the Back button (on Internet Explorer), you get "The web page you requested is no longer available - try refreshing..." It essentially breaks the back button which UI designers will tell you never to do.

So for me, the rule is, for any view-forms (where the form sends selection criteria for what the user wants to view), make them GET. Such forms tend to submit only the ID number of whatever they are pulling from the database, usually do not involve entering sensitive information, and should work when the users navigates away and uses the back-button. For update forms (where the user submits new data or changes old data) make them POST because it's good to prevent accidental resubmittion and because people tend to enter private and proprietary information on such forms.

Passwords Don't Matter

Why Passwords Don't Matter

I set out to write an article about tools to easily manage passwords securely, but when I looked for data on computer crime to encourage people to use better passwords, I discovered a very different story. Most "computer crime" (according to the FBI) is various forms of scams and con games that used to be carried out in person, over the phone, or through the mail, but are now done through online auctions or email. Nothing to do with passwords. This 25-page 2008 Internet Crime Report by the FBI only uses the word "password" twice.

At least for corporations, the big problem seems to be people using the access they were given to do bad things. That happens much more often than people hacking into other accounts.

Computer attacks tend to target applications and the operating system. If you don't keep up with patches, your password won't matter. Source: The Top Cyber Security Risks.

Contrary to the title of this posting, good password practices are important. But what's even more important is to:

1.) Keep your wits about you and cultivate a healthy skepticism before downloading a free game, clicking on an advertisement, or buying something from someone you don't know (e.g. eBay).

2.) Keep your operating system and applications updated. Always choose, "Yes, apply updates right now" and "Of course I'll reboot." Manually check for updates periodically just in case.

3.) Use a tool like Revo Uninstaller to remove applications you are no longer using. Especially anything by Adobe, RealPlayer, toolbars (e.g. Yahoo!), and the Microsoft .NET framework.

When Do Passwords Matter?

I got an email today saying that a web application I used a single time eight years ago had suffered a break-in and warning me that if I used that password for multiple accounts, I should change the passwords to all those accounts. I have over 120 personal accounts, and God knows how many at my various jobs over the last 8 years - how many of those applications have been compromised? Kudos to the organization who discovered the break-in AND alerted me. I think it's safe to assume this is not the only break-in among those 120 applications, nor the only one discovered.

Minimum Effort Password Management

I just read a wonderful article in the Boston Globe Online about the time-wasting, annoying, and mostly useless advice security experts have given us about passwords. So if you want to be secure with the minimum amount of effort, what is the most important thing?

I believe using a different unguessable password for every account is the most important password practice because doing so means that all of your other accounts are safe whenever one of them is compromised - and if you use a computer long enough, accounts WILL be compromised. Some have suggested using X9$bFacebook, X9$bTwitter, X9$bMySpace, but schemes that use the application name, even if it's altered in various ways, are still guessable.

To manage different passwords for every account, you need a password manager. Many people use the "remember passwords" feature of their favorite browser. This is a terrible idea because:

• It means you are storing your most secure data (your passwords) in your least secure application (your browser)


• You are going to need to enter activation keys or passwords into software installed on your machine at some point, and you cannot store that in your browser


• When you go to another computer, or try to switch to another brand of browser, you don't have your passwords.


• When your hard drive dies, so do all your passwords


• When you die, so does access to your computer and all your passwords.

So the web browser is not such a good solution. The best I've found (and thanks to a good friend for pointing me to it) is a free, open-source password manager called KeePass which is available for Windows and KeePassX for Linux, Mac, and Windows. I use it with a strong master-password and a tool called DropBox to synch it across my computers. Lifehacker has an article on how to use them together. Once a year, I recommend printing out your KeePass database, writing your master password on it (your Dropbox password will be in your KeePass database), sealing the list in a tamper-evident security envelope, and putting it in your safe deposit box. Then burn last years list (you know, with a match). When your hard drive dies, you have a backup immediately available on your other computers via Dropbox. When you die, there are legal proceedings for your next of kin to access your safe deposit box.

For a less secure, less robust, but easier to use password manager, look at LastPass.

Grep: Yet Another Reason I Love Bash (the GNU/Linux Born Again Shell)

I have to say how incredibly awesome it is to be able to issue a one-liner like the following:

egrep -w --color --exclude-dir='.svn' '[Bb]usiness [Uu]nits?|BUs?' WEB-INF/jsp/*

Everywhere the expression Business Unit, business unit, or BU appears in the JSP pages is now listed on my screen in color.

How does it work?

egrep

Run grep (the GNU "find" utility) using Extended (that's where the E comes from) regular expressions.

-w

I was looking up the word boundary expression in the man page for grep and found that the -w switch forces the match to occur within word boundaries.

--color

Show the file names and matches in a different color (red) from the other text.

--exclude-dir='.svn'

Prevents grep from looking in subversion (source control) directories

'[Bb]usiness [Uu]nits?|BUs?'

Match "business unit" with or without initial caps and with or without an "s" at the end, or match "BU". These matches have to occur on word-boundaries (because of the -w above) so that ABUSE does not match.

WEB-INF/jsp/*

Run the match against all the files in the WEB-INF/jsp directory.

I pay about $150/year for an individual license for InteliJ IDEA because of it's refactoring, but it still can't do this. You can pry bash from my cold, dead hands.

My Favorite Free Windows Applications

I rely on a small set of free tools (suggested on Lifehacker) to keep my Windows (virtual) machines (and relative's Windows machines) running smoothly. They are:

• Revo Uninstaller: To remove programs, but perhaps more importantly, to nuke junk that auto-starts (click Tools, then the traffic-light icon). Does a nice job of removing the extra junk that inconsiderate programs leave behind.


• Ccleaner: To clean up trash on the hard drive and registry. I make sure to uncheck cookies for the cleanup in all my browsers. Longer-term, I will probably mark the cookies I care about as safe and let it nuke the rest. Then I run the registry cleanup repeatedly until it doesn't find anything any more.


• Microsoft Security Essentials (antivirus): Free, highly rated, low-resource, no hassle. Time will still tell, but so far, so good. I've always thought that Microsoft should be the one responsible for protecting their own operating system.


• MyDefrag: The "Weekly" script rocks. I don't run it weekly, but it's amazing what a mess Windows makes of its drive. It's like an animal soiling it's cage. MyDefrag really helps boot times. I'm very impressed. Note: I do not like the "Monthly" script at all. Sorting files in name and directory order seems like a total waste of time and disk-life to me.

Honorable Mention:

• sdelete: A command-line utility from Microsoft that zeros out unused disk space. This is nice for security reasons, but I use it to keep my virtual disk images really small. I run "sdelete -c C:" Then in Linux, "VBoxManage modifyhd --compact"


• cygwin: A Linux command-line emulator for Windows. I wouldn't live without it, but people wouldn't have a need for it.

The above programs have helped me tame the most clogged-with-crapware systems and make them secure and responsive again.

If someone told me that once I ran Linux, I'd think nothing of running several Microsoft operating systems, I would have laughed. But Windows works great in a VM. It's a fun toy when you don't have to rely on it to do anything useful. I use one VM for IE6 (for testing) and the other for IE8 (for programs that don't have Linux equivalents). Both are running Windows XP SP3. A Windows 7 VM is probably in my future.

What is Linux?

For those of you who don't know already, Linux is an operating system (like Windows or Mac OS-X), that is built by the public and it's free.* If you know how to use Windows or OS-X, You can install Linux and be using it with no training in about 30 minutes. It's made entirely of programs donated to the public good and many distributions come with office applications, games, and web tools already installed.

There are hundreds of companies, causes, and individuals who package Linux into a "distribution" consisting of the Linux kernel (the guts of the operating system) and a set of software designed for a specific purpose. For example:

- Easy-to use desktop: Ubuntu
- Corporate web-server: RedHat
- Free (GNU) software purity: Debian or gNewSense
- Minimal hardware: Puppy
- Run from a CD: PCLinuxOS
- Repair your computer after a crash: SystemRescueCD
- To be just like another distribution: CentOS (like RedHat)
- To protect networks: IPCop
- Breaking into other computers: PHLAK (Professional Hackers Linux Assault Kit)
- Christianity, bible study, and parental control: Ubuntu Christian
- Online learning environment, suitable for classroom use: Edubuntu

That's a random sampling taken mostly from Distrowatch. There is a lot of crossover between the goals and included packages of various distributions, but this gives you a sense of what's out there. Because the source code for the entire operating system and most of the software generally distributed with it is free and/or open-source, a programmer can compile their own version and alter it to work with custom hardware such as a new phone, or a robot.

Interestingly, no-one told anyone to create Linux. In 1989, Richard Stallman, a visionary programmer who could be called the world's first software activist, created a new kind of software license - the GNU Public License, GPL, or "copyleft. The GPL guarantees everyone's right to copy, share, modify, and (re-)distribute software. In 1991, A programmer named Linus Torvalds started working on a version of Unix that he could use on his own computer. He published it under the GPL and released it on the web and soon many other programmers (or "hackers") contributed changes and improvements. The work of untold numbers of programmers, writers, graphic artists, testers, and other largely self-selected volunteers, under the GPL and other "open source" licenses, has created Linux in all its flavors - and it continues to evolve.

Who uses Linux? We all do. At least half of all web sites run on Linux servers. Mobile phones such as the Android run Linux. 443 of the top 500 supercomputers run Linux. Increasingly, personal desktop computers run Linux. If you aren't familiar with Linux, I encourage you to get yourself a LiveCD of any distribution and give it a try. Ubuntu is currently the most popular for non-techies.

For your entertainment, here's a brief history of Linux through advertising (and one spoof):

Mac Spoof: Upgrading

I'm a Linux

The Heist

* Thanks to DigitalMan for helping me come up with a one-line explanation of Linux.

Settling in to Ubuntu Linux

I'm surprised at how much I like Ubuntu Linux better than Windows! The UI is basically the same, only everything is faster. Especially when you do anything to a file (write to it, read from it, move it, or delete it), Linux turns hours into Minutes. When you consider that doing anything useful on a computer generally involves changing a file, that says a lot!

Printing to a network printer was actually easier on Linux. Our vendor-supplied proprietary Windows driver hangs the printer every second or third time you try to print a PDF! I've got my complaints (a few sound limitations and a few software packages that I still have to run in a Windows VM). But whenever I have to fix someone's Windows computer I pity them. Even Windows runs better on Linux (in a VM). That way you can keep working while you reboot, reboot, reboot...

As I'm writing this, I can hear my wife downstairs using Windows... "Network Problems!?! I can't have network problems right now! Operation failed???" I feel sorry for her, I've been there myself, but I have to laugh at the background to this blog post.

I encouraged some people I know who are absolute beginners with computers to buy Macs. But now I'm not so sure. Ubuntu Linux is actually easier to navigate in some ways than a Mac.

Update 2010-04-01: I spent 2 hours trying to copy some pictures from a camera to the hard drive on a Mac and it was awful. In Ubuntu, your camera gets mounted as a drive and you can drag and drop the pictures wherever you want them.

The only drawback to running Linux is that some programs only run on Windows. Screen sharing programs (except for TeamViewer) all require Windows or Mac. The latest version of Microsoft Office only runs on Windows, Photoshop only runs on Windows/Mac, and Proprietary VPNs only run on Windows. Most people don't need those things, but I do, so I have to run Windows in a Virtual Machine. But I only have my VM running about 25% of the time.

Windows in a Virtual Machine

My Windows XP SP3 CD came in the mail yesterday. This time around I did a more-or-less default install in VirtualBox with 20GB expanding drive, 1.2GB memory, 24M video memory, and audio disabled. Instead of Symantec Antivirus, I tried ESET NOD32. I also disabled Adobe Drive this time because I got some weird messages. The install and all setup took about 8 hours, much of which was waiting, which is much more reasonable than the 3 days my previous attempt took.

The new image uses only about 6GB of disk space instead of 15, presumably because it doesn't contain any junk from my old hard drive. It is immeasurably faster than my 140GB image of my previous hard drive, half-of which was unreadable. Not sure how much was VM settings, Symantec, or other junk, but I think everything helped.

I deleted the old virtual hard drive image. It took hours because I had a dozen huge "snapshots" I had taken in VirtualBox, each of which took 1-20 minutes to delete. Before I started, my new 1TB drive was 60% full. Now it's only 7% full! What a disaster that was.

I currently use Windows in VirtualBox a few times a week for the following, but I work mostly in Linux:

Photoshop CS4

I use this a lot and it requires 1024x768 resolution for some of the dialogs to work properly (to show the Save button). Takes a lot of resources, but as much as I love GIMP, it's not a substitute for Photoshop for professional work.

A couple of proprietary VPNs

The nice thing about running these in a virtual machine is that it lets me check email and access the web from my primary OS while the VPN is connected.

Citrix GoToMeeting

Works great

Remote Desktop Connection

Necessary for work.

Internet Explorer

Necessary for work (for testing)

Microsoft Office

Open Office is a fantastic substitute. It changes the layout only slightly I think because the available fonts are different on Linux. I still need the real thing for presentations and testing for work.

Firefox HTML Validator plug-in

I really wish there was a Linux version of this!

Hopefully, over time, things like GoToMeeting and the Firefox HTML Validator will work on Linux. I'm still looking for a secure backup strategy for my entire drive.