Tool turns unsuspecting surfers into hacking help

TalkBack 9 of 38:

Next »

« Previous

• Thread View
• Flat View

Speak 4 urself, but not TO urself!

You guys are talking past each other. Yes, of course, from a security standpoint -- and from a good security standpoint -- it is highly desirable to just block script execution globally, allowing exceptions only for trusted sites. But in the real world, doing this is difficult. It is NOT supported by the security model in any of the major browsers, nor is it encouraged by the proliferation of sites out there today that become difficult to use or even useless if you do _not_ enable script execution.

So I am glad this issue is finally getting the attention and publicity it should have got years ago.

But now what would a realistic solution look like? Relying on an add-on is a really bad idea, especially if it is only available for a browser with only about 10% market share (Firefox). That just means that hackers will go ahead and develop the attacks, and target IE users, which are already an all too attractive target.

And please, don't smugly say "I use Firefox, so this does not affect me". It affects all of us, whether we use a vulnerable browser or not.

But back to a realistic solution: all major browsers will have to get security upgrades and the new default installations will have to have the new security features enabled by default. And these features will be? If we insist on IE's notion of 'zones', it will have to support a new set of zones, one that allows the distinction between sites trusted to run scripts, and those not so trusted.

More important, it needs to support a way for the technically-not-so-savvy user to _update_ that list of trusted/non-trusted sites, based on _reliable_ information.

One way to do this would be to support a secure certification program, much as VeriSign does with their SSL certificates: in order to get a certificate from VeriSign, you have to prove to them that you are who you say you are, and that you follow basic security procedures to keep your own site from being hacked. Once you prove this to VeriSign's satisfaction, you get the privilege of paying for the certificate.

Of course, this is not perfect either. It is possible to fool VeriSign into thinking you are much more trustworthy than you are. Possible, but not easy.

But it is a much better security protocol than the current 'system'.

Posted by: mejohnsn   Posted on: 03/23/07 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Open Standards Technologies Provide the Ingredients for Delivering Security Across the Papa Gino's Enterprise Dell Papa Gino's Holdings Corporation founded by the entrepreneur operates one ... Download Now