Hackers Claim $10K Prize For StrongWebmail Breakin 193
alphadogg writes "Telesign, a provider of voice-based authentication software, challenged hackers to break into its StrongWebmail.com Web site late last week. The prize: $10,000. On Thursday, a group of security researchers claimed to have won the contest, which challenged hackers to break into the Web mail account of StrongWebmail CEO Darren Berkovitz and report back details from his June 26 calendar entry. The hackers, led by Secure Science Chief Scientist Lance James and security researchers Aviv Raff and Mike Bailey, provided details from Berkovitz's calendar to IDG News Service. In an interview, Berkovitz confirmed those details were from his account. However, Berkovitz could not confirm that the hackers had actually won the prize. He said he would need to check to confirm that the hackers had abided by the contest rules, adding, 'if someone did it, we'll kind of put our heads down.'"
Hu? (Score:5, Insightful)
Wait I'm confused??? They expected the hackers to follow rules?
Re:Hu? (Score:5, Interesting)
I'm thinking - if the hackers actually bribed/tricked the CEO's PA into just telling them what what in the calendar record then the guy is going to try to weasel out of paying.
Re:Hu? (Score:5, Insightful)
Social engineering is an perfectly valid and entirely effective method of hacking.
Re:Hu? (Score:5, Insightful)
But it doesn't test their software.
Re:Hu? (Score:5, Interesting)
Uh? According to NetworkWorld, "the IDG attack did not work initially, but succeeded when security software called NoScript was disabled on the Firefox browser, running on a Windows XP machine." wtf?
Re:Hu? (Score:5, Insightful)
They never logged into the account themselves.
It's an XSS exploit: StrongWebmail expended all their resources attempting to prevent people obtaining credentials and logging in. However, send an email with an appropriate piece of script to the target user, or provide a link targetting one of the iframes on the site, and all you have to do is sit back and wait for that to get loaded in the browser.
The person doing the exploit never has to log in, all they need is to get some script on the page and wait for the target user to use their account as normal, which triggers the exploit right inside the browser. That's why noscript blocked the attempt on IDG - it wasn't the hackers running Firefox+noscript, it was the journalist asking them to replicate the attack.
No secretaries, janitors or midnight exchanges of cash-filled envelopes required - they spent so much time decorating the front door that they forgot to check inside the constant stream of animal-shaped wooden statues delivered to the service entrance.
Re: (Score:2)
Wait, that sounds like it was a client-side attack on the CEO's machine. That also fails to test their email service.
Sounds like cross-site scripting to me. And if it can be done to the CEO to give other's access to his account, then it can also be done to any other user and their account too. If the company doesn't take precautions against that form of exploit then they are vulnerable and ultimately the bad guys don't give a shit about how they get access, they just care about getting access.
Re: (Score:2)
Yes, that would seem to be the case.
The thing that I've never understood is why more sites that are supposedly 'secure' don't have any mechanism for them to authenticate themselves to me. It would seem to me fairly trivial for users of a website to choose a second password that the website would show to them when they tried to log-on, after some sort of pre-authentication and therefore make it really easy to avoid any phishing attacks.
Re:Hu? (Score:4, Insightful)
That wasn't the whole challenge. The challenge was to access an account on their allegedly super-secure webmail service. If the software is fairly solid but the staff are easily duped/bribed... how secure is the service?
Even if social engineering alone resulted in getting access to the prize data, then the challenge has still been met: StrongWebmail.com - the service - is not secure.
Re: (Score:2)
But we might still give low ratings to StrongWebmail the service.
Hmmm, their site seems to require javascript to log in. I'll give it a low rating just for that alone.
Oh, even worse: enabling js for their domain alone doesn't work! Seems like they need googleapis.com.
I'm not going to enable js for other domains - what if googleapis gets exploited one day? Even if strongwebmail is ok, googleapis might not be (look at google's security track r
It does have to do with the service (Score:2)
"Procedures and Policies" are as much a part of the service as the programming of the web engine.
If you can trust the web engine, but not the staff- does it really matter? it's still a fail.
Re: (Score:2)
Re:Hu? (Score:4, Insightful)
In the real world I'm not going to care HOW my secret correspondence was hacked when they assured me it would never happen.
"They got in through a vulnerability in our OS, but our software held up".
"Someone in our company helped themselves/someone else to your mails, but our software held up".
"Someone installed a trojan that compromised the authentication system, but our software held up".
I understand perfectly what they are trying to achieve with this contest but they come off as sounding as if any other means of obtaining 'secure' information is beyond their liability when they state that it is the most secure webmail system out there.
There are many different levels to security that need to be continually addressed yet they seem to think that as long as their little solo phone app doesn't get compromised then it's not really their fault.
At least that's the way the rules and TFA sound.
Re:Hu? (Score:5, Informative)
Re: (Score:2)
Re:Hu? (Score:4, Insightful)
Re: (Score:2, Funny)
...social engineering is a very legit way to hack a system
interesting - are there more legit ways to hack a system? I'd like to hack into this bank but preferably without breaking the law...
Re: (Score:2)
ZDnet Article: http://blogs.zdnet.com/security/?p=3514 [zdnet.com]
One of the hackers posted an uninformative response on his blog: http://skeptikal.org/2009/06/strongwebmail-incident.html [skeptikal.org]
Re:Hu? (Score:4, Informative)
James said that these contests might be fun, but they don't provide a realistic measure of real security because they are encumbered with rules. The StrongWebmail contest prohibits working with a company insider, for example.
Re:Hu? (Score:4, Insightful)
Re: (Score:2)
The hell it doesn't! If hackers can pay the janitor or other employee a few bucks to access the CEO's email then I wanna know that before I hand StrongWebmail $$$ to handle my email. That's like saying social engineering [wikipedia.org] doesn't count. Of course it counts, the end results were the same, right?
Re:Hu? (Score:5, Interesting)
The hell it doesn't! If hackers can pay the janitor or other employee a few bucks to access the CEO's email then I wanna know that before I hand StrongWebmail $$$ to handle my email.
That depends on what they are providing. If they are providing a hosting service of some sort, then bribing a janitor counts. If they are providing a system to be handled by the local network admins (that's the impression I get), then it shouldn't. The janitors there are not the janitors that will be around the customers servers.
Re: (Score:2)
I would still claim it matters. In a properly designed system, the janitor shouldn't be able to get access credentials even if he or she wanted them. In a truly secure environment, every access of any type of information should be properly audited so that any permitted but strange access is noted as well.
Re: (Score:2)
And if it was because of the janitor attack, then the hackers shouldn't win the prize, but in that case I still won't say good things about StrongWebmail to anyone
Re:Hu? (Score:4, Insightful)
Why shouldn't bribing a janitor count? If I'm paying someone to call me every time I want to log into my email, then I'm probably pretty paranoid about security and don't want other people gaining access to my email. If security is so bad that random employees (including the janitor) can read my email, and those employees are so untrustworthy that they can be easily bribed, then that's just as real of a security problem as if their software were flawed.
Security is often only as strong as its weakest point. If the point of this prize was to prove that your email is secure on their servers, then gaining unauthorized access to other people's email on their servers should be enough to claim the prize.
Re: (Score:2)
Re: (Score:2, Informative)
Your impression is wrong. I just looked at their website. They're offering a webmail service like Yahoo or Gmail -- the difference is that they phone you with an access code at a pre-determined phone number every time you want to access your email account.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Question: Since the CEO got his information retrieved with out his permission would you trust their claims with your own data?
Re: (Score:2)
This was exploited using a bug in strongwebmail's software.
They weren't sanitizing or validating inputs on CGIs, which allowed the contest winner to run some javascript on the target's machine.
The other thing they weren't doing was protecting themselves against CSRF attacks.
This was ABSOLUTELY a problem with strongwebmail's software. Yes, user interaction was required, but the interaction was to exploit flaws in the software.
Re: (Score:2)
I suspect and hope that the statement was just a way to delay until the person in charge of the contest (some committee perhaps) officially confirms the win so that the check can be written.
that said, if you set something like this up with no rules you are being quite dumb.
for instance you can not violate law, don't ambush employees in the parking lot with weapons. Don't physically break into the building, don't download the employee database...
Re: (Score:3, Insightful)
Honestly what I find extremely funny is that they already know they have a security problem and that these hackers have some sort of access.
Are they really going to try and piss them off and not pay up?
Re: (Score:2)
Kidnapping his secretary and removing apendages till they talked is not worthy of paying for. Sneaking in and looking at his calendar while he's taking a dump is not worth paying for. Blackmale...No. Social engineering..No. They actually had to be intelligent and hack.
Telegraphing (Score:5, Insightful)
The size of the prize -- $10,000 -- indicates that the company thought it reasonably possible that they'd get hacked, and/or desired to avoid motivating any serious hacking attempt. Neither explanation gives me much confidence in their product.
And wow did it ever backfire. Normally they do these kinds of promotions in the hopes that nobody will bother, so that the company can later say "We offered a wheelbarrow of cash, and still nobody hacked us!". As if that was equivalent to a real security audit.
Re:Telegraphing (Score:5, Insightful)
Maybe I'm naive, but I figure StrongWebmail.com might be the best webmail site to use for security right now because they're in a heightened state of alert. Kinda like flying after right after 9/11.
Re: (Score:3, Insightful)
Strongmail isn't the "best" (whatever criteria you use for "best") webmail site for "security" (whatever your definition of "security"). It's proven that it's easily cracked, and that is in and of itself a stay-away sign.
I highly recommend Bruce's blog at h [schneier.com]
Re: (Score:2, Insightful)
There was nothing done after 9/11 to raise the level of security for the flying public. That includes the period right after 9/11 up to and including today. Everything that was done was in the spirit of "security theater" (credit: Bruce Schneier).
That is such incredible BS. Disregarding the heightened awareness of airport personnel and stricter rules for metal detection, body pat downs, and newer equipment, what about air marshals? You can't possibly be claim that under cover air marshals are "security theater."
Yeah, some of it is no doubt security theater, that's not in dispute...who says security theater isn't effective?
Re: (Score:3, Insightful)
Body pat downs are security theater. The 9/11 terrorists didn't have boxcutters on them nor would that have been found in a pat down.
Newer equipment has only been installed in test markets to do the "puff" test. It detects gunpowder or explosive residue. Neither the "liquid explosive" (myth) nor the boxcutters can be detected by it.
Under-cover air-marshals board first, and keep their jackets on. IF T
Re: (Score:3, Insightful)
We used to operate under the assumption that would-be hijackers wanted political attention and/or money. Now we operate under the assumption they are willing to die if it means inflicting more casualties. This means we will never again open the [now reinforced] cockpit doors in any circumstances when there is a hostile scenario in the cabin.
So all of this talk about box-cutters and other mythi
Re: (Score:2, Insightful)
Pilots will likely respond and land the plane. Sure,
Re: (Score:2)
That's a red herring.
No, it's really not. But you ARE missing the point here. Stopping weaponized planes is exactly what most of the security additions are about.
These same N terrorists (pick a number -- the lack of security won't prevent ten boxcutters from being brought on board any more than they'd not prevent 4 being brought on board) can threaten a LARGE number of innocent women, children, and men.
Pilots will likely respond and land the plane. Sure, it won't be used as a weapon (but that was the 8-year-old plan... not tomorrow's plan). They can still get hundreds of hostages.
Yeah sure, terrorists being able to avoid watchlists, smuggle on boxcutters, and attempt to overcome any air marshall on board the plane to take the passengers hostage is a certain possibility. However, since nothing remotely close has happened since 9/11, you're talking in pure hypotheticals. The scenario of "planeful of hostages" versus "weaponized plane impacting ur
Re: (Score:2)
Best of luck to you argumentative types -- I've got some racing to go watch.
Touche ;-)
Cheers
Re: (Score:2)
Parse the 'security' definition a little further and/or with more care; in particular, pay attention to the use of the word "assure", as opposed to "ensure", which, based on how you are arguing this point, seems to be your expectation of what is implicit in the term and/or idea of 'security'.
Security (3) reads: "Something that gives or assures safety,"
The first half of Assure [thefreedictionary.com] defined states:
1. To inform positively, as to remov
Re: (Score:2)
Assurances are not security.
To wit:
I hand you a router. I assure you that you can put your unpatched Windows boxes behind this router, and it will protect them. I tell you that you can hook the other side of this router to the Internet and it will continue to protect those boxes from all threats.
My assurances are nothing more than empty promises, as this router exposes each box that you attach to it directly to the Internet.
Happy Saturday!
Re: (Score:2)
That policy change happened before the day was out, even - as evidenced by a field in Pennsylvania. An airliner in the US will never be hijacked again.
Re: (Score:3, Insightful)
Sadly, sir, you are incorrect.
E
Re: (Score:2)
Do you honestly think a planeful of people are going to let someone take over the controls, regardless of what weapon he might have?
That's not happening - it simply won't. They'd have to kill everyone on the plane.
Re: (Score:2)
Just out of curiosity, have you ever been in a situation that involved the use of deadly force?
Re: (Score:2)
>>No, they'd kill one flight attendant, then grab another one by the neck and ask "Who wants to come up and be next."
Have you SEEN a box cutter? They're x-acto knives, dude. If some terrorist has hijacked my plane by shouting at the pilot through the security door that he can't get through now, and the pilot is - what? - intimidated into steering into a skyscraper (think about why this doesn't make sense) AND is waving a box cutter with a 3/4th inch blade sticking out of it, then fuck yeah I'm taking
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No, they'd kill one flight attendant, then grab another one by the neck and ask "Who wants to come up and be next."
All the little wanna be heroes would remain seated.
Doubtful. Even *I* can see that a planeload of people can overpower five? ten? attackers. If we can play up the passenger's fears of riding around in the guts of an extra-large missile, we can get them up and striking back. :D
Re: (Score:2)
"Heightened awareness" of untrained personnel yield more chaos and more chaffe, not more data. Sorry.
Body pat downs are security theater. The 9/11 terrorists didn't have boxcutters on them nor would that have been found in a pat down.
You know that's interesting--blanket statements without the slightest bit of supporting evidence. Retraining staff was a large part of post-9/11 reforms. Patdowns--which I've only ever had to go through once when I forgot my shoes had some metal in them (this was before proforma taking off of shoes)--are certainly effective as a layer of security. Should cops (etc) get rid of patdowns on criminals since it's jut security theater?
Newer equipment has only been installed in test markets to do the "puff" test. It detects gunpowder or explosive residue. Neither the "liquid explosive" (myth) nor the boxcutters can be detected by it.
I'm not sure where you're getting these facts--at my local airport shortly afte
Re: (Score:2)
The toilet stuff (not congregating, and not using the forward toilet if you're in steerage) isn't security OR security theatre. It's a way for the airlines to use government force to keep first class service
Re:Telegraphing (Score:4, Informative)
You think awareness will help to any degree? Awareness of what and how is that equal greater security? I worked at a major airline before and about 5 months after 9/11. I worked at an airline and at an airport that was used by the 9/11 terrorists. Things may have seem to have changed but if you knew anything about the operations at an airport, it was smoke and mirrors. Maybe have things have changed since then so I can not comment.
On another note, I now live and work in DC. I see cars being checked before pulling into parking garages of important buildings. A security guard walks around the car with a mirror on a stick and checks the underneath of the cars before allowing entry. You call that increased security? Paint your bomb with undercoating or put it in the truck, in your engine bay, or hell, even in the back seat. As long as it does not have flashing lights and does not say "EXPLOSIVE" on it, they would never know.
You want to know what heightened awareness there is? Remeber this incident? http://en.wikipedia.org/wiki/2007_Boston_Mooninite_Scare [wikipedia.org]
It had lights and wires, it must be a bomb. You feel save with that level of awareness? I don't.
Re: (Score:2)
I was on a flight last night, actually, and looked over to see a fire extinguisher behind the last row of seats.
I can't take nail clippers on the plane (because I might hijack it!), but its okay to leave a fire extinguisher sitting there. Ever see someone sprayed with a fire extinguisher?
If America was a truly free country still, 9/11 would have ended with a bunch of terrorists with gunshot wounds.
Re: (Score:2)
I can't take nail clippers on the plane (because I might hijack it!), but its okay to leave a fire extinguisher sitting there. Ever see someone sprayed with a fire extinguisher?
Really? Do you REALLY ever fly? I've flown about a dozen times in the past year, have a normal sized stick of deodorant, travel shampoo, normal toothpaste, and nail scissors in my cosmetics bag and I've never once been stopped.
I guess you think that planes should not have fire extinguishers??
Re: (Score:2)
Security theater is worse than no security at all.
Re: (Score:2)
Security theater is worse than no security at all.
Explain why.
Re: (Score:2)
Security theater:
A) Consumes resources better used elsewhere, like, say, real security.
B) Can further reduce funding for real security by convincing less knowledgeable people that allocating resources to the smoke and mirror show actually *is* keeping them safer. They *feel* safe, so they don't see the need to spend more for something that actually *keeps* them safe.
Please don't go off on a tangent about the TSA or stuff like that. I'm addressing your challenge and nothing more.
Re: (Score:2)
That is such incredible BS. Disregarding the heightened awareness of airport personnel and stricter rules for metal detection, body pat downs, and newer equipment, what about air marshals?
Not to mention that it would have been crazy to attempt a hijacking after that. As soon as you made a move *bam* a sea of people would have sat on you.
Heightened state of alert. It's not just for passengers, it's for corruptible PA's, too.
Re: (Score:2)
Yes, if they were so busy looking for dark skinned people with bottles of Evian mineral water that they missed some Russians with Polonium. This did happen.
Re: (Score:2)
Maybe I'm naive, but I figure StrongWebmail.com might be the best webmail site to use for security right now because they're in a heightened state of alert. Kinda like flying after right after 9/11.
I'm building a webmail service packed with so many sql injection opportunities that it gets hacked by accident, just so you can put your mind at ease.
Re: (Score:2)
On top of that, he will have a tounge...
Tongue. The word that you are looking for is tongue.
Re:Telegraphing (Score:5, Funny)
The size of the prize -- $10,000 -- indicates that the company thought it reasonably possible that they'd get hacked, and/or desired to avoid motivating any serious hacking attempt. Neither explanation gives me much confidence in their product.
And wow did it ever backfire. Normally they do these kinds of promotions in the hopes that nobody will bother, so that the company can later say "We offered a wheelbarrow of cash, and still nobody hacked us!". As if that was equivalent to a real security audit.
Perhaps they'll fix their software by simply offering a lower prize.
"Hack our software, and win a free small soda with purchase of any McDonald's value meal!"
Re: (Score:2)
Interesting approach (Score:4, Insightful)
Re:Interesting approach (Score:5, Insightful)
This is obvious (Score:5, Insightful)
If they idea is to determine whether it can be cracked, why are there rules? Whether they followed some self-imposed rules or not, it still indicates that there is a weak link in the armor.
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Rule #0 - A "win" is defined by the rules.
If there are no rules, there is no winning. If there is no winning, what sort of contest is it? And who gets the prize?
Yes there may be a weak link in the armor, but if you don't follow the rules you SHOULDN'T get the $10K.
The Catch (Score:5, Informative)
from StrongWebmail's Site [strongwebmail.com]
There's just one catch: to access a StrongWebmail.com email account, the account's owner must receive a verification call on his pre-registered phone number. So even though you have our CEO's username and password, you still have some work to do because you don't have access to his telephone. If you do manage to be the first person to break into his email account, there's $10,000 in it for you - just register below to get started. Good luck!
So they have to hack the phone company's system too, or find a way to clone his cellphone, so they can intercept the call and approve access? They might be cool with having their own systems hacked, but it sounds like they are now involving a phone company, which might not be too thrilled to be a part of their little game - the only way around that I can see is to hack the StrongWebmail system to change the "pre-registered" phone number....
and who the hell wants an email account you have to approve via phone call every time you login?!? What if your phone is lost/broken/dead/no reception/etc.. then you have no way in
Re: (Score:3, Funny)
Telesign, a provider of voice-based authentication software...
Sounds like something for protecting a phone system.
Re:The Catch (Score:4, Funny)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Blackjacking's been around for awhile (Score:3, Informative)
Re:Blackjacking's been around for awhile (Score:5, Funny)
Hacking (or blackjacking, to use the vernacular) cells has been in existence for quite awhile, with probably Thai coders taking the lead, with Chinese, Americans, Germans and Brits coming up from the rear.....
That must be uncomfortable for the Thais...
... What? Oh! 'Coming up from the rear.' Forget I said anything.
Password are bad for security. (Score:2)
Passwords are a bad means of securing a computer. Sure, passwords are far cry more secure means no authentication at all, but they do have some pretty severe limitations...
1) Any breach of a password pretty much kills them. Dead. If your ex-GF/BF gets the password to your webmail account, god help you, because the password in their hands works just as well as in yours.
2) Usually you don't have any (obvious) way of knowing that the breach occurred.
3) Because of (1) and (2), they are highly vulnerable to soci
Re: (Score:2)
1. Install script in end user's browser using drive-by download on site you get them to access, emailed javascript, etc... multitude of ways.
2. Wait for end user to accomplish steps 1-3a for you, which he will the next time he checks his mail.
3. Installed script passes whatever you want back to you since it now has secured access to your secure site. (???? step)
4. Profit $10K!
The phone call method of security is useless if you can just wait for the end user to legitimately accomplish it for you when they th
Comment removed (Score:5, Interesting)
Re: (Score:3, Funny)
Comment removed (Score:4, Interesting)
Re: (Score:2)
I'm not saying GSM isn't swiss cheese from todays security POV, bu
Re: (Score:2)
Re: (Score:3, Insightful)
The only detail that your missing is that you would also his username and password in addition to being able to tap his cell phone.
Re:Full Details (Score:5, Informative)
Re: (Score:2)
Unless the explanation itself is emailed to them and contains a secondary attack... if they really did it with XSS as the ZDNet article states, that's a reasonable assumption.
But we may be bordering on ridiculous.
Just Kidnap the Bastard (Score:2, Interesting)
Point of Order... (Score:2, Insightful)
Void where prohibited, taxed, or otherwise restricted by law. Subject to all federal, state, and local laws. This Contest is open to all legal residents of the United States and the District of Columbia, and U.S. Military personnel (and their families) with APO/FPO addresses, who are eighteen (18) years of age or older.
Void where prohibited? - Hacking? Nah...
Taxed? - Hacking? - Donno it might be now...
Otherwise restricted by law? - Hacking? Nah....
Subject to all federal, state, and local laws? - Hacking? Nah...
Only open to US residents? - SURE, "all" the best hackers and US born.
18 Years of Age. - O yes, for "all" the best hackers are 18 and older because they have girlfriends, jobs and a shit-ton more to loose.
Gezzzzz come on now... If you try and claim the 10 grand you're going to get 30 years in federal prison.....
No w
Re: (Score:2)
Only open to US residents? - SURE, "all" the best hackers and US born.
18 Years of Age. - O yes, for "all" the best hackers are 18 and older because they have girlfriends, jobs and a shit-ton more to loose.
They have to limit their liability by only allowing American adults, a minor can't enter into a contract so there's no point in even allowing them to compete. They probably need to be American just in case the company decides to sue them. As for hacking being illegal, it's not exactly illegal when you have permission to do it. The definition of hacking includes lack of authorization to do what you're doing. If you have authorization, legally speaking you're not hacking.
Re:Point of Order... (Score:4, Informative)
There are anti-hacker laws, but they generally read along the lines of
Whoever having knowingly accessed a computer without authorization or exceeding authorized access... ...
Whoever intentionally, without authorization to access any nonpublic computer
Whoever knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access
(From 18.USC 1030 [cornell.edu], the law Lori Drew was charged with)
Darren Berkovitz gave explicit permission when he announced this contest, so they had authorization to attempt to gain access by any means allowed by the rules. The only restrictions given were that you had to register first, and you couldn't get help from a StrongWebmail employee.
The rest of the rules looked innocuous to me. Most of it was standard broiler-plate which is required by law for any contest - a cereal box prize will have the same language. The last paragraph of the third section was all just Disclaimers of Liabilities - we aren't responsible for network congestion if someone tries to DoS us to win the prize, we aren't responsible if you download some script-kiddy software to use in the competition and it screws up your computer, etc.
If you did clearly break the rules that you could be charged under 18.USC 1030 as the access was unauthorized, knowing (you agreed to the rules), and fraudulent (you were attempting to cheat them out of prize money), and crossed state lines. But they weren't tricky rules to follow.
Put their heads down? (Score:2)
Won't they have to pull their heads out, first?
Remember, folks, in the real world, crackers won't abide by your user agreements. They will look under your secretary's keyboard for the password list, check your logs for mistyped passwords instead of login names, read your Subversion stored plain text passwords from your backup tapes, and read your Wiki for shared passwords.
Re: (Score:2)
Re: (Score:2)
Yeah, and blackbirds are just black birds, so it should be written that way!
Or, you could learn English as its actually used, instead of pretending its a programming language.
Log On/Off, In/Out Annoyance (Score:2)
What greatly annoys me is when I see a site has that has for example a "Log On" button but the corresponding button is called "Log Out" when it should be "Log Off".
Re: (Score:2)
You can't possibly tell that from the screen shots. The form itself is not on an SSL-protected page, but that's not uncommon. What's important is whether it *submits* to an SSL-protected URL, and I'd be kind of surprised if they didn't do that.