Site Sponsors!

Jan
07

Lessons in Computer Security!

By Tom Whiting 2 views
(No Ratings Yet)
Loading ... Loading ...

1. DON’T use Internet Explorer!!!!!
There is no reason, whatsoever for any user to actually use internet explorer any more. Even MyIE (or whatever they’re calling it nowadays) is bad, because it’s BASED off of the IE engine.

So, why replace IE?

a. It’s non standards compliant.
Even ie7 (which who knows when we’ll see) is going to not be standards compliant. Sure, they’ll rewrite things from the ground up, but they refuse to comply to W3C standards, which is just ridiculous.

b. It’s NOT a web browser!
IE is based off of (and uses) the file browser Explorer. Because of this , IE is surely not fully qualified to be a “web” browser. It’s a file browser, but NOT a web browser. Even IE7 and explorer (in vista) will most likely be closely integrated.

c. Security? Where???
IE has been well known before (and after) XP SP2. Yes, they cleaned up their act and got a bit more harsh on permissions, but IE is still IE and it’s still 100% insecure.

The question shouldn’t be why REPLACE IE, but why USE it? With IE being the most popular browser out there to hijack, why in bloody hell would ANYONE want to use this POS browser?

Misc. Myths:

a. “If I use another browser, I won’t see stuff that I should”
This is because IE uses older, non standards compliant CSS code. In other words, the problem isn’t the OTHER browser, but the fact that IE is wrong. In most cases, this is not a problem though.

b. “I won’t be able to view my favorite site using (insertotherbrowserhere)”
Again, this isn’t correct. In 4 years of using “other browsers” on Windows (I’m not going to plug another browser, you can see the one I use in the “cool stuff” section ;), I have not once seen any truth to this statement. Sure, there are (a few) people like Yahoo who refuse to write code properly, but those cases are extremely few and far between. In fact, the ONLY case I’ve seen is Yahoo lately where that’s a problem, and they’ve said they’re working on it, supposedly.

c. “Internet Explorer is Secure with SP2″
This is just incorrect. Days after sp2 came out, numerous hacks were written which proved that IE was STILL insecure!!!

d. “They can still get to me if I use another browser”
Again, incorrect. I use other browsers, and have for years, and NEVER once have I had any problems with spyware, virii, etc.

2. DON’T use Outlook (or Outlook Express)
Hey, if these guys can’t write a BROWSER properly, what makes you think they will be able to write an EMAIL client properly? Well, believe it or not, they can’t.
Outlook/OE are extremely insecure, in the fact that they , like IE are too permissive. Viruses are written for these email clients on a daily basis, and, as always, nothing is done about this @ the Microsoft front. Sure, they claim to be doing stuff, but those are always just empty promises. It takes months, sometimes years to get updates for these products to fix huge security holes in the product.
Reasons not to use Outlook / OE:
a. Registry issues:
We’ve all come across these, and as a tech, I can’t count the times that I’ve received this call:
I’ve modified nothing in my email client, yet I can’t send or receive email
Every time, it’s the same thing:
Client is using Outlook or Outlook Express.
Once I tell them to close the client, and restart the computer, usually (usually) this helps. If THAT doesn’t help, then I tell them to re-download the auto configuration, and then do the same thing. That ALWAYS helps
So, what changed? Nothing. The server didn’t change anything , the email address and password didn’t change. This is the mystery that is the Microsoft Registry. Love it, leave it, whatever, the registry gets modified quite frequently, and in many cases WILL screw up Outlook/OE.

b.Proper Error Reporting
Oy vey, how many times have I heard the following:
I’m getting this error in Outlook
Error 0×800CCC0F (or insertothererrorcodehere) when sending or receiving mail.

Please, someone tell these people how to PROPERLY report errors, my god! That’s about as helpful as the following (and I have got this one too):
My server’s broken, I don’t know what broke, but it’s just not working
Errm, hello??????? Come on now, seriously. A properly designed email client will not give you binary error codes, it will spellout the problem, and go from there. Jesus F’ing Christ!

c.Security
Security is a pretty hot one. I’ve talked a bit about the security factor, but not a lot. Here’s a few things that Microsoft Outlook (OE) does wrong in the security end of things.
A> Automatically displaying images, without the ability to turn them off
B> Automatically sending emails without permission
C> Automatically parsing and loading scripts such as vbscripts, js, etc
D> Automatically displaying html, without the ability to turn them off.
E> Improper filtering options
F> Inability to properly seclude and secure accounts
Admittedly, the (later) versions of Outlook handle the first and last (I believe) well enough, but let’s just face it, who wants to spend hundreds of $$$ for security features, right?

d.Backups
A proper email client will back it’s own data up and provide the individual with the ability to backup/export AND restore reasonably. Let’s face it, losing email is a bad, bad, bad thing. Outlook and OE have BOTH failed this test

So, how about some alternatives?
Here, I will actually speak up a bit. I use Barca by Poco systems. This is intended to be an alternative to Outlook, not OE. They do a lighter (cheaper) version for those just looking to replace Outlook Express, the only difference between the two being the Office type functionality (calendar, notes, diary, etc). These guys are the BEST that I’ve seen and the most secure. Unlike most, they do not use the Microsoft Rendering engine for mail, meaning that my mail is 100% secure.

3. ALWAYS use a firewall
Windows firewall isn’t going to cut it in this case. It’s too new, to clunky and too, well, too problematic. If you’re online, and you have a broadband connection (even if you don’t), you’re going to be attacked and run the risk of dealing with zombie programs, etc. Know what’s going on in your PC, KNOW what’s being done to it, and know what can be done to prevent it. The best out there will tell you you’re being attacked and proactively block that attack. This is how things SHOULD be done. Without a firewall, you’re screwed, seriously!

4. ALWAYS use Virus Protection
Email isn’t the ONLY way you can get viruses, gang, and more and more individuals are realizing this. Virus protection is ONLY as good as the individuals sending this out. There are a number of top players in the game here, so I won’t go into this much more. Just remember, that your connection is more than JUST email!

5. ALWAYS know what you’re installing, and where you got it from
Another big one here, really. This comes up more in p2p than anything, but still you NEED to know what you’re installing, where you got it from, who the developer is, and, download the product DIRECTLY from the developer whenever possible. I realize that it’s not ALWAYS possible to do this, but it should be done as much as possible.

In 5 years of running Windows PCs (previously Linux), I have yet to get a “virus”, “trojan”, or anything else. Why? Because I’m safe and secure with my browsing. Remember, gang, you are responsible for your browsing habits, and your PC. Don’t leave your PC insecure, or you too might be getting a visit from the RIAA someday claiming YOU did something you have no knowledge of.

Peace out,
-=T=-

Categories : blog

Leave a Comment

Jukebox