Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Thursday, December 21, 2006

Yahoo! Sign-in Seal - what exactly does this accomplish?


I'm no security expert here, but I like to think things through. Yahoo! has a feature which is, it seems, a few months old. But it's new to me. It allows you to create a custom image - here I've made one that says "yahoo sucks!" - and every time you access a Yahoo! login screen, you see the image and know it's legit.

It took me, as a semi-regular Yahoo! user, a few months to even notice the little plug for this feature on the Yahoo! login page. I don't often look around at the various graphics on login pages, since they're usually cluttered with ads and help for users without accounts. Now that I've set a witty statement as my sign-in seal, I may notice it more. But if it didn't show up, or an error displayed where the sign-in seal used to be saying "sign-in seal temporarily unavailable", would I suspect a phishing scam? Would most users?

Yahoo! uses some interesting methods to store the reference to the image. I was at first concerned that simply deleting cookies or the browser cache would result in a broken seal, but Yahoo! took precautions.

But Yahoo! doesn't seem certain about the reliability of their security feature:

What if I don't see my sign-in seal?

You could be on a fraudulent site, but there might be other reasons why you can't see it. For example, someone else using your computer may have deleted or changed your seal, your cookies or files on your computer may have been deleted, or you're using a partner or international Yahoo! site (like BT Yahoo! or Yahoo! India). To be safe, look for these other clues to make sure you're on a genuine Yahoo! sign-in screen.


Yahoo! is too quick to list other explanations to the missing sign-in seal. If a user has taken the time to look up Yahoo!'s help information about their missing seal, the company could at least provide them with a link to some more information on phishing and how to avoid being scammed. This brief explanation contains no links, nothing to do other than "look for these other clues" and then log in and hope for the best.

How much phishing has this sign-in seal prevented? Probably not much, if any at all. Quite telling is the little pop-up message (shown above) asking if that's your sign-in seal. Phishing sites won't bother to put that little pop-up message in, and that's the only time when users will need to see that message.

Friday, November 17, 2006

Malkin: A Student Baits the Taser?

Is Michelle Malkin serious? She has entered into the realm of satire. If an individual refuses to show identification, does she really think shooting them repeatedly with a taser is the appropriate response? At least we can agree that tasering them after they've been handcuffed is excessive, right? Please?

From what I've read, even the police agree that this man made no threats of violence and was nonviolently resisting after they tasered him. What sort of scary world would Michelle Malkin prefer to live in? Doesn't tasering people who refuse to show ID make the world less safe?

Then a police officer named Joel writes to Michelle, and it only gets more bizarre. He claims that the problem here was California-style political correctness. I guess that in liberal P.C. society, we're now politely tasering people who resist showing ID, who knew? According to Joel, it's better to "hit a person with your nightclub one time as hard as you can in the leg" instead of resorting to the gentle taser approach.

Tasers are not always non-lethal, and become much more dangerous when they're used repeatedly on someone. Tasering a person for a few seconds may be defensible in situations where they appear to pose a threat - tasering a nonviolent protester multiple times while they are physically restrained is indefensible.