EdgeCrafting - giving you an Edge !

Cult of the Dead Cow is still alive; The group behind the now famous Back Orifice virus released a vulnerability scanner called Goolag Scanner - giving anyone who can download and install a program one-click access to scan sites for vulnerabilities via google !

Doing a search on google for goolag scanner shows lot of goolag news - but no goolag site until around spot #28 as today (your indvidual placement for goolag searchresults may vary due to personalized searchresults).

I guess Google have applied a huge negative factor to their site, or the explanation might simply be there's too little goolag on goolag.org .
I did though note a website with IP numbers instead of the text goolag.org appear as hit #3.

Yahoo have no problems finder the Goolag Scanner!, Yahoo returns goolag.org as #1
It should only be a matter of time before someone make a Yahoo version of Goolag scanner also, value added with yahoo new open search approach were you can get access to yahoo search results directly via an API.

I guess you can look at it positive as it gives easy access for everyone to check their website security - but as with Back Orifice we will probably see a lot of script kiddies trying this software on other sites as well ....

Another reason to step up on your security, you can download Goolag scanner here!

---

If you like this article you might want to read Pwdhash - one password to rule them all, giving you advice on how to have a unique password for every site you use with a login - without having to remember them all

So little time - so many sites which need a password when you (have to) register yourself.

Admit it, you use the same password for different sites - don't you ?!, and if possible the same (set of) user-id's

Well, same password on different sites are not a good idea, each time you register yourself there's an increasing possibility the security on one of the sites will be comprised and a hacker obtain access to your password and user-id ......... and with those leaked there's free access to try them out everywhere else.

PwdHash - a password encryption plugin from Standford security lab solves this problem

PwdHash takes your password combines it with url for the website and generates a unique hashed password for each website from the same master password.

With PwdHash you can use the same initial password for different sites and let pwdHash generate the final unique password

"PwdHash is an browser extension that transparently converts a user's password into a domain-specific password. The user can activate this hashing by choosing passwords that start with a special prefix (@@) or by pressing a special password key (F2). PwdHash automatically replaces the contents of these password fields with a one-way hash of the pair (password, domain-name). As a result, the site only sees a domain-specific hash of the password, as opposed to the password itself. A break-in at a low security site exposes password hashes rather than an actual password. We emphasize that the hash function we use is public and can be computed on any machine which enables users to login to their web accounts from any machine in the world. Hashing is done using a Pseudo Random Function (PRF)."

It's not a solve all solution - your master password must not be given out, otherwise it would be possible for another person to use the PwdHash algoritm and compute the hashed password

I guess a simple solution and improvement to PwdHash would be to add a user configuration for PwdHash, with the option to provide a unique randomizing factor to the algoritm, e.g. a string (sentence) entered by the user at installation time.

Final advice; Don't use only one master password - use a minimum of 2 or 3

1. One password + PwdHash for newsletter and website registration
   
2. Another password + PwdHash for website that have your creditcard on detail (e.g. amazon, phonecompany etc.)
   
3. A third password + PwdHash for the most critical places (e.g bank account, paypal etc.)

Idea is to differentiate between websites without financial info (class 1) and those with financial info (class 2 and 3).
For websites belonging to class 2 and 3 you do not use auto-login or remember password features and even more carefully about the master password.

Hey, that's only 2 or 3 password to remember !

Get PwdHash - the password encryption plugin from Standford security lab

Review verdict: 4 keyholes out of 5

It works !, though missing the ability to add an individual hashing factor to the algoritm

May your password(s) be with you !

---

Liked this post ?! - check out other post about extensions

---

Got a beta invite to polarrose ("The Polar Rose browser plugin lets you discover who's in any public photo") and got sidetracked by a link while reading the polarrose blog to recaptcha.net


Love the idea behind reCaptcha, the service generates Captcha's from failed OCR at the internet archive;

"eCAPTCHA improves the process of digitizing books by sending words that cannot be read by computers to the Web in the form of CAPTCHAs for humans to decipher. More specifically, each word that cannot be read correctly by OCR is placed on an image and used as a CAPTCHA. This is possible because most OCR programs alert you when a word cannot be read correctly."

Apparently reCaptcha were conceived by Luis von Ahn who also happens to be the man behind Google Image labeler.

I've registered an account at recaptcha.net and will definitely use this service on a forthcoming website I'm working on.

reCaptcha offers a free captcha email protection service also at mailhide.recaptcha.net. Think I will reCaptha my email adresses instead of using this javascript email address obscuring script from projecthoneypot

Note, did find the audio version of reCaptcha a bit difficult to hear ...... glad I can read

Great example of utilizing wisdom-of-crowds to provide a real service. Nice tagline they got "stop spam - read books"

The polarrose service I'll blog about when I've got time to play around with the service