An idea that has come up many times before, User Identification, is a hotly debated topic among security experts. The general goal is to reduce certain levels of anonymity on the internet in order to increase accountability and security.


According to an article at Australian PC Authority, security experts like Eugine Kaspersky (co-founder of Kaspersky Internet Security) are recommending government-sponsored ID requirements for computer users that would increase security for banking and other sites at high risk of fraud.

As it stands now, the only identifying information that can be gathered about a website visitor is their IP address and the voluntary information sent by their web browser (user-agent and cookies). In the case of IP address, this is vaguely identifying and can lead to some information about the visitor's geographic location and service provider. On the down side, IP addresses are easily spoofed and often disguised by proxies, network address translation and VPN services. Browser information, including cookies, are all but useless in tracking a cyber criminal.

As proposed, two-factor authentication, biometric based ID and/or physical identification cards would prevent some of the most common threats. Phishing scams, identity theft and bank fraud would be much harder to pull off if you had to scan your fingerprint or retina to log on. Sound a little too futuristic to you? Well you may be right, but many laptops today ship with fingerprint scanners or facial recognition software already.

More realistically, ID card readers could require a form of digital passport for certain levels of internet access. Kaspersky believes IDs could be used to combat security issues associated with popular sites such as Facebook and MySpace. Currently the top places for deception-based scams (phishing) are Facebook, eBay and PayPal all of whom have no identification requirements beyond standard username and password. Physical counter-measures, on the other hand, are much harder for cyber criminals to infiltrate.

Reportedly, some Baltic countries and some British banks already have hardware-based identification in use today. On a larger scale, though, it would be very expensive and would require the cooperation of many governments, PC makers and financial institutions.

Is all this identification a good idea? Well many say no. According to a ZDNet article, there are various reasons why this would never work, including significant privacy concerns, risks of fraudulent authentication, technological hurdles and budgetary challenges.

As most of us know, the internet is a very big, very anonymous place and people should be mindful of the fact that not everything is as it claims. With new identification methods, there may be a less anonymous internet in our future, but for now we need to be alert and aware of the risks and approach online security with a "guilty until proven innocent" mindset.

A report by Google released May 3, analyzed 240 million Web pages and uncovered more than 11,000 domains involved in fake antivirus distribution. That accounts for about 15 percent of all malware (malicious or harmful programs).

The 13-month study conducted between January 2009 and February 2010 is part of Google's efforts towards "Safe Browsing technology" and it shows that scammers are increasingly turning to social engineering to distribute malware rather than exploiting holes in software.




This five-fold increase in fake antivirus (fradulent pop-up warnings designed to scare computer users into installing and often paying for false software) could indicate that people are far too conditioned to pressing OK when prompted without thinking first.

Many experts claim that the more "are you sure" and "are you really, really sure" messages that are presented to users (a big complaint about Windows Vista) the more the user grows accustomed to casually clicking proceed. Instead of causing the user to think twice or read the message, it trains users to think less and click more.

This increase could also be a consequence of protection software getting stricter and vulnerabilities being patched by software makers more quickly. It is reasonable to assume that if cyber-attackers cannot find a breach in the "security fence" then the next logical step is to get let in the front door by simply convincing the user to open up.

This kind of social engineering is nothing new. It can take on many forms aside from fake anti-virus. Take phishing scams for instance. Most of us have received an email at some point making unfounded claims, promising large rewards or attempting to look like it's from our bank. Sometimes the poor wording, or suspicious from-address can give it away, but a well composed look-alike can often fool the best of us.

As always, if you don't scrutinize every claim, you could likely get fooled. It's no fun to get ripped off, but you'll feel even worse afterwards if you realize you basically handed over your money, credit card or password to a scammer.



Death of Flash, Part 2

Posted by Sigate | 11:43 AM | 0 comments »

A few months ago we talked about the inevitable demise of Adobe's long lived multimedia platform in "The Death of Flash". Most of us in the development community have been aware of the decline in Flash for some time, but now it is catching some serious main-stream attention.


Steve Jobs of Apple Computers, made headlines with the release of his detailed Thoughts on Flash explaining why they will not support the platform on any of their mobile devices (currently the iPhone, iPod touch and iPad). Shortly after, Adobe CEO, Shantanu Narayen, spoke with the Wall Street Journal and tried to assure the Flash community of their ongoing commitment to the technology.

As we mentioned before, the battle is far from over and Adobe still has a very strong foothold on the desktop (where most web browsing takes place) but their fate is likely already sealed. It will take some time before we stop seeing Flash websites, but it is happening already.

There are several technologies taking on Flash from multiple fronts. Most notably, we are seeing HTML5, h.264 (video), Javascript and CSS3 moving in on Flash territory. These are all open standards and already supported on many web browsers and mobile devices.

The web transitioned long ago from a presentation medium to an interactive platform and for many years Flash was the way to give users the richest experience. As web standards have evolved and web-browsing platforms have diverged, we find the role of Flash significantly minimized in the day-to-day web.

Finding Apple on the opposite side of the playing field from Adobe is surprising to some, but it is a clearly strategic business move for them and will accelerate the demise of Flash in a global way.