Manually Configure Your DNS Settings in Linux

Using your ISP's or employer's DNS servers may or may not be a good idea. Are they configured properly? Are they monitoring your lookups? Note that some employers may have policies regarding what DNS servers clients use, so you may want to look into those policies.

When visiting a Wi-Fi hotspot, do you really trust their DNS settings? By default client machines using DHCP will get their DNS settings as well as other addressing information from the DHCP server, which would be the router at a wireless hotspot. Trustworthy? Why would anyone think so?

First, don't bother with the Gnome/Mate/Cinnamon networking applet. It will let you make the change, but doesn't successfully change the system configuration. Instead, find the Network Settings. In the Mate menu it's at System|Administration|Network. It should something look like this:

Click on the padlock where it says "Click to make changes" and enter your root password. Click on the connection you want to configure. For this example I'm using a desktop on a home network using Verizon FiOS. Feeling neither trust nor love for Verizon, I'd rather not trust their DNS servers. Instead, I'll use OpenDNS. Here's a little piece at the bottom of their home page:

Note the two IPv4 addresses, 208.67.222.222 and 208.67.220.220. Enter these addresses in the DNS Servers box under the DNS tab. There are other choices for a public DNS, e.g., Google.

One unfortunate aspect of the GUI management of DNS settings is that with wireless connections, the settings must be made for each access point, which means that the first time you connect to a new access point, the DNS server address will default to the access point or its DNS server. Fix it as above and then restart networking.

At the Google page there is a link to a nice little introduction to DNS security.

Allowing Apps Access to Accounts

EFF points to an interesting article The Perpetual, Invisible Window Into Your Gmail Inbox which talks about pitfalls of allowing apps access to one's Gmail, Twitter, Facebook, etc., accounts. It's a good read, though my basic advice is don't give access to your e-mail to any app. However, with a smart phone the temptation might be great.

One of the sites mentioned there is http://mypermissions.org/. I recently deleted my Google+ account and barely use my Windows Live account, so the only account of interest there was LinkedIn. It turns out they think I had given access to two applications, an event announcement app and a survey app. They are probably both innocuous, but I was never aware of giving them access, and actually like the idea of getting rid of their useless event announcements, so I was able to disable them. Also, looking through my LinkedIn settings, I saw a number of settings that they had chosen for me by fiat, as I never would have chosen to allow e-mail from partners, for example. All that is cleaned up, but apparently bears revisiting from time-to-time.

In my Gmail account I had sharing among various Google services enabled and the ability to use my Google account to log in to some services enabled. Basically, if my Google account is penetrated, other dominoes fall.

Blackboard 9 Usability and Security

It turns out that Firefox users can improve their browsing experiences within Blackboard and keep their local data a bit safer through the use of the AdBlock Plus extension.

A problem I've had for awhile--predating Blackboard 9--is that when editing content within a Blackboard text area, Blackboard pops up a requester asking me to give some piece of Java code complete access to my PC. Of course I always say no. However, Firefox and Chrome seem unable to remember this, though Opera can be instructed to always block such a request from a particular site. Firefox is happy to allow one to always trust signed content from a provider, but not to always distrust. Strange.

Anyhow, these two AdBlock Plus rules block the annoying content from UMBC's Blackboard installation:

|http://blackboard.umbc.edu/webapps/blackboard/content/webeq3.editor.InputControl
|http://blackboard.umbc.edu/webapps/blackboard/execute/webeq3.editor.InputControl

It appears that Blackboard wants access to all the data and applications on my PC on the off chance that I might want to run an equation editor. I'll go out on a limb, having never tried webeq3, and say I have better equation editing tools on my machine.

Ubuntu 10.10 Day 0

Yesterday I installed Ubuntu 10.10 on my laptop, and have a couple quick encryption-related comments.

I installed from the alternate install image. The standard image does not include encrypted LVM. It does, however, allow one to encrypt user home directories. Is this good enough? No.

(1) In Ubuntu, encrypting a user's home directory fails to protect users who lose their passwords. This could happen a number of ways. It happened to me once via shoulder surfing. Many people use the same password for multiple services--a bad idea. The user password and encryption pass phrase should be distinct.

(2) Users tend to use weak passwords. Hopefully they choose better pass phrases.

(3) With just the home directory encrypted, swap is in the clear. This is a well-known leak and part of why secure software generally overwrites passwords and keys in memory as soon as they are no longer needed. Garbage collection is not good enough for keys. In general any data could show up in swap, and so swap should be encrypted.

Alert! Alert!

UMBC police are using a false alarm as an argument that we should sign up for text alerts. I guess the argument is "See, we sent out another useless alert. Don't you want to be sure you don't miss any of this irrelevant information?"

This country has been running scared since 9/11/01, and the situation a couple years ago in Blacksburg didn't help. But enough is enough, and "e2campus" is too much. We're expected to sign up to be alerted for events of near-zero probability, so almost any e2campus alert will be a waste of time.

> September 23, 2010
>
> To: The UMBC Community
>
> Fr: Mark Sparks, Chief of Police
>
> Re: False Report of a Shooting on Campus
>
> This morning, Baltimore County Police responded to a 911
> call of a possible shooting in front of the Retriever
> Activities Center (RAC) within about two minutes of
> receiving the call. Both police agencies did a thorough
> search of the RAC and surrounding area and found no evidence
> of a shooting through the search or citizen interviews on
> the scene. The call was apparently unfounded, and is being
> treated as a False Report call by the Baltimore County
> Police Department.
>
> An e2Campus text alert was sent out once the UMBC officers
> developed enough information about the call, to tell the
> campus the nature of the call and that it was unfounded.
>
> Members of the campus community are encouraged to sign up
> for e2campus, an emergency alert text-messaging system that
> will permit the University to notify subscribers to any
> campus-related emergency (such as potential campus safety
> hazards or campus closures due to weather). It is compatible
> with mobile phones, Blackberries, "smart phones," satellite
> phones, e-mail, wireless PDAs and pagers. Normal
> text-messaging rates apply. There are no additional
> charges. Sign up for this important service today at
> http://my.umbc.edu/go/alerts.

Security on the Client Side

Common--and good--advice is to not trust the client. If an organization has no control over the client, as is the case in web-based client-server applications, the client is not trustworthy. The Milwaukee Journal-Sentinel's Packer Insider is a very good low-stakes example of a site that has gotten this wrong. The Packer Insider is intended to be a subscription-only service, but I was reading it for a while, perhaps a long while, before I realized I was reading for-pay content.

If I visit http://www.jsonline.com/sports/packers/ in Firefox I get full access. If I visit it with Opera or Chrome, and click one of the Insider links, I get a login screen. What's the difference?

The difference is NoScript, an indispensable Firefox tool. NoScript is not intended to circumvent security, but rather to enhance client-side security. The idea is that if I let any given web site execute any script it wants on my machine, my personal data and the integrity of my machine are at risk. NoScript also helps me limit more obnoxious advertising by selectively shutting off Flash, JavaScript, Java, etc. NoScript uses a default-deny model, meaning that sites are not allowed to run client-side scripts unless I assent. NoScript is not for everyone because it does cause problems with some sites and it does require some effort on the part of the user, but it does provide a much safer browsing environment.

So, if I disable scripting, I get a much cleaner, more pleasurable view of the Journal Sentinel's Packer pages. As a side effect, I also get access to the Packer Insider materials. This is due entirely to poor security architecture at the Journal Sentinel's site, and, IMHO, strong evidence that the design was not done by an experienced professional. OTOH, there may have been other constraints making this desirable, and they may not actually care. If I were to lose access to these pages, I wouldn't really care because the Green Bay Press Gazette has comparable content that's openly-available.

As an aside, there are those that think it is bad to disable advertisements that support web sites. I have sympathy for this view, but I don't want their scripts running on my machine, eating cycles, providing animations which make it difficult to concentrate on the actual content, and, in extreme cases, making noise or damaging my system. I will aggressively block Flash, animated GIFs, etc., that damage the user experience.

This shows a general advantage of server-side over client-side scripting. Providers have a better idea of what their pages look like on the client side if they use server-side scripting--which is controlled by the provider--rather than client-side scripting, which is controlled by the end user, the browser, malware, etc.

Summary: security must be on the server side.

Web Page Raspberry--Pass the Bromo-Seltzer

The Bromo-Seltzer Tower has been an icon in downtown Baltimore for almost a century. And they have their own web page, http://www.bromoseltzertower.com/ . This is all good. However, it is entirely impossible to navigate the site without flash. There is nothing I've seen at the site that requires flash, so this seems like a case of a web developer who likes flash and uses it whether appropriate or not. The site crashed my browser twice this morning.

Of course, flash is one of the larger technological threats to web security, and works much more slowly than static content or server-side scripts. And there doesn't appear to be any substantial content at the site that isn't static.

There are better alternatives, though:

1. http://en.wikipedia.org/wiki/Emerson_Bromo-Seltzer_Tower
2. http://www.nps.gov/history/nr/travel/baltimore/b17.htm
3. http://www.baltimoresun.com/topic/economy-business-finance/bromo-seltzer-tower-PLTRA000097.topic

The site itself is designed by folks at http://www.missionmedia.net/ , which have a web site that's all flash and no usability themselves.

Soundtrack: The Church, Sometime Anywhere, Disk 2

Browsers

More and more I'm starting to use different browsers for different purposes. Opera is nice because it allows fine control over scripting on a per site basis. For example, at NFL.com, I can shut off most of the advertising but still use most of the site's features. I especially like this for Blackboard, however.

Blackboard is a commercial course management system. Essentially, it's bloatware loaded with features that I can't imagine many people use, but they persist because, apparently, someone uses each. One of the unfortunate features of Blackboard is that when entering data in a text area, it starts a Java application. Yes, an application, not an applet. For some inexplicable reason, Blackboard wants to run an application with full user privileges on my PC. This is even harder to understand, since disallowing execution seems to have no effect on Blackboard functionality. It's probably innocuous, but as a matter of policy, why subject all the data on my PC to Blackboard's whims and bugs? Plus, what, if anything, are the software folks at Blackboard thinking?

Firefox generates a warning, but doesn't remember negative decisions. It allows one to always trust a site, but not to always distrust a site. Strange.

Opera, though, now knows to never run Java at blackboard.umbc.edu. So far, this is causing no problems, and so Opera is now my browser of choice for Blackboard.

Clear.com Security FAQ

From clear.com: How secure is it?
Your CLEAR connection is very secure. Unlike WiFi, CLEAR technology uses a licensed 2.5 Ghz frequency and OFDM transmission protocol for a very secure connection.
The combination of licensed frequencies and OFDM technology provides a very secure connection.

This is a very strange statement, since neither the frequency nor how it's multiplexed have anything whatsoever to do with security. Their customer support says the link is encrypted, but the web site makes no mention of this.

Blackboard Security, UMBC

A couple items that instructors using Blackboard at UMBC should be aware of: First, at the beginning of most sessions when one is preparing to post new content, a requester pops up asking for permission to run a Java application. The correct answer is, emphatically, no. Everything works fine if you deny that application permission to run, so there's no need to grant it complete and total access to your PC (or to your account on the PC which, for most Windows users, is the same as the PC itself). Second, OIT often refers to Blackboard as a secure place to post grades. In some respects this is true. However, be aware that the grades are transfered in the clear, so anyone eavesdropping can see all the grades of everyone in your class. On campus this is probably a minimal problem for wired users. It's a switched Ethernet, and hard to eavesdrop on. The campus wireless is not encrypted however, so accessing a Blackboard grade book using 802.11 on campus is not secure. By the same token, accessing a blackboard grade book from off campus is not secure.

Security Issues Solved!

From the CircuitCity.com review of the Yoggie Gatekeeper SOHO Network Security Server:

Features Complete protection: Yoggie Gatekeeper SOHO offers corporate-grade security for your small office or home network. Protect up to five computers with 13 built-in security packages packed inside a small, palm-size, Linux-based security server. No additional software needed: No need to purchase or manage additional security software for your PC’s—just plug the Yoggie Gatekeeper SOHO into your Internet router and your computers are completely safe. Parental controls: Yoggie Gatekeeper SOHO manages the security from outside the child’s computer. Through an intuitive remote management environment you can enforce web content filtering policies, and control on-line time, without actually accessing the child’s computer. Easy to install and use: With Yoggie Gatekeeper SOHO you don’t have to be a security expert to enjoy corporate-level security. All you have to do is simply plug the Yoggie device into your network router and you are completely safe. It even feature automatic security updates and upgrades, so you don’t have to worry about downloads. Not once, but twice this review says that the user is "completely safe." Additionally, Circuit City begins the review with the phrase "complete protection." Finally a security device that offers complete protection! I can discard any other devices, software, or processes I have in place--Yoggie has it covered! To be fair, it appears that this is a stateful firewall and a proxy for a number of popular protocols. It probably does a fine job, but it certainly doesn't completely secure a network. Indeed, if a naive user believes reviews such as the one at CircuitCity.com, it's likely to make the network less secure. Unfortunately, the Yoggie site itself says "Connect your laptop to any hotspot without security-related concerns." So now I can send personal information over unencrypted wireless LANs with no security concerns? Another troubling thing is that one of the review sites says that software updates are free for a year, and an eBay seller mentions a three-year subscription. That raises red flags, and I can't find any mention of subscription prices or durations on the Yoggie site. The Circuit City page gives essentially no information beyond the market-speak given above. Amazon's description is roughly the same as Circuit City's "review," lending credence to my impression that the "review" was written by a marketer. Yoggie also provides something called the layer 8 security engine [sic]...