See pics of women, free

Just now on Facebook I got the following advertisement:

I didn't quite react at the first glance, since every once in a while you get served the ads for "Russian ladies looking for love" etc. (hope I'm not the only one getting those). Then I realized that this ad was for Match.com! That's amazing. I clicked on it, and yes, it led me to: no.match.com.

The title of the ad suggests that it leads to one of the more sleazy sites on the Internet. If you do a Google search for free pics of women, you'll get the idea. Warning: NSFW!

I'm not convinced that this is how girls looking for a relationship would want their profiles advertised on the Internet. And it is yet an example of how a social website might try to capitalize on the personal information you've shared — in a way that would make you uncomfortable if you were made aware about it.

Shame on you Match.com! This is not how a responsible and respectable dating site would treat their users.

Giving up your privacy for nothing at Yahoo News

UPDATE Nov. 10th: The story about the dog turned out to be a hoax. Pheew.

This weekend I read a somewhat disturbing article on Yahoo News about a Jewish court sentencing a dog to death by stoning by children and decided to share the story on Twitter. Most news sites include buttons to conveniently tweet articles, Yahoo News is no exception. I clicked the "Retweet" button and expected to see the Twitter confirmation screen as I was already signed in to Twitter. But wait!
Yahoo News wants me to let TweetMeme use my account, that was a surprise. Usually I don't bother reading these pop-ups, I just close the window and then go on to share the link manually. But this was Yahoo News, so I started reading the pop-up to see what they were hoping I would agree to. Turns out it wasn't just the article about stoning the dog that was disturbing.

Why security questions are not

The other day, I received an "encrypted e-mail" through the Cisco Registered Envelope Service. Their "about" page states:

If the envelope is password-protected, it can only be opened by authorized recipients who authenticate themselves. If you are a first-time recipient receiving a password-protected secure envelope, you will be asked to register with the service to set the password which will be used to authenticate you.

I had never used the service, so I had to register before I could get access to the e-mail. To my surprise, I had to choose three security questions and provide an answer to them before the registration could be completed.

Steal a Google account and get a free OTP device!

I just read an interesting article on the Naked Security blog: New Android Market web store could open backdoor for phone hackers. Turns out, you can trigger installation of applications from the store and the installation procedure will silently complete on the Android phone. This could be a cool feature — but it comes with severe security implications for login procedures relying on mobile phones.

Why Facebook's social authentication fails

Just a comment on the latest blog post on security by one of the Facebook engineers.

First, it's a good thing that Facebook finally offers its users the most fundamental of all security measures, a secure connection to their website. Still I would have expected them to move faster, especially after the Firesheep controversies back in October.

Then to the most controversial change — the social authentication — which raises a few questions about both the security it is supposed to add and the possible effects on Facebook users' privacy.

The security failure
Consider some malicious Trojan-writer on the other side of the earth, trying to log into your Facebook account with your newly stolen password. Matching the pictures and the names presented in the social authentication should constitute a real challenge. It doesn't! Launching a google search for the suggested names, narrowed down to the Facebook site will reveal..... You guessed it! A picture of the person!

Social authentication illustrated

Facebook privacy bug: Your likes are leaked

I just discovered that Facebook reveal to search engines the users who "Like" a page , regardless of their privacy settings. Try a Google search and see for yourself — if you've disabled "Public Search" for your profile that is:

site:facebook.com "Your name here"

Why is this problematic? Well, I have set my Facebook profile to not be enabled for public search. Hence, my Facebook profile does not show up in Google's search results.

NewTwitter not working with Safari's private mode

A couple of days ago I tweeted that I had trouble with NewTwitter. It turns out that Twitter does not work correctly with Safari in "Private mode." At the time, only the top bar would load, no other content was visible in my browser. After switching off the private mode, Twitter yet again worked as expected. Even after turning private mode back on. This meant that I was unable to reproduce the problem.

Today, new problems. This time, the timeline of other users does not load. I get to see their profile, but without the timeline. My own timeline works just fine. Checking with Burp, and comparing with a page load without private mode, I'm able to verify that there's no request for the timeline. Checking the error console reveals the following:

What a strange error message:

QUOTA_EXCEEDED_ERR: DOM Exception 22: An attempt was made to add something to storage that exceeded the quota.

Some investigation reveled that this is an HTML 5 feature, as usual there were clues at stackoverflow.
When turning off private browsing, everything's fine, there are no errors reported.

Checking the localStorage W3 documentation gives me a strong feeling that Safari denies local storage when in private mode, and instead should have thrown a SECURITY_ERR exception (not that it matters to most end users).

I'm not sure who's creating the problem here, Safari or Twitter. I'll send the issue to Apple and Twitter. If I get a response I'll update this post.

Update 19 jan.: Twitter responded to my e-mail just now, they promised to fix the issue. Good stuff.

Some Azure signup challenges

Yesterday I blogged that MSDN subscribers got an Azure subscription for free. Today, I decided to activate an Azure subscription and take the first small steps into the cloud.

The ancient browser problem

I've been using Opera as my primary browser for more than ten years now. Why am I telling you this? Well, during the signup process for the Azure subscription:

Oh, the horror. I can't remember the last time I had to tell Opera to identify as another browser. Fortunately, under "Site Preferences" I could tell Opera to "Mask as Firefox" and it was all well... Come on guys. It's the year 2011. I cannot believe that this should still be a problem.

A more modern browser problem
But I hadn't left the rough patch just yet.