Re: AppleScript & HTML Again...
Re: AppleScript & HTML Again...
- Subject: Re: AppleScript & HTML Again...
- From: "John C. Welch" <email@hidden>
- Date: Mon, 29 Mar 2004 06:43:33 -0600
On 3/29/04 12:07 AM, "BJ Terry" <email@hidden> wrote:
>
> That's not being stupid. That's following the documentation.
>
>
While it isn't (necessarily) stupid to leave the protocol name as is,
>
and to leave your hard drive name as is, it would be stupid to have
>
applications on your computer that automatically do something bad any
>
time they start up (and it would be stupid to trust applications
>
e-mailed to you, as in the previous example). Offhand, I can't think of
>
any applications that do anything bad when sent an open event, but
>
perhaps you have tons of these on your computer. Sure, a web page could
>
have a javascript that opens all the applications on my computer, if I
>
have Missing Link installed, but that will be hardly more than a
>
nuisance. Probably about as annoying as web pages opening my CD tray on
>
my PC. I'm sure I could deal with it, and remember never to go to that
>
web site again. If someone sent me an application that harmed my
>
computer with the intent to subvert it using Missing Link, it would be
>
subverted as soon as I manually sent it an open event with my mouse.
How about a javascript that started ALL the default, apple-shipped
applications...not just in /Applications...but Classic Startup, etc..that
would pretty much be a DOS attack.
>
>
> Do you change
>
> ever single default setting on everything you use? Of course not.
>
> There's no
>
> reason, barring a non-existant security warning, to change the
>
> protocol. In
>
> any event, that's security by obscurity, and *anyone* with a clue will
>
> tell
>
> you, that's not secure at all. That's blind luck.
>
>
Security through obscurity refers specifically to cryptographic
>
algorithms. If something is acting as a password, as it is in this
>
case, then it isn't subject to the same rules that a cryptographic
>
algorithm is. Security through obscurity doesn't work with algorithms
>
because one can break them by reverse engineering the executable, or
>
using statistical analysis techniques on the output of the algorithm.
Gee...because on all the security seminars I've attended, that's called
"cryptography", and security through obscurity refers to the computer
version of hiding the keys to the house under to the front doormat.
>
My password/protocol name is secure because I'm the only person who
>
knows it. If I changed my protocol name to JHKSFkdalDS3129, no one
>
would ever, ever, ever, ever, ever be able to guess it. Nor would they
>
be able to attack it with brute force. Why? Because I don't leave my
>
web browser pointed at websites barraging it with attempts to link to
>
various URLs like a:/Applications/iCal, b:/Applications/iCal. They only
>
way a hacker could ever find out my protocol name is to either hack
>
into my system, reading my preferences, or to physically sit at my
>
computer and check it. I'm not worried about either of those
>
situations.
For everyone like you, there's going to be someone who leaves it to the
defaults. Should they be punished for not changing a protocol name? If
that's security, then there's nothing wrong with Windows XP shipping with a
dozen ports open, because the USER should know to turn them all off. Again,
there are some VERY simple things that can be done within missing link to
make it FAR more secure by default than it is now. Requiring the USER to
make up for a lack of security thought is as unacceptable on the Mac as it
is on windows.
>
>
>
>
> I fail to understand this visceral refusal to acknowlege that while a
>
> really
>
> good idea, the current implementation of Missing Link has real security
>
> issues. Is the Mac community THAT bizarrely in denial as to think that
>
> changing a protocol name makes you immune?
>
>
>
> john
>
>
There is no reason to believe that changing a protocol name doesn't
>
make one immune. I know that protocols that aren't present on my system
>
are simply ignored by my web browser. I know also that no one knows the
>
protocol I use for Missing Link. Thus, no one can use the protocol to
>
open applications on my computer. Quod Erat Demonstrandum
Because it doesn't make you IMMUNE. It makes you a tad harder to find.
And, quite honestly, if someone wanted to bad enough, there's an EXTREMELY
simple way to suss out the protol name you DO use...
Two words:
Packet Sniffer
Unless EVERY html page you use ML with PHYSICALLY lives on your local hard
drive or on a mounted filesystem connected by an encrypted link, any script
kiddie with a packet sniffer can have your "magicallly immune" protocol
name.
john
--
"Memories fade Lenny, they were designed that way for a reason."
Angela Bassett
"Strange Days"
_______________________________________________
applescript-users mailing list | email@hidden
Help/Unsubscribe/Archives:
http://www.lists.apple.com/mailman/listinfo/applescript-users
Do not post admin requests to the list. They will be ignored.