139 karma · joined November 24, 2011
It's a useful excercise, I think, in that it demonstrates that even the most hardened of codebases still has security bugs and it also serves as a cautionary tale for people who think they don't need multiple layers of defence..
If they're seeing targeted phishing (which the article implies that they are), then the attackers will just observe the drop off in people following the links and move the phishing forms to another domain or service, making it very difficult for the admins to keep up.
Really addressing this kind of problem has to come down to a combination of awareness training and improved authentication techniques (i.e. move away from static username/password combinations)
You could argue that "big, enterprise" systems are likely to be more secure, but experience with things like Oracle databases around 8/9/10 would indicate that's not always a good measure.
You could argue (and people do) that the framework being open source is a good thing, or a bad thing.
So absent that information how would someone factor that into their choice of system?
I'd also say that the site itself doesn't make it that clear, that the money is an investment or gify. From the Kickstarter proposals I've read I don't see them heavily mentioning the idea that the backer won't received the reward at the tier that they donate to if the project doesn't succeed in creating the product.
If you look at some kickstarters that have big delays on their delivery (e.g. Zioneyes http://www.kickstarter.com/projects/zioneyez/eyeztm-by-zione... ) there seems to be a large percentage of backers who were expecting a product and aren't very happy not to be getting one after over 12 months)...
Definitely from a personal perspective I'm more careful now about what I back and specifically the track record of the project creators (i.e. have they done this before).
"This project is a blue sky implementation of a cloud based virtual paradigm which really shifts the boundries of our connected world.
Using patent pending technology to accelerate your business, we use full-stack web-scale systems built on noSQL databases to drive clicks.
And your security is safe with us. We use military grade encryption to protect all your data at rest."
Almost makes me regret being a freelancer.
(Most) people don't want a computer.
They want something to give them access to shop online or to keep in touch with friends, to watch videos or to play games and at the moment the iPad provides the easiest, most hassle free way to achieve that.
No A-V, easy updates, no worries about drivers or compatibility and it's relatively cheap. It's also very easy to use.
As an anecdotal point I've recently introduced my mother who's in her sixties and father-in-law who's in his eighties to iPads and they've both been able to use them easily and without a lot of the questions and problems that technologists learn to dread when they're providing family IT support.
The iPad isn't likely to replace laptops or desktops for IT professionals any time soon, but I think that for a lot of people it does what they want in an easier more intuitive way.
Extra work, but it is possible.
One other thing to watch out for with SSDs is the "native" AES encryption. From what I've read in many cases it's only there to provide a fast wipe facility and doesn't actually provide protection for data on a lost laptop. Some SSDs (eg Intel 320) provide password protection for the encryption keys via the ATA password, but a bit of reading didn't make me feel too comfortable with how they've implemented it.
Obviously if the cost (to the bank) of online fraud gets high enough it starts to make more sense. What's interesting is that some online apps (eg, World of Warcraft) have seen the benefits of providing 2-factor authentication faster than a lot of Financial Services companies.
2-factor auth of one kind or another seems to me to be a good idea for online banking, given the prevalence of banking trojans which have keylogging functionality.