hype-free: January 2010

Tuesday, January 26, 2010

You go PHD Comics!

PHD Comics is always great and hilarious (and worth to subscribe to if you are even vaguely related to the academic world - like trough a friend of a friend :-)) but there are those occasions when it is epic, like this one:

The media can almost never be trusted to get things right and we should get into the habit of questioning everything they deliver. Think for yourself people, get a grip on basic math and logic and learn how to dig up information!

PS. I'm not "new media", I'm just a raindrop :-p.

Carving out files with Perl

0 comments

I've had to use this trick a couple of times the last few years, so I decided that I might as well document it:

If you have an image of a storage media (like an SD card or CD/DVD) which you can not mount (either because the filesystem is hosed - that's a technical term for damaged beyond repair :-) - or because it uses some proprietary extension - *cough* MS *cough) and you know the approximate size of each file (maybe they are JPEGs or AVIs), you could adapt this script of mine.

What it does:

It reads $search_buffer bytes from $input
It looks for $header (as it is written it looks for RIFF, which means AVI or WAV usually - for JPEG you would use "\xFF\xD8")
If it finds it, it dumps $extracted_size bytes from the given position (this should be set to be larger than the biggest file you expect)
It not, it seeks forward $search_buffer - length($header) (to handle the cases when the header is split by the border of the buffer)

The script is not perfect (for one it tries to load the entire file into memory before writing it out; it also doesn't do any validation of the fileformat, thus possibly creating some garbage output), but it worked well for me in the past, so I thought I share it.

PS. If you need some more serious file recovery, you might want to look at PhotoRec and TestDisk. They are both free (as in freedom - GPL license) and seem to be great programs (I never actually managed to get them to recover more than my little cobbled together script, but I might have some very particular usecases).

Monday, January 25, 2010

Should I use RoboForm?

6 comments

A little background about this post: while I was vaguely aware of RoboForm, I never took a closer look at it until I saw the following post by Derek: Beware of fake shopping sites. What it basically says is that a password manager (such as Roboform) will help you avoid phising sites, because it will observe the different URL and will not pre-fill your contact details, thus providing you with an additional warning sign that something is phishy :-)

I have a great deal of respect for Derek so I did some quick checking around the product. Here are my findings:

My first question was: how does the company behind Roboform make money? Because if they don't have a clear way of making money and they are giving away the product for free, you might start to wonder - aren't they giving away my information to make money? I was relieved to find that they have a pro version which costs money. This doesn't necessarily mean that they aren't giving away your information, but there is one less reasons for them to do so.
The animated banner ad reminded me of some "smiley toolbar" advertisements which lead to adware, but taste is relative :-). An other marketing method of them which I personally found distasteful (although it is certainly legal) is the "Free Password Scan". This is a small tool which, when executed, shows the saved passwords from IE and Firefox. The purpose of this - I assume - is to show how "insecure" those browsers are (BTW, if you need such a tool, I would point you towards the NirSoft utilities). I dislike FUD and negative campaigning (sadly it works quite well).
A quick test in a VM showed it working as advertised. I have one remark though: while it doesn't store the master password in memory (as the setup boldly points out), it stores the individual account passwords in clear-text when it is unlocked. You can check this out using something like Process Hacker or Process Explorer. You should point them to the actual browser process, since it is there where the passwords are stored, rather than the main RoboForm process.
One thing which Roboform doesn't do is to differentiate between the HTTP and HTTPS version of the sites. It happily fills the secure version of the page with credentials saved on the insecure version and vice-versa, potentially exposing the user to and sslstrip type of an attack, which becomes more and more important because of the wide use of wireless technology.
Finally, I would like to comment on something Derek wrote in his post (so this is not an official statement from Roboform as far as I know): "ROBOFORM ... keeps all passwords in a secure encrypted database that only you (not a keylogger or malware) can access and use it". This is and isn't true. It is true that keyloggers won't see your individual passwords, but it will see your master password (!!!). Also, while Roboform will protect you against malware which specifically targets the password store of browsers (and there are quite a few of those out there), it will not protect you against the ones which inject themselves in the browser and simply capture the contents of any HTML forms which have an INPUT element of type PASSWORD in them - of course neither will SSL/TLS. And there are quite a few out there which do this.

In conclusion: I wouldn't trust my sensitive passwords to a closed source program and I would always go with an open-source alternative. Roboform isn't vastly superior in any particular way and the marketing around it leaves a sour taste in my mouth.

BTW, the links on Derek's site are affiliate links - which is all nice and good, I too have affiliate links in my blog postings occasionally - but I would have liked a clear disclosure about this fact.

Who feeds me? (with information)

0 comments

I received a private request to share the feeds which I read, an I though to do it publicly, since there might be other people interested in it (yeah, right :-p). Also, the least I can do is to post a link back to the authors website. So grab my OPML file or see the complete list below. Disclaimer: the presence of a given site in the list below shouldn't be seen as an endorsement. I read a couple of feeds to "hear the other party". Also there are a couple of dead feeds in were not cleaned up. So in no particular ordere here are the feeds:

hype-free

Tuesday, January 26, 2010

You go PHD Comics!

Carving out files with Perl

Monday, January 25, 2010

Should I use RoboForm?

Who feeds me? (with information)

Search the blog

Subscribe

Enter your email address:

Delivered by FeedBurner

Del.icio.us

Tag cloud

Powered by

Blog Archive

Recent comments

Top Commenters

My time

About Me

Things I read / listen to

Random blogs I'm reading

My stackoverflow feed

License and disclaimer

Visitors

Weather