Category Archives: Security

Quicken Online?

0
Posted by admin on February 3, 2008 – 3:50 am
Filed under Misc, Rants, Security

I can see doing a lot of things “online”.

Email? GMail is pretty dang slick, with a spam filter that’s second to none.

Stock Portfolio and watchlists? Sure.

Craig’s List Searches? Right there on my homepage.

Word Processing? Spreadsheets? Hmmm. Google apps is definitely interesting, although I tend to want to keep my files close at hand.

Personal finance information? Huhwhaaaa?

Call me old fashioned, but the thought of putting access info to my entire checkbook/credit card/bank account/investment accounts online just seems a little, uh, risky?

Hell, it’s probably all already out there, but is it really a good idea to put concentrate all that in one place, online, in the ether on someone else’s server?

Hmm, looks like somebody already has. But wait, this is great. Check out the bold restriction in their terms of use. Why oh why would anyone put private info on some company’s server when said company says up front not to put financial info there. Damn, I hope they have a good E&O policy!

I suppose SalesForce.com asks their customers to do it every day (after all, isn’t your company’s client list a bit like your ledger?) and nobody has much of a problem with it.

So maybe I am old fashioned.

Then I saw this (from the QuickenOnline.com website):

Build your whole financial picture for up to 5 years.
Most banks keep your online data for only 60 to 90 days. 
With Quicken Online, you build your whole financial picture 
from the day you start. We keep active customer's data for up to 5 years.

5 whole years! How generous! And I guess after five years, all that data would be useless to me?

Um. I don’t think so.

Guess I’ll stick to the tried and true for now.

Digitally Signing a Word 2007 Document

2
Posted by admin on October 2, 2007 – 12:54 am
Filed under Office, Security

I originally wrote about digital signatures in Office documents way back here, so check there for more information. But I just stumbled across something with Word 2007 and document signing (including signing templates) that had me scratching my head for a minute.

Word, in it’s shiny new 2007 skin, now has a nifty little feature to add a signature to a document (or template) right on the…um… what they hell you do call this button?

image

Anyway, under “Prepare”, you’ll see this:

image

The Add a Digital Signature lets you sign the document right there. Which is great.

Except for one thing.  That signature is not the same as this one:

image

The former actually signs the document, whereas the latter signs the VBA code contained in the document.

If you don’t believe me, sign a document using the Prepare menu item, then check the signature using the VBA/Tools/Digital Signature menu item. Then sigh and weep.

So, what does that matter, you ask?

Well, in terms of checking the validity of macro code in a document, from what I can tell so far, the signature on the document isn’t checked, only the signature on the VBA code. From a macro/VBA standpoint, signing the document is pretty useless.

I’m still hunting for a way to automate the signing of DOC and DOT files (such as the SIGNTOOL.EXE utility for signing DLL’s and EXE’s). That would make the whole process much more convenient, not to mention enabling it to be built into a normal build process.

Disabling the UAC for Administrators Only (or rather, Not Quite)

0
Posted by admin on July 10, 2007 – 2:55 am
Filed under Security, Vista

Ever since I disabled UAC on my Vista machine, I’d been hoping for a way to disable it only for specific users.

Then I just stumbled across a promising page for disabling the UAC prompting for administrators only.

It wasn’t the “Per User disabling of UAC” that I was hoping for, but I’d take it.

In a nutshell, run SECPOL.MSC from the Start, Run box

Expand Local Policies, and select Security Options.

Find the entry “User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode” in the list (it’s towards the end) and double-click on it.

Change the setting to “Elevate without prompting”.

Note that this won’t work with Vista Basic and Home, because those versions don’t come with the SECPOL.MSC file. Check out the blog above for a reg script for that.

So, then, I thought,  just setup an Admin user for doing standard development stuff (where the UAC is just a flat pain in the ass), then, login as a NON-ADMIN user with UAC enabled to test things out.

Well, not so fast. Turns out, even with the Automatic elevation setting on, elevation still doesn’t happen quite right in all cases. Take for instance, Winternal’s Process Explorer:

image

That Replace Task Manager option will cause a “Process Requires Elevation” prompt with UAC enabled, regardless of the “Elevate without prompting” setting mentioned above, so there’s more to this that what would appear to be mentioned in the help for that security option. Granted Process Explorer is pretty low level stuff, but it’s something I use all the time.

Screw that. Not worth bothering with, so off goes the UAC again.

Vista and the UAC , Or not

1
Posted by admin on July 6, 2007 – 8:01 pm
Filed under Security, Vista

Well, I finally succumbed.

After hours of working to get some scripts going that, with XP took all over about 10 minutes the first time around, I’ve given up.

I simply opened the Windows Users control panel applet and turned off UAC.

image

Lo and behold, everything works just like it did back in XP.

I know, I know. “Users won’t run with UAC turned off so how are you going to properly test your app?”

Well, how ’bout a VM with Vista in it and the UAC turned on?

Even better, my user account with UAC off, and a Test User account with minimal rights and UAC turned on. (But I haven’t yet figured out how or if  you can turn UAC on, on an account by account basis, Anyone have any ideas?)

I’m not happy about it, but I refuse to spend any more of my time clicking those damn “accept” boxes.

Not only that, but I’ve heard not just a few respected programmers in the community say things to the effect of “Vista is just too difficult to program under, I’m going back to XP.”

My question is, if running Vista without the UAC is basically like running XP, then, at least from a developer perspective, why not just run Vista without the UAC, then test on a VM with it? Does continuing on with XP bring anything to the table that Vista without UAC leaves out? From what I can tell, no.

Is it ideal? No. Is it better than XP? Well, the drivers and eye candy are nice, but otherwise, I don’t see much difference. Surely there’s additional security details that have been cooked in that have nothing to do with UAC, so I’ll get their benefits.

And when PowerToys for UAC (Ugh) comes out and I can munge the UAC as necessary to get everything I need working properly, I can turn it back on.

Vista and Intranet Application Security

5
Posted by admin on July 5, 2007 – 5:28 am
Filed under Security, Vista

On my setup, I have a file server with a RAID that generally is a bare (but SP’d and updated) Win2003 server install, ie a very minimal installation. At one point I set up ADS with a domain, DNS, etc. Nowadays, I still setup the DNS server on this box, but generally don’t make use of ADS, in my (albeit weak) attempt at simplification.

On my workstations, I install Win2000/XP/Vista in Workgroup mode and use identical passwords and user accounts on the server and each workstation. That way, legacy login support kicks in and login validations still apply, but I don’t have to mess with ADS and domains to make it happen. Not as secure as ADS, but not completely open either. 

One thing I tend to do, when possible, is install apps to a network drive and run them from there. I say when possible because for those apps that require COM registration, etc, this doesn’t work too well. But there are plenty of apps that work just fine this way, including Trillian, Keepass, InfoSelect, NotePad++, IrfanView, etc. Keeps me from having to reinstall and redo configuration.

With the latest install of Vista, however, I was getting a “Are you sure” dialog like this every time I went to run an app off a server share.

image

Now, before people start screaming “Good Lord, don’t turn that off, there’s no telling what might have replaced that app out on the network! How do you know it’s safe?!”, the fact is that my entire network runs behind a firewall, and all machines run NOD32. If something infected an app out on the server share, it’s just as likely to have already infected my local workstation anyway.

I’d rather not have to “accept” running any app off the server every time I want to, so what I needed was a way to tell Windows, “Hey, it’s OK to run files from these locations, I’m fairly certain they’re safe”.

Come to find out, such a setting exists, of all places, in the Internet Settings area of the Control Panel:

image

image 

Make sure the Local Intranet security is medium-low or lower. This is the default though, and doesn’t appear to need to be changed.

image 

image 

At this point, just enter the UNC of your server, say \\MyServer (you only need to enter the root server name, unless you specifically don’t trust certain shares on your server, in which case you could specify the server and share name, such as \\MyServer\MyTrustedShare.

image 

And that’s it.

If there are any significant security issues with this approach, I’m not seeing them. I have to trust my server as much as my workstations (if not more, since I rarely actually install any software on my server. Anybody care to enlighten me?