Financial Site Password Policies

One of the many things I’ve had to do as part of transitioning to my new job is move my retirement savings (401k) over to a new provider. In this case I’ve been moving over to the Fidelity site. The security of financial web sites never fails to disappoint.

No I didn’t try some crazy SQL injection, CSS, or XSRF attack on the site (that would be illegal!). I just read their password policy:

  • Use 6 to 12 letters and/or numbers
  • Do not use one entire piece of personally identifiable information such as your Social Security number, telephone number, or date of birth. Instead, alter or disguise it (e.g., Jane212Smith)
  • Do not use more than 5 instances of a single number or letter, or easily recognized sequences (e.g., 12345 or 11111)
  • Do not use symbols, punctuation marks, or spaces (e.g., #,@, /, *, -.)

::Sigh:: 12 character max and only letters and numbers? Come on seriously? According to Microsoft [1] 14 characters is the recommended minimum for a password. But length isn’t the only factor. By excluding all special characters they effectively cut the character space in half.

Let’s think about this technically for a second though. Why would they need to place these restrictions on their customers security? Let’s assume the password is just another field in the Fidelity database because that’s exactly what it is. Typically there are two reasons to limit field length and content in a database:

  • efficiency: variable string length fields are very expensive
  • special characters can be a bit dangerous in that a scripting language or the SQL engine fronting the database might interpret the characters as commands

If however, Fidelity follows best practices for storing passwords in their database neither of these concerns apply because YOU SHOULD NEVER STORE THE PASSWORD DIRECTLY IN THE DATABASE! A hash of the password is what should be stored and the process of hashing addresses both of these concerns because it:

  • normalizes the password length
  • sanitizes any special characters

This last point can also be mitigated by using the proper and safe SQL commands available in any modern database engine.

So what these restrictions make me think is that the Fidelity site may actually be storing my password in plain text. That, or they’re just placing restrictions on my password strength arbitrarily which makes little sense.

Unfortunately this Fidelity site isn’t the worst offender that I’ve seen, and I don’t even analyze website security for a living. My experiences are limited only to the sites I’ve had to use over the years. Some time back around 2005 I had an account with a bank once that didn’t even let me change my password for their website if I wanted to. They set my password for their website when I established my pin for my ATM card! That’s right, my password for their website was a four digit number. I wrote them a letter pointing out the weakness in their password policy and I got back a form letter basically telling me to go away … so I did, and I took my money (totaling a whopping $2500) with me.

These are the people we trust with our life savings … Most of the web forums I have an account on fixed these problems back around 2007. Fixing something like this isn’t rocket science, just best practice.

UPDATE
After dialing into the phone system for Fidelity it became apparent that special characters are prohibited in passwords because their phone system authenticates users against the same database. It’s convenient, but touch-tone key pads just haven’t kept pace with keyboards 🙂 This also means that their passwords are probably case-insensitive too which nearly cuts the character space in half yet again. ::sigh:: balancing backward compatibility against security is an age old problem. You can look to Microsoft for a few of the biggest examples: the bazillion Windows users still surfing on IE6, the upcoming EOL for Windows XP etc. The Fidelity password strength issue isn’t anywhere near the scale of these examples but the principle holds.

[1]: http://www.microsoft.com/security/online-privacy/passwords-create.aspx

oil companies love mondays

It’s been a million years since my last post. Standard excuses apply: day job has taken over my life. I am working on a technical post so expect that in the next few days. In the mean time, here’s an image that has come to define this crappy week:

Only an oil company can make a Monday worse that it usually is. $50 for a tank of gas? Jerks. The only thing worse than having to put on a work-appropriate shirt (I hate work-appropriate shirts!) and drive half way across the state to get to work is having to pay through the nose for the privilege.

Enough I say!

Great Jargon LOL

Something I do in my day job a lot is read. I read tons of documents from peer reviewed publications, a bit less from periodicals like IEEE S&P, ACM Communications etc, and finally I get sucked into reading some vendor white papers / marketing crap. The density and value of the information in these documents decreases in the order that I’ve listed them while the amount of useless jargon increases.

I write a tech-report or a proposal every once in a while myself and I’ve found that the things I read have a significant impact on how I write. Similarly I’ll get asked to “provide comments” on a document prepared by someone else from time to time. This may sound strange but in reading something written by one of my peers I get a glimpse of what they’ve been reading too,

This past week I was asked to give someone feedback on a paper that’s still in draft form. I had very few issues with this paper technically. It had some pretty crazy punctuation and there were gramatical errors but it’s just a draft so I made note of them in my comments.

Now I’m no Shakespeare. I’ve made the same mistakes that I was commenting on for this document and that’s why we ask other people to read these things before we send them out into the community … But there are some things that I cannot excuse.

Toward the end of the document the author was noticeably fatigued and he started using jargon. I was about to make a note of how this jargon was meaningless and that the sentence could stand on its own without said jargon when I started to feel bad. Was I being too harsh? Was I just tired and sick of reviewing this document on a Friday at 5:30 when all I really wanted to be on my way home? So I threw the jargonic phrase in question into Google to see if the internets thought this was jargon as well. The first hit from this search had me laughing for a good minute. Follow the link, it speaks for itself.

So I concluded this was jargon after all 🙂 I don’t want this post to be interpreted as some commentary on writing style or our use of the English language in professional writing. I don’t have anything new to add there. If you care about effective communication read Orwell. If you’ve read this blog before (hell if you’re reading this post) you likely know that my writing can be as crappy as the next guys … just do me a favor and stay away from the jargon. It’s what separates us engineers from the marketing department.

Nokia E7 Pre-Order Page Crashes N97 Browser

I had hoped to hold out on buying another cellphone until Nokia got their shit together and released the first Meego phone. With the latest news out of Nokia being a Microsoft partnership and the projected release of the N950 being “later in 2011” it’s become painfully obvious that my N97 just won’t make it.

I signed up on the Nokia website to get email notification when the C7 was available for preorder I finally got that email today. I was sitting in my mechanics waiting room when I got the email so followed the link in the email on my N97 and after loading up 828K of the web page … the browser stopped responding. Actually the whole phone stopped responding for almost a minute. Eventually the browser just crashed and the phone recovered.

This pretty much sums up my experience as an N97 user: irony around every corner with Nokia looking like they’re really trying hard to screw things up: your company website shouldn’t crash the phones you make!

Despite my complaints about the N97 it was a huge improvement over my Samsung BlackJack II that (sometimes) ran Windows Mobile 6. Hopefully when I shell out the small fortune for the C7 it’ll be even better.

Barnes and Noble Customer Disservice

Even though I’ve got an ebook reader I’m still on the look-out for a new one since the technology is moving so fast and new features seem to hit the market regularly. There’s no way I’m buying a Kindle because they don’t support the ePub format and that’s what the local library is using. I ran into a friend at the bar the other day and she started showing off her Nook. She couldn’t say enough good things about it so I thought I’d go down to the local Barnes & Noble to see if the sales person could convince me to shell out $150 for one.

Requirements

The criteria I’m using in my eBook reader search are pretty simple:

  1. Lots of ebook format support. Specifically PDF, ePub and plain text (txt) are necessities.
  2. Display that isn’t back-lit. ePaper gets extra points but isn’t a requirement.
  3. MUST render some obscure PDF formats well. Specifically articles from scientific journals / conferences (like ACM and IEEE) are a must.

That’s a pretty short list. I don’t care if it’s got a 3G connection (frankly I’d rather it not). WiFi and a web browser would be nice but since these devices aren’t very powerful yet I’d rather it not have a browser than have a crappy one. The requirement that’s really hard to meet is that last item on the list. For the interested reader a good example of such a document would a paper by Bryan Parno, Jonathan M. McCune, and Adrian Perrig titled “Bootstrapping Trust in Commodity Computers.” This was published by IEEE and is supplied in their required format.

I read tons of papers like this so having a reader that renders them well is essential. So I took a trip down to the Barnes & Noble on Erie blvd in Syracuse to see if I could get the sales person to let me try a Nook out and load up a paper in this format. Everyone reading this probably knows how badly was destined to turn out and so did I. But hell, I’m not going to shell out that kind of money without knowing whether or not it can render the documents I read daily.

The Shopping Experience

So I walk into B&N and walk up to the Nook display. There’s a bunch of floor models, both the black and white model and the color one. Since the color model is back-lit I took to the black and white one. The interface was very easy to figure out and in a minute or two I was searching the web for an IEEE formatted publication to download.

First big strike against the Nook was a web browser that can surf web pages but can’t download PDFs. WTF?!? Why would you put WiFi on a device if it can’t download content from the web? If it can download books from the B&N online store why can’t the browser download a PDF (other than for the reason of cutting into B&N’s bottom line)?

Ok I wasted 10 minutes playing with the browser to no end but at least I found this glaring shortcoming in the Nook. Not a deal breaker though so I got in line to talk to the one guy servicing customers at the Nook display. He was pretty frazzled because there were no less than 8 people waiting for him to help them. As we were standing around I learned that only myself and one other person were there to buy a Nook. A number of them had updated the firmware on the device and now couldn’t open books they’d previously purchased or had devices that were bricked outright.

After kicking around for a half hour the sales guy got some backup and there were 3 people working the line. Eventually I got to the guy behind the counter and described what I had tried on the display model. Obviously he knew that I wouldn’t be able to download the PDF directly and he instructed me to “side load” the document onto my Nook instead. It took me a few minutes to explain that I didn’t own a Nook YET but that I wanted to buy one after seeing how it rendered this specific PDF. “The books we sell on-line are PDFs so it renders them fine” he tells me but I’m insistent that I want to see it render an ACM or IEEE formated publication because they’re a two column format with graphics integrated. He got a very skeptical look on his face like I was trying to trick him or something. This is a bad sign.

After a few moments of contemplation he proclaimed “I can’t help you”. I’m pretty sure the look on my face at this point was one of shock. He was standing next to a computer but he couldn’t load up a PDF for me to see it on the device. “Wait a minute” I say, “the ability to load PDFs on to the Nook is an advertised feature but you can’t show it doing this?”. I may have been pushing it but this seems like a reasonable request to me especially since I’m considering buying one of these things. His response seemed to me like a car salesmen showing someone a car, starting it up but refusing to let the prospective buyer drive it.

I’m not quite giving up at this point but I can see where this is going. In a last ditch effort I point out the close proximity of the computer and the Nook (which he was holding at this point). All of the necessary parts are there if only he’d hook them up! He wasn’t budging though. Finally I ask if he really can’t help me or if he just won’t help me … and that marked the end of our conversation. Yeah I got testy with that last line but seriously, I’m not asking for anything too far out of the box am I?

Conclusion

Needless to say I didn’t buy a Nook even though I really wanted to. The Nook may actually render these documents perfectly but I wouldn’t know. As someone who’s pretty tech-savvy I’m having to face the reality that the questions I ask seem completely unreasonable to most sales people. Well thanks to Barnes & Noble and their unhelpful sales staff I’m getting the hint: buy your stuff on line after doing the research yourself.

I guess in the case of B&N this isn’t surprising since their staff generally is accustomed to shelving books and helping people find the books that they just put on the shelf. They’re pretty much librarians … next time I’ll ask the kid working at the Starbucks they have in the B&N for help.

Update
I floated the same question to the Barnes & Noble Nook forum. The users there are much better than the B&N sales staff and in about 20 minutes I had a responder that was willing to download the USENIX sample paper and report back on how his Nook rendered it.

Sadly enough the paper crashed his Nook. Luckily he didn’t report any permanent damage. My Aluratek Libre gets confused by the two column format but only when there are graphics on the page that are full page width mixed in with the two column text. It doesn’t crash though it just scales the full page to fit the screen. The text is so small that it’s pretty much illegible though. Oh well, I guess I’m waiting for the next generation of ebook readers.

QNAP 419P Torrent Client

About 6 months ago I purchased a QNAP 419P NAS. I did a bunch of shopping around and settled on this one largely because it’s Linux based, runs on a low powered ARM cpu, and it’s got a pretty active community. After 6 months of operation I can’t say I’m thrilled, but it hasn’t been a complete disaster either.

I bought it to replace an older P4 system I had Frankensteined into a file server. It had an old ATA133 3ware raid card with ~900GB in raid 5. I had it running rtorrent on the console and serving up files using NFS. Pretty basic and it served my purposes just fine. I started running out of disk space so I picked up the QNAP 419P.

The 419P is a departure from my normal setup since everything is done through a web UI. I also mount my files using CIFS so my room mate can mount a drive too. The 419P will allow you to mount CIFS and NFS but the permissions get all borked up and since Linux support for CIFS is pretty good these days (and Windows support for NFS sucks) I made the switch.

Now on to the reason I’m writing all of this down: the torrent client that QNAP packages for the 419P is terrible. It’s custom so in their defense it’s a lot of software to maintain. That said I’ve got no idea why they’re trying to roll their own. There are so many web front ends to rtorrent++ that there’s no excuse to be building your own half-baked web front end.

Now bad UI I can handle but recently the trackers I used have started white listing clients. Naturally the identification string offered up by the QNAP torrent client isn’t on the list. So what to do? Well this is where the QNAP community comes in: package rtorrent++ and a few web front-ends. This is all described in their forums [1] and the person who did the heavy lifiting here is definitely getting a few paypal bucks from me as a thank you.

So I’ve got rtorrent and the front ends running on my 419P but why am I still annoyed? Well for one thing there’s no authentication for it. QNAP spent some time building their auth system and it’s not half bad but from the looks of it there isn’t a way for application developers / packagers to tie into it. So as it is now the web UI for rtorrent is wide open. Even on my home network I like to have at least a login / password.

There may be a way to tie into the QNAP auth infrastructure, or even a way to require some auth for the rtorrent front end (I’m thinking some sort of apache mod_auth foo to get at the URI). In the mountains of spare time I’ve got I’ll take a quick look (thick with sarcasm). For now I’m just happy to be downloading again thanks to the QNAP community.

[1] : http://forum.qnap.com/viewtopic.php?f=146&t=25165

Verizon customer support is crap

RANT ALERT!

I’m writing this post as I’m waiting in a Verizon tech support phone queue. I’ve now waited through 4 different queues and spent 20 minutes convincing the first level tech that the reverse DNS PTR record I need in their DNS servers has nothing to do with DHCP. I’ve been on hold for about 2 hours now and if that wasn’t enough to drive me crazy, this stupid muzak is will.

As much as I want to I won’t use this space to tear on the Verizon techs for being stupid. In fact some of them are actually quite knowledgeable and I understand the need to have varying levels of technical expertise in such a large organization. What I will fill this space with is a testimate to the fact that Verizon specifically has their “customer service” infrastructure set up to deter people from asking for, or getting help. They’re content to spin you through an endless cycle of phone queues until you give up and go away.

How it all got started

I don’t send a whole lot of mail from my domain, just my personal stuff, but a month or so back I started to notice that email I’m sending to Gmail users was ending up in their spam folders. No one goes through their spam folders so in the end my friends weren’t getting my emails. A little digging shows that this is likely caused by my lack of and SPF text record in DNS.

That’s easy enough to populate myself through the GoDaddy servers, but for SPF to work correctly it requires reverse DNS to resolve the name of a host that’s authorized to send email fro your domain. Unfortunately this isn’t something I can set up myself since Verizon owns the IP of my mail server and controls the reverse DNS record (PTR).

So how do I get this record populated? I call Verizon tech support. They then tell me that I have to make the request in writing (email) which I did 2 days ago. Well today I get a very nondescript email which I’ll produce here in its entirety:

Hello,

I apologize, but Verizon is unable to process DNS requests at this time.

If you have any further questions regarding this particular issue, please
respond to this email leaving the ticket number in the subject line.

Thank you for using Verizon Business,

Erik Correll
Verizon Business
866-492-1074 option 2

This Means War

Thanks Erik, that’s about the most unhelpful response you could give me. So what you’re saying is: Computer Says No. Next time just tell me the truth which would read something like this: “I’m busy, go away for a while and try back later”. The odds of me responding to this email and waiting another 2 days is 0. I got on the phone this time determined to wait in as many phone queues as I have to till this is resolved.

Funny thing is the first knowledgable person I talk to (1 hour of waiting) told me I had to make the request over email. Nuts to that I already did. I send him off to get me to the right department and it turns out he has the wrong phone number.

Verizon plays this cute little trick where they change the phone numbers of their departments on a continual basis. This is to prevent people from saving the numbers of specific departments and calling there directly. It’s also intended from keeping awesome sites like DSLReports from publishing these numbers accurately. What a bunch of jerks right?

DSL Reports has a FAQ page specifically dedicated to getting reverse DNS records populated through Verizon and guess what, the phone number they publish is wrong now. It was accurate when the published the FAQ but Verizon changed it to keep people from calling that department directly.

This guy was actually very helpful and eventually he gets me through to the DNS guys. Again they tell me I have to make my request in writing. Yeah I already did that. Another half hour of waiting and this guy comes back on the line and tell me that they have a 30 day freeze on all DNS changes and he didn’t know about this till I asked! That’s the biggest WTF I’ve ever heard. He’s in their DNS department and he didn’t know about this freeze till I asked. Right well I’m getting my damn reverse DNS PTR if it kills me, or it costs me all of the minutes I have left on my cell plan for the month. That’s right this is actually costing me money.

So yeah this isn’t even resolved yet. I’m still on hold after 4 hours of waiting for Verizon to figure out what their DNS policy currently is. So yeah, fiber to the home in the US is crap. It’s owned by the biggest most disfunctional monopoly on the face of the earth. I pay a small fortune for fast fiber and a static IP and I get crap for service.

Verizon has pretty much done everything they can to deter me: a blanked freeze on DNS service to their business customers (me) with no explanation and 4 hours of running me around on the phone. I will get this set up if it’s the last thing I do and I’m so bored waiting on the phone that I’m using this time to rant. It feels good but ultimately it doesn’t do any good. The only thing that will fix this is breaking up these huge telco monopolies so that there’s competition in this market. The only way we (customers) can get the attention of Verizon is if we take our money elsewhere by switching to a different provider. Right now, for high speed fiber to the home we can’t do this.

Alright this rant isn’t helping my blood pressure. I’m almost on to hour 5 of this stupid phone music and I’m ready to explode.

UPDATE: 2010-05-20
Just to finish the story: I never got this issue resolved over the phone. At just about the hour 5 mark my call got dropped by the Verizon help center. It just clicked a few times and then the line went dead. I fell back to sending emails with stronger language (i.e. “this is completely unacceptable” blah blah blah) and after a few more days they finally populated DNS with my PTR entry. I never got an explanation as to why they refused in the first place since this is a service they’re supposed to provide to business customers.

Lesson learned: don’t waste your time trying to get through to Verizon tech support on the phone, just send them a hand full of increasingly angry emails.