Disparate identities? No thanks.

We all are used (or at least adapted) to keep and reenter a multitude of passwords.

They follow us everywhere - at work, when home, even when we're calling the bank on the go.

Security is a complex concept. Sometimes things that feel "intuitively right" are not in the best interest of securing your access.
Quite often, we are secured FROM accessing the services we so desire...then we resort to the oldest and least secure SMTP protocol that is long overdue for Rev.3 or Rev.4.

Many have adapted the use of "password manager" tools / addons.

Let's consider if there is a better alternative to existing solutions.

In few example cases, I will show how "feel-good" solutions, that are often "specifically designed" to improve your security, will actually decrease security of your access or even open ill-considered backdoors into your systems.

Case 1. ID Federation vs Multiple ID

Imagine controlling several separate security domains.
This happens most often at work, where you use one ID to logon to your PC, then another one to connect to your (Development Environemt/Model Environment/External VPN/Internal Applications etc).

You may have another username (a).
You may have to use slightly different usernames (b).
Sometimes you use exactly same username (c).

What IS important is you do not care to use different passwords in each domain. You would go crazy if you did, especially in case (c).
"Domain Name" is often not considered by the Application developers, and users are not always aware to which domain they are logging into.
Sometimes domain name is not even shown, especially in cases where applications are not designed for, and hence would not allow cross-domain logins.
What IS ALSO important is that there is no easy way to make sure users use different passwords in every domain.
Your SAP solution would not check Active Directory and make sure you use a different password.
Where are we ending with this non-SSO enviroment?

Users like to use same passwords everywhere.
It is enough to hack one enviroment and then reuse same password in other environments.
The thinking that non-SSO environment would "protect" against a password compromise is not often substantiated in practice; it is "false intiution".

How easy it is to protect against potential compromise?
We'd have to make users change passwords in every domain.
They may not even remember all passwords, when some were left behind and unused!
When disaster strikes, many doors will be open even though the storm is already gone.
When people leave the company, several non-integrated systems may still contain active credentials.
This is especially bad for VPN or other internet-exposed systems that are not AD-integrated.

What's the best architecture for multiple domains controlled by same people?
Use full SSO, one login connects users to all services at work.
Through IT Policies, make sure that every app deployed supports a form of integration with your most important credential data, Active Directory.
Prefer Kerberos integration over LDAP. LDAP would not support multi-domain environment easily.
Let application developers, modelling and vendors build a one-way external trusts towards your single forest root domain.
This is often safer, and is always cheaper that external "integrations".

Additional advice - use AD as your master DB. If you use external ID providers (Oracle, IBM) then those must have admin service accounts into your Production AD. This is bad...
External vendors (or their subbies) may be able to reset passwords of your CxO and read their email / access documents. Again, those service passwords most likely will be moved around the world over unsecured SMTP emails, often on "Cloud" providers and multiple governments looking over the shoulder.
Instead: Let your forest root domain controllers keep all IDs safe and ready to be reused in your forest child domains. Let DC talk to DC to automatically reset computer account passwords at predetermined intervals. No humans mucking around.

Case 2. Policing the passwords.
In password credential management, there's a number of parameters that often make even "experienced" people make stupid mistakes.
Every time, the whole password lifecycle process must be considered in an end-to-end manner.

The basic password policy parameters include:
- minimum password length
- maximum password age
- minimum password age
- password history
- password complexity checks
- password change warning period

Many of those parameters require consideration of how your passwords are: set initially; distributed to users; reset by users; reset by service personnel; aged and requested change; accounts disabled etc.
Let's take a quick example of CONTOSO company.
They have set password history to 24, and password minimum age to 1 day.
When passwords are reset by the helpdesk personnel, they are dictated over the phone to users calling in for a password reset.

Issues? Oh yes!
Firstly, when dictated over the phone, several users in the call centres (sometimes abroad) get to hear them out, spelled clearly and nicely.
Secondly, the two parameters they set, were designed to prevent the same specific unsecure situation - users recycling same passwords indefinitely.
But because these parameters designed to reach the goal via different means, only one or the other of them should have been used.
Using both, while seeming to "improve security", simply by tweaking all the knobs we see there, in fact cause a very insecure situation.
Password History is a barrier for users to always select a new password when changing it. The depth of password history log defines how many passwords user have to invent, before reusing the old and loved one.
Set it to 1 and users only have to change it twice - first time to invent a new password (the current one goes into the history log) and then back to the second password. Two passwords can be recycled indefinitely.
Set it to 12 however, and I doubt the users will go through the pain of changing passwords 13 times (inventing new ones) in order to reuse their favourite mot-de-passe.

In case of CONTOSO, however, the minimum password age was set to 1. This parameter was designed for cases with no password history.
Users would have to WAIT AND USE the new password they just set or got assigned BEFORE they could ever change it again.
This means that all newly assigned passwords, that were probably overheard on both sides of the phone calls, cannot be changed immediately by the user.
It also means that if someone overlooked your password as you were changing it, you'd not be able to change it once more when that person leaves the room.
They would have to use the passwords as assigned at least for one day. Compromised new passwords stay compromised for at least 24h. Not good...

What this means in practice is that passwords reset by the service desk are never changed by the users. Not on the next day.
Never - until the next expiration cycle.
There is no way to force users doing that.
The only way out is to change the policy and set minimum age to 0 and check "Must change password at next logon".
The password history will take care of "inventive" users trying to revert back to old and loved passwords.
As of now, users tend to stick with very simple and possibly compromised passwords well beyond the first day.

As for the password expiration period, it should not be left at default 14 days. In 14 days, many users are reluctant to change passwords so far ahead of time.
At the same time, 3 days is a bit too short - users may be compelled to change it on Friday and they won't remember the password Monday.
Five days seems the best choice. Users who receive the warning on Monday will have full week to think about doing it. They'd know they need to do it "this week".
It the pesky dialog pops up Friday for the first time, 5 days is good time to postpone it "till next week".

Password complexity? Of course.
If you serious about complexity, you should write your own PASSFILT.DLL.
Include dictionary lookups, as well as proper non-generic error messages towards users, so they know why the new password they tried to choose was a poor choice.


Case 3. External domains
Consider your "work" environment is fine-tuned and well-considered, time-tested and pen-analyzed.
How can you be sure your users are not using same password on their Facebook?

Well, this is where our discussion will lead us to the next gen of ID management, the frontiers of developments ongoing in various bodies and corporations.

Remember Microsoft CardSpace?
This was Microsoft's first attempt at "embracing and extending" credential management on the websites, "out there".
By design, web developers would have to include CardSpace support in their websites.
Then, once users connected to the website, it would send a signal to Internet Explorer to indicated that it accepts CardSpace.
Come on, fire up your XP machine and check in Control Panel.
It was basically same as Windows Credentials Manager (still present in Windows 7 and 8) - only for websites.
You could fill up, save and one-click-reuse so called "cards", one per site. Each card could contain your names, email, as well as "salted association ID" that would be used in place of password on the particular site that generated and saved the card.

Now consider the SmartCard standards.
Many computers still have the readers. But it has been a long time since I saw someone use a smartcard. OK CBA folks I know you do :)

The real reason why smartcards aren't popular is because the current standard sucks.
It does - because it hosts only one certificate. It seems designed only for "work use".
One certificate, same thumbprint - very easy to track the user.
This is definitely not a good architecture - for privacy reasons.
There's also no controls designed around what sites can access which certificates.

A better architecture would see the SmartCard standard extended and merged with some concepts of the Microsoft CardSpace component.

1. From a hardware perspective, each SmartCard would need to be able to keep up to 1024 user certificates (or other credentials), one in each separate isolated cell.
2. Each cell would be signed by a special website certificate, and verified via full DNS name. Other sites would not be able to send requests for that particular card.
3. One per-card PIN would unlock all cells, but each individual user card request would be screened by OS UI and approved/denied by the user.
4. OS would support new card creation by suggesting values from the user profile (name, nickname, email etc) but the user would have the right to override all values to establish a new account with a new service.
5. Some government sites would only accept "verified" cards that were issued by specific government sites/bodies.
6. Cards would not be "locked" to specific countries, they would be open for any new web services globally.
7. It would be possible to combine multiple "government verified IDs" on one card.
8. During new account creation, a uniquely-generated credentials would be stored on the card, only accessible by the site that generated it.
9. Some websites would offer to reuse government IDs, while allowing to create a new "local" account to anyone.
10. Optionally, a plain-text password can be displayed on the screen, to be taken by the user and used on computers without the new smart card readers.

With inception of such universal standard, all woes about passwords would be solved and the internet would become a more secure space.

It is time to move away from insecurities of keyboard keystrokes into the area of specialized chips and certificates controlled by the openly reviewed and secured hardware/OS standard.

Instead of building ID around Facebook, it's time to ask for universal standards for the new generation.

Ask your local Member of Parliament to support this.

Share and repost in social media!

Help to propel the cause to get rid of password headache and insecurities.

Chime in the comments as well - do you develop something like this?
Can you help developing this?

Microsoft and Vendors

PC hardware vendors should only hate Microsoft for removing "Computer" icon from Desktop by default in Windows 7.
"Less-hardware-minded users aren't keen to upgrade often..."
NB. The Recycle Bin is holding on.

Built-in tracking protection in IE10+

A simple trick to help you thwart attempts to track you on the web.

It's a little-known built-in feature that applies to Internet Explorer 10 and later users; yes, you should update any prior versions you may still have, even if you do not use IE - many system components are using its frames.

While in Internet Explorer, press Alt-X or click the Tools button on the toolbar (most right), select "Manage Add-Ons".

Click "Tracking Protection" on the left - you will see a pre-defined "Your Personalized List" on the right.

Click the list and then click "Enable" button below.

Click "Settings" button below and select "Automatically Block" on the dialog that opens.

"OK", "Close"

Now what happens is IE will detect tracking frames on all websites that you visit.
If there are more than 10 occurences (different sites) having embedded the same tracking scripts, it will be considered a tracking network and will be blocked from placing an identifying cookies on you.

Hopefully this helps stopping the trackers "profiling" you, i.e. gathering info on types of sites you visit, and placing you into certain categories.

Possible uses of tracking involve targeted advertisement, market research for correlated traffic, audience statistics etc.

Not bad for an un-advertised feature that is given for free to all.

WhoIs Microsoft

I have just downloaded WHOIS for Windows from Microsoft.
I have no idea why I have not done this before.
Microsoft were right when they bought SysInternals.

Error Codes

"Hey Computer! Why don't YOU run that command?!?"

To XenApp or not to XenApp?

There are few tips about Citrix XenApp (ex. Presentation Server, ex. WinFrame) that I would like to share.
Many people, even being involved in technical architecture decisions, are not completely aware of possibilities, dangers and ramifications of this product. They fall to "typical config" patterns that are outdated and do not deliver the best of XenApp.

1. Only publish publishable.

Sometimes XenApp is used as a Remote Access Solution. In this mode, they try to use XenApp as a sort of "gateway" into other internal systems. Well here's the gotcha - if you cannot install and publish a client on XenApp's farm, do not use XenApp. I have seen deplyoments where XenApp was used only to log the incoming user and start a Firefox on the farm. Well, that Firefox could be retargeted to any other internal system, or local file. Plus it could have been used to go online and grab your exploits or code or files from your online accounts. Publishing "open" things is not good. Always try and publish only the final destination apps. If this cannot be accomplished, you're doing something wrong.

2. Browser is not needed.

A typical XenApp installation will include a Web Interface. Now, do you need it at all?
Consider this - starting up a browser, typing and selecting one of bookmarks to navigate to your various Web Interfaces is a drag. Why is it still being used? Only for flexibility of user access, so you could try and access your site from any external of uncontrolled system. Now, what if you have internal, corporate systems that are only accessible to internal clients?
For corporate apps, you should be using Citrix Receiver deployed on client machines, and Citrix Service Site instead of Web Interface. This will improve user experience. Modern Receivers allow users to drag needed icons straight into their Start Menu. One won't need to muck around in a browser to be able to start a pubilshed app. And there's no annoying "bye byes" from Web Interface where you have to re-login due to session expiration.

3. Check your security requirements.

Some still think that Citrix XenApp is a sort of security tool. It is not.
Consider this - you may have 55 users sitting on the same host simultaneously, each user's outgoing sessions have the same source IP. If you have 5 different systems, that source IP has to have route and ACL permissions to go to any system. This means that on network level all 55 users have access to all 5 systems (even though they need not). See why I raised a point 1?
Now to logging. One of your users has managed to run a full internal network scan, discovered some vulnerabilities (sometimes by looking at internal web source code from the published Firefox) and successfully exploited some loopholes, causing service disruption or credetnial leakage). You discovered the issue few hours later, when the farm had [another] 15 users on it. How do you go about tracking suspicious activity to a personal account? In your network logs, it's same IP for all users. On the XenApp host, you have no logs telling you what user had which TCP sockets open at a given moment.
Compare this to VPN now, where everyone has unique IP addresses, hence network permissions and route tables.
One might say - well what about SmartAuditor, a software that can record all user's session as MP4 videos?
OK, so that guy spent 4 hours on legitimate work, then issued a stray command that crashed your system, then kept working for another 3 hours - how are you going to catch it? Watch all 7 hours of his (and other users') videos and following closely everything they were doing? Hardly productive, and certainly not indexable.


4. Secure Gateware deployment.

There are guides on Citrix Secure Gateway deployment. Please be sure to carefully consider what is more important to you. The two main features of CSG are PRE-AUTHENTICATION and WEB-SECURITY.
Pre-authentication means that before your user gets access to your Web Interface, it is authenticated by the CSG.
Web Security mean you're not exposing IIS to externals. CSG offers it's own, sanititzed and locked down environment.
Do not neglect these two, or you will be neglecting the CSG's value. For these reasons, CSG should be deployed in its own box, which is hardened. Do not install Web Interface or other components on the same bax, this will negate the CSG's value or protecting those components.

5. VPN is still a viable alternative.

As already mentioned before, sometimes VPN is a more traceable, transparent solution. You can regulates access on the network level. Different groups can have different ACLs in the network, because they could receive IP from different subnets, or they may receive different routing tables (less secure).
Many negative things about VPN come from the past era of IPsec/L2TP which had it's share of compatibility issues.
Welcome to the age of SSL VPNs. One does not need to go far - Windows 7 (or Vista) support SSL VPN out of box.
If you're a bigger shop, do check out DirectAccess feature in Windows 7/Windows Server 2008R2.

6. Microsoft RDS may fit your bill.

Microsoft has improved and revamped it's Terminal Services to become Remote Desktop Services (RDS).
The new service can give you most of what Citrix XenApp allows, at much more affordable price.
Consider performance, too - XenApp 6.0 is much slower at opening sessions than MS RDS.
Most of XenApp's value - Advanced Load Evaluators, Offline Published Programs etc are rarely used by SMB or even big Enterprises. Being another software, XenApp certainly takes some extra effort in both integration as well as in daily use. Microsoft's offering is certainly better integrated and starts up faster. It also does not require separate skills.
So check your requirements.

7. Some apps are born to be wild.

With Web 2.0 era, more and more applications are moving to the browser (contrary to what I said in point 2 - but that was about way of accessing XenApp). This means that apps are thin enough to be run on any client, and the protocol in between the client and the server is resilient to low-speed or low-quality lines. Lines are getting better every day, so you may need to consider not having any extra "gateways" or VPNs in between the client and the server.
They are all about legacy or insecure software anyway...

Office 365 arrived

I have watched Microsoft's Office 365 introduction for IT Professionals.

It was interesting until they revealed you still need to install 800M distro onto every computer where you intend to have access to your "online" documents. And keep that patched. Oh yes, and no Mac/Linux version.

Next.

(The only advantage is low entry fee, which may be interesting for small businesses. But then you will have Office-format documents, and as you grow to medium-size, it won't be easy to migrate away from that format, just ask others. That's when the paying spree begins.)

UH-OH, and don't forget the Patriot Act!

Internet Explorer 9 loves Binging

I have installed IE9 and I can't find an easy way to stop it from sending my Address Bar typos to Bing. It's simply not in Internet Options.

Adobe Updaters

Dear Microsoft,

Will you please buy Adobe, too?
We are sick and tired of their separate updaters already.

Yours,
PC Users.
------------------
Dear Adobe,

I don't believe you need to place Adobe Reader's shortcut on my desktop every time.
If you run a survey you'll probably discover that people just double-click PDFs, not go the way of "Show Desktop, Run Reader, Find Documents to read".

Yours,
Sergey Zak

Nokia partners with Microsoft, adopts Windows 7 Phone

In a much speculated and quite expected move, Nokia is finally moving past Symbian.

Today, an open letter from Steven Elop and Steve Ballmer, both companies declared partnership and vowed to bring "stellar hardware, innovating software and great services" to mobile phone customers.

As I wrote in November, this will be a perfect match between Nokia's hardware capabilities and capacity, and Microsoft's innovative mobile OS and tight integration to most popular desktop environment, Microsoft Windows.

With hardware giant like Nokia in their allies, Microsoft is sure to make a major dent in mobile marketplace. Mobile users will win from improved innovation rate, better compatibility and increased usability, and simpler integration between mobile devices and desktops.

Nokia Ovi suite could be reformed and re-incorporated to bring value to all Windows 7 Phone customers. That would be an important step to increase it's market adoption rate and usefulness.

Vendor-specific social platforms are doomed, that's why Ovi must go beyond Nokia to really succeed and compete with the best.

The deal will invigorate mobile market even more, adding to the battle between Google's Android and Apple's iPhone ecosystems.

It's a great day today for both companies, and I am looking forward to help them improve their act.
I used to be a Symbian fan, but it's been long time to move on.
Nokia hardware was quite competitive, but sad truth is that Nokia simply could not make first-class software for few recent years.
When that is changed and outsourced to a partner as great as Microsoft, everybody wins!

Patriot Act for all

There's no Outlook Express in Windows 7 anymore.
Say goodbye to your encrypted emails to Assange, people.

Windows Phone 7 in, Symbian ^ out?

Tectonic changes are happening, friends. Very big, long-awaited stuff. Dinosaur mating.

Not long after ousting Olli-Pekka Kallasvuo, the Nokia CEO, Nokia hires ex-Microsoftie for that role.

On November 8, Windows Phone 7 is out.
The very same day, Symbian Foundation is "suddenly" shrinks.

It's a very tough time for Nokia.
This year certainly wasn't their strongest.

And the next year will be even worse.
Unless they switch the tired horse.

And looking at the jockey, I guess I know where to bet.

Why I killed iTunes

I have been using iTunes since 2001 (version 1.0) on a Mac, and since it came out - on a PC, too.
I killed iTunes on my PC and here's why.

First of all, I do not posess Apple's "closed source" systems like iPod or iPhone.
This effectively frees me from the need of iTunes - because I do not have to sync those. Nevertheless, iTunes seemed to be the best music jukebox system out there, on any platform. But 7 years have passed, and things have changed...read on.

Secondly, there's no iTunes Music Store operating in Russia (of course, this being a major reason to my first point. A big pity, I must say, I was longing for a way to get those free Album Art covers for all my CD-ripped goodness...
GimmeSomeTune stopped finding the right stuff, for some reason.

Next on, the built-in Visualizer has changed for the worse. It tends to circle a little bit too much on a very limited subset of visual configs, showing just few tired schemes.
My reliable sources said Steve Jobs mada some orders and it influenced the "randomness" of the config preset selection. Too bad, I still remember how beatiful it was in version 2!..
Version 7 showed some improvement in that part, though, but never again was it soo good...

The User Interface has changed in v6 from very simple and elegant, rounded corners, to somewhat edgy and more aggressively-looking one; the Visuals button disappeared into the menu; button layout changed and I must say it was unpleasant and irritating to accomodate to those unexpected changes.

Startup speed on PC was slow.

But worst of all, was the closed nature of it's sync mechanism (iPod or nothing), which could not help my Nokia N95 to get new tunes! Well guys, I remember v1 was not so! It could sync to Rio and Creative MP3 players, although to a limited set.

Once I installed the new Nokia N-series PC Suite, I could not miss the MTP option - the one that installs the drivers needed for Sync with the Windows Media Player.
The second blow came when I upgraded from bundled WMP9 to the latest WMP11.

IT REALLY ROCKS!

I did not expect this from Microsoft, but they did their homework well!
This player exceeded my expectations in functionality, and gave me a very satisfying user interface.

Very important that now I can sync to Nokia, thanks to the open nature of it's device interface.

This thing watches folders! The functionality has always been in my wishlist for iTunes - and I found it only in WMP11. Now you can simply copy some files into a watched folder and they automatically appear in your WMP Library! The same goes with changes/deletions. Wow!

The usability has increased dramatically since the previous versions.
I have never had high expectations of newer MS releases, but hey! WMP11 delivers!
This one goes against my common rule - never upgrade a Microsoft product until you have to.

WMP11 has a built-in Find Album Info feature - this works most of the time, getting all the info, including the album art.

And since all my music was already neatly packed into iTunes Music folder, I just set the WMP to Watch this folder - and all my music magically appeared inside the WMP Library! Managing music with this feature is a no-brainer. The only loser would be iTunes, if I changed something outside of it.
And then - after a week or so - I found it does not make sense to keep PC iTunes anymore. The competitor is strong enough to stand on it's own feet.
Why would I bother manually re-scanning music folders from within iTunes, to add some newly copied files?

Kudos to the MS Windows Media Player Team!

(My Mac still runs iTunes, though! :)

Microsoft Office:mac2008

Microsoft Office could be a target of a separate essay on how low one could go with usability when they not only try to cram more features, but also try to ADVERTISE them to user. Remember Clippy, the Office Assistant? That little "friend" apparently got so bad feedback from business-minded folks that they finally stopped advertizing it and switched it off by default. Now MS wants mac users to get ready to buy the upcoming Office:mac2008.
Simply have a look at their running ad: www.macoffice2008.com

Now let's see how many menus they present to a user:


1. The standard Mac OS menu in the top line on the screen.
2. The toolbar menu (with text labels) below the document title.
3. The "ribbon" menu top line of tabs.
4. The "ribbon" menu lower line of tabs.
5. The "ribbon" menu icons
6. The Formatting palette, floating.

This ribbon menu is the "New & Improved" stuff, and I think it's not done properly.
Just look at how all those menus took 1/3 of your screen, in vertical dimension!
I think it should've been made into a floating palette (MacOS X "drawer" UI concept comes to mind), since the ribbon menu is not needed all the time.
Or, at least, make the menu vertical, not horizontal.
The new DVD-aspect-ratio displays invite you to explore the width, not the height.
Had they made the ribbon menu a vertically floating palette, things would look much better and less cluttered.
To sum it up, current MS UI philosophy seems to be

"First - our Product, then - your Document".

They put the document you work on into a corner of what's left after their "new feature marketing" people put all those new shiny icons in the "prime space" which should be well reserved for your document.

They forget that [their] Tools are less important than [your] Trade.
Luckily to them, the Corporations world is deep entrenched in their legacy.
But as for the Personal world, it's high time to think of alternatives.
Apple's iWork package is something to be in terms of UI and usability, while maybe lacking more advanced features and complexity required in daily Corporate business.