Securing login pages

I meant to blog about this last week, but I was sick and never got around to it. There was a great conversation I was following about Should login pages be protected by SSL?

Lots of good points on both sides. I definitely favor secure login pages for financial, purchasing sites, etc. that's a no-brainer. I'm not sure about general purpose sites, though.

The case that bothers me is logging on over an insecure wi-fi hotspot. For me, I have several levels of passwords of increasing complexity and varying rotation schedules:

  1. simple disposable accounts when checking out a site, "qwerty"-style password for an account that I probably will never come back to
  2. sites where I'm not very concerned about the data (bloglines, my yahoo)
  3. message boards, email password
  4. bank, paypal, credit card sites
  5. webserver shell, database, etc.
  6. government work

So, if someone sniffs my msgboard password from an unsecured login page, it won't likely cause problems with my bank account. But I have the feeling that some people, like my parents, have a common password for most of their sites.

So, is it a disservice to leave a login page non-https for your users, even if you're not handling sensitive data? (aside from the password)

I've been debating whether or not to secure the login page for Gefilter Fish, so I checked out what the trend currently is with hip websites:
http://del.icio.us/login - doesn't appear to use ssl
http://www.flickr.com/login.gne - doesn't appear to use ssl
http://www.blogger.com/start - doesn't appear to use ssl
http://www.bloglines.com/login - doesn't appear to use ssl
http://www.furl.net/index.jsp - doesn't appear to use ssl
http://123.backpackit.com/login - doesn't appear to use ssl
http://360.yahoo.com - MODE: Standard | Secure option

Hmm, not many sites seem to bother securing a login page anymore. Am I missing something? Is there a better, Web 2.0 method of accomplishing this nowadays that I don't know about? Or have people come to the conclusion that it doesn't really matter for non-critical websites?

Posted on Thu, 30 Jun 2005 15:15 by wombat (1895 day(s) old)

%$@# yeah!

Woo-hoo! Mystery solved.

Let me back up a bit. Yesterday, while getting off the subway in Berkeley, I had this really eerie feeling. I guess classes aren't in session anymore because the streets are empty now, and, unusually for summer, it was cold and misty. Instead of throngs of students everywhere, the only people I saw were people sweeping the sidewalks with dustmasks over their faces.

The feeling brought back a faint memory of a tv show I saw as a kid where a guy somehow ends up out of sync with reality and sees what's really going on behind the scenes. Instead of seeing his normal house, he sees the physical world getting built just-in-time as people traverse throught it. Very odd and for some reason it stuck with me on the fringes of my memory.

This is the sort of question that would be perfect for Ask FlickChick, which is a great column where people as things like "I caught the last scene of something on tv where there was a guy and car near a bridge. What tv show or movie was it? I think the guy was balding." And then they come up with all kinds of possible answers. Great stuff.

But I've been meaning to track down this snippet of memory for a while and spent some time yesterday on this. I had the feeling it was an Outer Limits or Twilight Zone episode because it had the kind of self-contained, anthology feel to it.

[Funny side note: A few years ago I watched all the original Twilight Zones which brought back all kinds of memories from my childhood. All the paranoia, allegory, and sappy sentimentality came back to me like an old friend, and I saw the source of many of these strange images and stories that lurk in my distant memories]

But this new memory was definitely not part of the old series, it was in color (modern color, not the weird color of the final TZ episodes from the 60s). For some reason I had thought it was the Outer Limits because I had written off the 80s Twilight Zones as crap. It turns out that this show was, in fact, part of the 80s Twilight Zone series and was an episode called "A Matter of Minutes", written by Theodore Sturgeon (based on the short story "Yesterday was Monday"). link

I must have watched quite a few episodes of that incarnation of the Twilight Zone because I stumbled upon another one that I vaguely remembered. Something about a bunch of spirits turning themselves into raindrops to restore an environmentally destroyed planet. The episode was "Voices in the Earth", story by Alan Brennert. It must have made an impact on someone else, because someone has put the entire episode available for download here.

Now I just need to see if they have the 80s TZ series available on DVD. Hmm, I've still got to track down the Return of Starbuck, and I could put together a killer Movie Night.

Posted on Wed, 29 Jun 2005 13:50 by wombat (1896 day(s) old)

Fish Changes

I've been sidetracked for a bit, but I'm able to focus on Gefilter Fish again. I've fallen behind on implementing the suggestions people have been sending, but the next week should be pretty productive on this front.

These two changes have been rolled out to production:

  1. Invite List - Lots of people have been asking for a way to see who's been invited to an event. This makes a lot of sense, so there's now a page allowing you to see who has received an email for the event generated through the site. It lists the people with their domain masked, like this:
    dusty@********.com
    wombat@************.com

    Right now, anyone can add other people to the invite list, we'll see if that needs to needs tweaking.

  2. Standard Event Format - I've gotten lots of suggestions to integrate Gefilter Fish with people's calendars and blogs. Holy crap, the event format standard is a messy space! Lots of interesting terms floating around...ESS, EventsML, ESF, caldev, OpenEvents, hCalendar, iCal, Structured Blogging, and more...

    There are lots of great ideas floating around for a standard event format, but most of the groups seem to be acting independently. So, while all the ideas share a lot in common, there are notable differences. And, worse, it's hard to tell who's still actively trying to make this happen, some of these projects look like they've been abandoned.

    Luckily, I met Tantek last week after Tag Tuesday, and we discussed . It's an interesting approach and it looks like have a lot of momentum going these days.

    So, building upon work by others, I've added a couple of new features. As with most of the things I've thrown into Gefilter Fish, this is just the first of many iterations, and we'll see how this feature now plays out.

    New Features:
    • After an event has gone through Date Voting and a date have been set (or you skipped straight to RSVP mode), you now have the option to set the date and time in hCalendar format on a page incorporating Ryan King's hCalendar-o-matic. This hCalendar event snippet can then be copied to a blog or website. Hopefully soon, aggregators will do interesting things with hCalendar and everyone's personal calendars will handle them natively.

    • There's also an option now to enable an iCal button on your event, which uses Brian Suda's hCalendar-2-iCalendar xslt. If users click on the iCal button, the event should then be imported into Mozilla Calendar/sunbird or iCal.

    It's easier if you just see it in action. Here's an example:
    July 9, 2005 - 19:00 - 22:00 - Iron Chef Dinner Party - at Dusty's house
    The concept is simple. We all agree on a single ingredient that would make for some interesting dishes. Each party preps a dish using this ingredient (appetizer, entree, dessert, drink, whatever) and we meet at someone's house and feast on some unusual concoctions. If everything ends up terrible, we just order some pizzas. The question is, what would be a good first ingredient? Olives? Ramen? Tuna? Spam?

Posted on Thu, 23 Jun 2005 15:26 by wombat (1902 day(s) old)

Big Pig

I finally got around to grabbing pics off my phone. Here's some images from a pig roast last Saturday. I'd never been to one before. It was lots of fun, thanks to all who put it together. :)


Posted on Wed, 22 Jun 2005 11:54 by wombat (1903 day(s) old)

Steee-rike!

Clerical workers are striking at UC campuses and Berkeley Lab today. Last month there was a strike of University Professional and Technical Employees, and the month before that there was a strike by a union of State, Municipal and County Employees.

I suppose I should pay more attention to this stuff, but I'm finding that I tune out a lot walking around Berkeley these days. Someone's always yelling in my face about something, either a homeless person, picketers, or protesters (oil, war, marijuana, impeachment, etc.), so the message, unfortunately, doesn't always get through.

Hmm, I remember reading something about a possible BART and ACTransit strike last week. And it looks like Northwest mechanics are preparing for a strike. And there's talk of an NBA strike at the beginning of next season, which will probably go about as well as the hockey lockout. Oh yeah, and there's the San Francisco hotel workers strike. It looks like those who called the union a dinosaur were premature.

meh. Who is John Galt?

Posted on Mon, 13 Jun 2005 13:06 by wombat (1912 day(s) old)

Web 2.0 Definition

There are some interesting efforts to define Web 2.0 over at whatisweb20.com and Wikipedia.

Unfortunately, these definitions always come across overloaded with technical jargon or sound like marketingspeak.

When I talk with people about Web 2.0, geeks love it, but I have yet to find a way to explain why it's important to clients, users, or upper management.

BTW, I forgot how cool this image/text looks when I see it pop up on a Wikipedia article:

Posted on Sun, 12 Jun 2005 10:47 by wombat (1913 day(s) old)

Neat Sites

I think I've fully emerged from my online malaise now, as evidenced by the number of sites I've been furl'ing in the last few weeks.

Here's a few cool sites that you may have already seen, but I thought they deserved the additional linklove.

  • ClockWork - Simple and clean. I could have used this back when I was billing by the hour instead of by project. But it's still good for letting me track how long I've been working out or how long I've been heads-down coding.

  • colr.org - It looks like this was a little too popular for the server. It's a great site to examine colors for websites. Here's a cached copy

  • chicagocrime.org - Another GoogleMap hack that kicks ass. I'm sure there's a version of this for the Bay Area by now. I'd love to see this combined with a 3D city like GeoSim's Virtual Philadelphia or Google's upcoming 3D San Francisco.

  • flickr Colr Pickr - Words can't really do this page justice. I could play around with this for hours.

Posted on Fri, 10 Jun 2005 13:22 by wombat (1915 day(s) old)

Gefilter Fish Changes

I just made a bunch of changes to Gefilter Fish based on recent suggestions.

  • Inverted the order of the discussion area so that the most recent posts are now at the top and you no longer have to scoll down
  • There's no longer a separate RSVP page. If the event is in RSVP mode, this feature is now on the main event page where the thumbnail calendar usually is
  • When creating an event, there's now an option to skip the whole date voting rigamarole and put it directly into RSVP mode. This is for cases when a date is already set and you just want a quick RSVP mechanism to use. (i.e. "let's go see Batman Begins on opening night. Who's in?")
  • There's now an option to move a page into post-event status, where there's no RSVP, no Date Voting, just a simple follow-up discussion. This is useful for event communication that happens even after it's over. (i.e. "Click here see pictures I took during the event", "Someone left a jacket, anyone know whose it is?", "Everyone owes me $100 for the ski cabin")

Posted on Wed, 8 Jun 2005 17:16 by wombat (1917 day(s) old)

Audience attention

I just read some interesting thoughts about banning wifi at conferences. It's a tough problem and I bet it's just going to get worse as people start getting more mobile devices to add to the laptop distraction.

I went to the Mobile Monday last night at Openwave. I haven't been to one in a while and they've gotten really big these days. Kudos to Mike and Russ.

I didn't notice anyone in the audience with laptops out during the presentations, but there were a bunch of people using their phones during the talks (not surprising considering the audience). I'd have to say that Mobile Mondays have the highest beeps per minute emanating from the audience of the tech talks that I attend, though. The sounds ranged from some pretty embarrasing ringtones to the sounds of SMS messages being received to the odd person who left their phone set to beep on every keypress.

It was actually an interesting indicator of how compelling the talk was by how many people started playing with their phones while the speaker was still talking.

This was in sharp contrast to a tech talk I went to recently that mostly consisted of undergrads, which seemed to have the least amount of interruptions/ambient noise from electronic devices I've seen. I guess their professors have sufficiently conditioned them to put their phones on silent or to use their devices discreetly.

That poses an interesting question. Are younger people who've grown up with mobile phones and GameBoys better at being polite with their personal devices than those that haven't grown up with them? I'll have to start studying this more on the subway and at future tech talks.

Posted on Tue, 7 Jun 2005 12:07 by wombat (1918 day(s) old)

Beagle puppy went home

Rats, I forgot to post this over the weekend.

On Friday evening, I was walking around with the lost beagle puppy putting up signs and a car pulled up with a guy and two young kids, a boy and a girl. The little boy got out and confirmed it was his dog. I asked him if they live far away and he points to a house down the street. It turns out the puppy didn't get very far. Then he got back in the car and they took off.

So the crazy little puppy is home now with his family, and life is much calmer around here. :)

Posted on Mon, 6 Jun 2005 12:26 by wombat (1919 day(s) old)

Little. Orange. Different.

My mind is shot from dealing with beagles all day, so I need to clear my head a bit, relax, avoid coding, and think about happy, little orange buttons.

I've been asked to add email notifications to Gefilter Fish recently. This was a harsh reminder that not everyone believes in the RSS religion.

There have been some really good comments recently about how counterintuitive it is to subscribe to feeds here and here. They're totally right, I'm surprised users are still getting subjected to this, the process is a huge barrier to entry.

I don't have any good suggestions though, I can't even decide on which type of button to add. If you look at Gefilter Fish today, I'm currently using a pretty indecisive button.

I'm not happy with this choice, though, so I'm trying to find out what's most commonly used and might come close to approaching some sort of easily recognizable standard.

Wait a minute, it's a lot worse than I thought, there's more options now than ever! Thinking about these little orange buttons isn't relaxing at all! [anger rising...]

Maybe it'll help me to see them all together. Hmm, actually, I kind of like the "feed://" one.

Posted on Fri, 3 Jun 2005 17:14 by wombat (1922 day(s) old)

A moment of peace

Whew! It's finally calmed down a little bit around here. The beagles are sleeping and I can sit down with a cup of coffee and respond to some emails.

Posted on Fri, 3 Jun 2005 14:38 by wombat (1922 day(s) old)

Extra Beagle

We found a lost beagle puppy this morning wandering around the neighborhood without any tags. I put up a sign and I've been walking around looking for an open gate or people looking for a dog.

I need to start calling around places to see if anyone's reported a lost beagle and put up some more signs.

I've forgotten how much work it is having a puppy around. This little guy is crazy, he keeps knocking over the doggie gate and has tried to climb into the freezer. He's quite the escape artist and he's getting into everything. At least he's enjoying Dusty's old toys that don't get played with anymore.

Posted on Fri, 3 Jun 2005 11:14 by wombat (1922 day(s) old)

Colors

Thanks again for the feedback on GefilterFish. I've fixed a few of the bugs already and my "features to be added" list is now pretty impressive. I also got a great suggestion for the vote tally on the calendar to update on a mouseover, which I just put in, and it rocks.

I've been spending a lot of time on new features, but I'm going to get back to tweaking the UI. Lots of people don't like the DHTML popups, so they've got to go. I'm also going to get rid of the list of suggested dates on the right column of the calendar. It's kind of redundant and takes up a lot of space.

Also, I've been looking at the site on a bunch of different machines and the colors are terrible. On my laptop the colors appear subtle, which is what I was going for, but on my desktops, everything has a Technicolor, over-saturated look. I thought it was the color settings on my laptop at first, but I've been told that the site looks ok on other laptops and flatscreen displays.

Posted on Wed, 1 Jun 2005 13:04 by wombat (1924 day(s) old)