Slashdot Mirror

Obviously the answer is GoToMyPC. Look, it even says it on the website, "Access your Mac or PC from Anywhere." How can you argue with that? Clearly they've even solved the problematic issue of 'anywhere' including private IP spaces, so they're effectively proxying or tunneling access, which is awesome, and scary as shit at the same time. If you're looking for cheap thrills at the expense of your data (yes, I mean you govt. officials, I heard rumors Assange has his hands in on this operation *wink, wink*), this is one hell of a solution.

You don't appear to understand what LogMeIn does.

To be like LogMeIn (or similar stuff e.g. GoToMyPC see: https://www.gotomypc.com/en_US/ourTechnology.tmpl for their architecture ) would require a way of allowing other people to control your machine without you having to change your firewall or NAT settings (beyond allowing "normal" outbound connections[1]).

See the LogMeIn architecture in http://www.infosecurityproductsguide.com/technology/2007/wp_lmi_security.pdf

From what I see, Guacamole cannot do the same thing as LogMeIn. There are no Guacamole intermediate/central servers (see the gotomypc link) - there's no sign of a Guacamole Gateway/Communication/Broker server software in the announcement ;).

So Guacamole isn't much of an advance over normal VNC server since you still have to configure your firewall and NAT to allow inbound HTTPS/HTTP connections. If you can do that you can always configure your firewall to allow inbound VNC connections, or alternatively configure your VNC server to listen on the HTTPS port.

[1] Yes I know it won't work in tightly controlled places.

*cough*https://www.gotomypc.com*cough*

The problem is the layers. The Desktop PCs (you know, the ones you use to check email and surf the web) have access to the internet (probably just outbound), and access to the SCADA networks. While you cannot initiate an inbound connection to those Desktop PCs, all you have to do is get someone to click on a link and get infected with something that sits on their PC and maintains an outbound connection (think GoToMyPC). From there, the exploit team has access to their PCs and everything their PCs have access to.

In an ideal world, they'd have two PCs on each desktop. One on the internet, one on the SCADA network. The two should never be connected. That's how the military is suppoesd to do it between different levels of their networks (the two different levels are never to be connected).

But that costs you twice as much, and isn't convenient. But you'd never have a security breach.

Oh, and they buy and sell power over the internet between different power companies, so right there is a reason you'd need some SCADA system connected with internet access (but you could have those systems very, very locked down as to what and how they can access between things).

Although cool and nifty, who is really going to want a remote desktop which governments can potentially access at their free will? Especially nowadays with lax wiretap laws and the like.

Convenience is a very important factor these days. At my job we set up VPNs and VNC/RDP sessions left and right - because people want the convenience of being able to access their computer/work/data/programs from wherever they're at. Services like Log Me In and Go To My PC are insanely popular.

If you told the average user that they could use their computer from anywhere in the world through a web browser... That all their programs/documents/settings/whatever would all be there... That it would be just like sitting down at your PC at home/work, but from absolutely anywhere with Internet access... Most of them would leap at the opportunity, and privacy be damned.

Their goal turned out to be the creation of a piece of software later called Fog Creek Copilot, which would help techies fix customers' or relatives' computers by giving them remote access to the ailing machines.

Great idea! Take an idea that already exists, in several variations, and create yet another incompatible implementation. When it fails, you can always fall back on the movie!

In other words, it's exactly like go2mypc, VNC but fun, snappy, easy, bypasses firewalls and highly commoditized not to mention being 5 years old.

Superglue + Ethernet port = No shit happens

But to be completely honest, I am a student myself, and I get completely pissed off by all the security measures at my school. Sure, it stopped/made it harder to do things such as what your trying to stop, but ultimately if you try hard enough, anythings possible. Ever heard of Mandrake Move?

At my school they disabled right clicking. It seriously impares one of my classes (digital design), which slows down the class because the teacher has to explain how to copy and paste without right click (yeah, we have got some retards in my class).

Anyway, ultimately, its your problem. You can try whatever you want, but there are so many proxies and there are many other ways to get around it anyway. One day, your students will find a way around it.

Good luck anyway, and I hope you decide to just more closely watch your students.

The only fool proof way to stop the internet is to disconnect....

Why would this be a Windows killer? These solutions have been around for years on Windows (and in X itself). I can't really see where all the "innovation" is. Five years ago I was administering Windows database servers remotely from almost 2500 miles away with no problems whatsoever using various methods (Windows Terminal Server, PCAnywhere, and now there is another web based one that is even more responsive called gotomypc that we've started using).

1) Kiosk security. If somebody is looking over your shoulder (physically or digitally) it really doesn't matter how secure your password is. A 64-character password is no more secure than an 8-character one is somebody is filming your typing or using a hardware/software keylogger. This is where password changes come in. Changing your password every few weeks (maybe using a rotation of a few passwords) seems to make some sense here, if you use your password often on suspect terminals. If, on the other hand, you are generally using your password in your hermetically sealed server room, it might not be all that important.

2) Brute-force, which is what this article seems more to be dealing with. This problem is EASILY solved in a way that is far, far, too often overlooked. Simply do what I've done on my own system: temporarily disable the account after three unsuccessful password attempts. Furthermore, log all login attempts and report the number of failed logins since last successful (gotomypc.com has done this very nicely).

There are all sorts of human (i.e., non-password strengthening) methods to improve security. What I've done (or, more acurately, have had my employees set up on high-security client systems), additionally, is made it so that the accounts can only be unlocked via a special account with limited privilages (mainly to reset this feature and to reset user passwords). This account is only enabled for local, physical access.

The system is pretty cumbersome to brute force.

Can't you already do basically that same thing with GoToMyPC?

"Do the Right Thing. It will gratify some people and astound the rest." - Mark Twain

also since https://www.gotomypc.com/ is now a part of citrix, you have more choices in Accessing Information On Demand

Here's a more clickable version of that link. GoToMyPC PocketView Press Release

Easily implemented solution: don't share your information, but access your own PC from anywhere and use it as you would elsewhere. This is easily available now for PC's, and could be extended to PDA's, phones, etc. with a little more work. Start with a web-centric remote administration product like GoToMyPC or Radmin.

GoToMyPC is terrific; it uses a central server to connect you from a browser through firewalls to your PC regardless of its current IP address. The software currently cross-platform only on the client end; the server is still Windows-only, but that could change. The go-between server software can be licensed, so it's not even necessary to have a third party broker the connection to the home PC.

I use GoToMyPC regularly. It's a fairly platform-independent (on the client; host is still Windows only) remote web-based access solution. Like PCAnywhere or Timbuktu or whatever, it communicates using only the GDI, keyboard and mouse.

I'd like a wireless pad with at least 1024x768, using the thin GoToMyPC client to view any PC host on my account; switch between PCs on the fly but never have to configure the pad itself for anything. Would anyone else go for that?

I'm not sure from your post if you're using a unix/linux box or a windows box, but if you're using a windows box you might be interested in gotomypc.com. It's basically pc anywhere, except about 1000 times easier to setup and use. And it's reasonably secure.

Also, as a former employee, I feel compelled to point GoToMyPC, which is like VNC, but with better compression, nicities like remote printing, and most importantly firewall penetration. (But, yeah, Windows only and expensive.)

It's not free but it has windows and Java clients, it gets around firewalls pretty well and aparently has really good compression/speed.
gotomypc.com

ASPs haven't taken off like they were supposed to

eBay is one of the most successful ASPs on the Internet. Sellers seem to have no problem paying a per-auction fee to eBay for hosting the auction application. You can imagine an alternative where everone paid $10 for an eBay application that sat on their Windows desktop and did a P2P search of current auctions by communicting Gnutella-style with the other eBay applications. It would suck. The ASP version kicks its ass any day of the week.

Similarlly, I used to work for a company with an ASP remote access application. To circumvent firewalls that only allow outbound connections, the company routes all connections through their servers; there's no other way to do it if you want to support connections where both endpoints are firewalled. Hence, ASP. It's easy for me to justify paying a monthly fee to use this service because the application demands it. I have to use their servers. (The company includes free support and free upgrades with the subscription fee, too, which makes it rather more attractive than Microsoft's licensing scheme.)

As for ASP MS Office... At this point, my reaction is, "What's the point?" In the absence of ubiquitous thin-client computing, I can't see at all why I'd want to pay for a subscription. There's no value in an ASP model for lots of applications, include most of Microsoft's (with obvious exceptions like Hotmail).

ASPs didn't fail. They just succeeded where it was logical for them to succeed.

All it takes is one idiot to install PCAnywhere and throw a dialup modem on their office computer so they can work from home. Or someone who dials out to the net from their office computer and runs something like Go to my PC.