Slashdot Mirror
Novell CEO Attacked by Cookie Monster
It is a given that cookies are flawed:
- Most systems store them in a readable format on your harddrive. Yeah, that kinda sucks. But if your machine isn't secure, then you've got bigger problems then just your cookies file.
- They are sent in plaintext over the internet. But thats why we have SSL when you need security. Someday all net transmissions will be encrypted anyway. (assuming nobody else from the IETF gets bothered by the FBI)
- Cookies used to be pretty well forced on netscape users, but now most browsers give you an option. And there's always junkbusters for the more paranoid.
It is given that I need state over httpd. I want shopping carts. I want net commerce. I want user preferences on websites I frequent. Maybe you don't want these things, but I do, and I don't think I'm alone on this one. There are a few ways besides cookies to do this.
- Intel would love to use a CPU ID to help us. This has so many problems that I'm just not going to go into it. But it would work.
- Webmasters could create a session and pass it in a URL with each page. This suffers from all of the same problems as cookies, except that the session ID isn't stored on your hardrive. Unless you bookmark it. Ooops. It also has the added benefit of making URLs messy, and being a huge pain in the ass for a webmaster.
- Some sort of third party big brother handling authentication. I'd much rather just have a cookie that I can turn on or off than have a third party take care of it for me. I trust me more than them.
I really thought that the 'Cookies are Evil' was dying down as people realized that while they aren't the best solution, they are as good as we're gonna get any time soon. Then to see someone who ought to know better get out and throw fire ants into the mix to plug his software, well thats just really rubs me the wrong way.
It's like telling people that the water that comes through your pipes has floride in it, so you ought to buy their brand of bottled water instead. You ever see a communist drink water, Mandrake?
One of the greatest problems in this whole arena is that anytime someone stores any bit of information for whatever reason people will get unnecessarily angry. It's a fact of life, albiet a sad one, that many people have become so astoundingly paranoid. If we had slightly more trust then maybe things could start to work, but not until then.
Just confirms my suspicions that CEOs ain't CTOs for a reason...
Trust isn't something that should be granted by default, only to be taken when something goes wrong.
Unless id Software, Real Networks, Novell, Netscape/AOL, or anyone else proves to me that they NEED a certain bit of information, in order to serve ME better, I'm not giving them the first initial of my first name.
They already get enough for system administration purposes: HTTP referrer, IP address, even browser type (although Konqueror allows you to change that).
I saw this a few hours ago. I was thinking, "Good god, not the cookies are evil thing again." But no, it turns out that the article is nothing but a shameless plug for a product that this fellow is trying to shill.
The most telling part of the whole tale though, is the ZDNet TalkBalk. When "Larry, Internet Web Designer" can identify it as a joke, you know that even the lowest common denominator can see right through this guy.
I can't help but wonder why even ZDNet would lower their quality control to this level.
------
If a tree falls on an anonymous coward yelling 'first post' in the forest, does anybody hear?
I know of at least one place in the USA that won't allow floride in the water becasue they know it's part of a communist plot to take of the USA. Anyone been to Santa Cruz.
JungleBoy.
"You never know when some crazed rodent with cold feet might be running loose in your pants."
-Calvin
The thing with the latter is due to the fact that most CC # checkers check the numbers, and not the expiration date. Thus, pass 10^16 numbers to one of the sites, and you're bound to get some cash. Once they have a number that works, then they're set.
Therefore, he might have been hit with this instead of true CC# stealing (It's really hard to get at cookies although there are some bugs, but require a lot of assumptions on the end user's actions). This only suggests to me that we need to make sure that CC# verification systems are more secure, and ask for the experiation date in addition to all other info. Or even better, add a PGP-like key to CC# info to make it more secure.
"Pinky, you've left the lens cap of your mind on again." - P&TB
"I can see my house from here!" - ST:
It's true that we a need to keep state in writing out web apps but maybe we should retink this whole web app thing in the first place. Trying to write a serious commerce app over a stateless anonymous protocol is a recipe for disaster. What we need is another protocol for delivering code over the net and leave http for delivering content. Something like RMI but language independent if possible.
BTW I know CORBA is language independent but honestly it's bit complicated for the average developer. HTML was great because it was so simple to learn and effective at what it wanted to accomplish.
War is necrophilia.
I am paranoid. I dont trust any one. Cookies are bad. Javascripts are yuckkkk .. But I TRUST Novell. They are so carefull people. see they learn from their.. opps their CEO's experience.
I hope they implement "digitalme" soon. My cash is running out. I need a database of credit card numbers.
Manifest
... "follow me" the wise man said, but he walked behind
I'm hesitant to condemn the man on the spot, because after all, he is CEO of a multimillion dollar company and one would guess that his vide presidents shield him carefully from saying anything TOO embarassing in public. But when I read the vague 'I don't know how it worked, but I'm sure cookies had something to do with it', I really started to have my doubts.
Are there sites that store cookies with your freshly entered credit card number in it? I can't believe it. Only thing this shows is that he lacks a fundamental grasp of what cookies are and how they work.
Cookies are in the most part not entirely insecure.
This shows how people always blaim what they don't understand so as to put blame on something, so they can't blaim themselves.
The only way they could have lifted the cookie file is if it had too much yeast in it
-----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/M/Sd?s-:a---->?c++UL+++P++++L++++ E+++W+++N+K-w---M-PSY+t+5?XtvbDI++
Of CEOs shooting off their mouths to try and move product.
Anyone else remember McAfee and the Michalangelo virus?
Sure, you could rant and rave about how bad cookies suck - but what would you do without shopping carts, user preferences, and *GASP* slashboxes? Of course I suppose you could petition all programmers to use Php4's session functions and not only get nowhere fast, but get rid of cookies all together.
Rob just stole your credit card! Look out!
Shame on ZDNet for this headline. It flashed across my MSNBC breaking news thingy, too.
Lots of people may see this headline, but not read far enough into the article to see it's a thinly-veiled product plug. Now all the newbies have one more reason to think cookies are some evil scam.
Grrrrrr.
-- Cara
Cara Hart chart@eNOSPAMfurn.com Systems Administrator eFurn.com, LLC. and ARITEK Systems, Inc.
I'm the guy who writes those silly fortunes. =)
It is NOT easy to grab a credit card number on-line. Sniffing packets, intercepting e-mails, grabbing cookies, etc. is bloody hard work. Especially since you could spend 5 minutes raking in the bins at your local mall and get 100 numbers.
I am willing to bet $50 that Mr. Schmidt has at some point in the last 6 months handed over his credit card in a restaurant. Doing that is opening up his card number to a wider audience than using it on Amazon.com ever could.
However, it is helluva easy to use a credit card number online, once you have it. Go on, fill in a few forms, and it doesn't matter if you're a 13-year-old boy in Arseville, Tenessee -- you can use that card number from the 70-year-old woman in Alaska who wouldn't know a modem if it bit her on the arse.
Last week, I found a $60 Amazon.com charge on my card which wasn't mine. I don't blame the internet. I don't blame Amazon. I don't blame cookies, SSL, e-mail, or Elvis.
I don't even care that much. So what? I shout a bit, get my $60 back, and carry on like nothing ever happened. No big deal.
This kind of thing has been happening for years on the phone. This is nothing new, except for the sheer volume of fake transactions. But until the card companies make it easier to verify transactions on the fly (see Philip Greenspun's excellent book for a description of how pathetic the whole thing is), it's not going to get better any faster.
Just don't forget to burn your carbons.
rOD.
--
Rod Begbie done this, and he's not
Quidquid latine dictum sit, altum viditur.
I only post comments when someone on the internet is wrong.
Yes, there are quite a few problems with cookies. The major two have to deal, of course, with encryption. The encrypted storage is depressingly easy for a browser company to fix; I can only wonder why Netscape, Mozilla, or even IE hasn't at least done a weak scheme (at this stage, with the RSA patents set to expire in less than a year unless I'm mistaken, Mozilla will probably be the first to do it).
The problem of sending cookies in cleartext is harder. The solution is of course encrypted communication. For anyone with Apache this shouldn'e be too difficult (SSL should be sufficient)... except for the whole certificate problem. I'll be glad when encryption is built into the protocol.
Come to think of it, the only way this credit-card number could have actively been stolen would be if the sessions hadn't been encrypted. Does this mean that one of the "great" computer executives was actually stupid enough to give his credit card number to an insecure site? I find that hard to believe, though if he's trying to hawk his own wares I suppose it could be some kind of play.
More likely he simply fell victim to a credit card number generator (which exist all over the place) and blamed cookies since he could use that as an advertisement.
Sure, its possible for a clever Cracker to get at my cookies. But I'm not too concerned with it. The guys who are that good have bigger fish to fry.
I'm more worried about some store clerk collecting card numbers and passing them on to someone else. That is a lot more likely to happen in the real world!
Mike Eckardt meckardt@yahoo.spam.com
The big problem with cookies, I think, is that they're misused. You should maintain state, not useful information, using cookies. They're perfect for stuff like a session ID, a user ID, that kind of thing, which does not need to be kept secure.
:).
Credit card numbers should either be kept in a back-end database, or (preferably) not at all. I'd prefer it happen the latter way. I like net commerce as a bright idea (both generic and in the IBM-branded net.commerce) and have even worked on some commercial sites, but that's part of the problem: you don't want schmoes like me safeguarding your credit card
If Novell's CEO is having problems with credit cards kept in cookies, it isn't the fault of the medium but the way it's being used. If anything, we should adopt best practise standards which keep credit card numbers secure and press business software vendors, like IBM or MS, to do the same.
Of course, I suspect that it wasn't the fault of cookies at all; it was a cracked machine or even a shopclerk who swiped his card twice. But that's just my nasty, nasty suspicion.
--
--
There is no premature anti-fascism. -Ernest Hemingway
So here's my suggestion...
When a person is issued with a credit/debit card account, they are asked if they want to make online purchases. If they think they might want to, the bank supplies them with a small device, like a pager.
Whenever a customer wants to make a purchase, they enter their credit card details and send them off, where the mod 10 algorithm and expiration dates are checked.
If this passes the test, the bank sends a message to the pager-like device asking the user if he/she authorises the transaction. The device has at least 2 buttons, maybe 3: one for "yes", one for "no", one for "alert, someone else is trying to use my account!"
I think it would be a good idea for a bank to provide this sort of service, because then users would be much happier with their security, and less worried about the possibility of online fraud.
how funny is hell?
I am always curious on this one, hope this is not off topic:
What's the implication if a banner ad that send me a cookie?
As far as I can think of, using this cookie, the ad provider company will know which page I viewed their ad, can they get more info out of this?
--- You make things foolproof, and they'll find you a damn fool.
Imagine that, as a web surfer, you have a smart card that identifies you as a web surfer. Personally I am a believer that you should have to identify yourself as adult/child in order to cruise some areas of the web, but that's my personal opinion. But that's not for this thread to discuss. Add to the smart card some sort of bio sensitive way to identify yourself, maybe a thumb, maybe an iris scan. The key being that everything you need (short of the reader hardware) is stored on the card. You can take it with you to any browser (unlike cookies).
Your smart card not only identifies you, it has a profile on you. It can keep your web site preferences, but it can also keep your buying habits, etc. And your age, marital status, and so on. It's here that people scream bloody murder about privacy on the net. But here's my hopeful suggestion : that your profile will come with trust zones. If you're doing anonymous surfing, maybe all the site gets is your age -- or maybe nothing at all. For sites you want to register with long enough to read a story (like NYTimes), you let them have your name but not your profile. And so on. For trusted sites like slashdot you set up preferences. For sites where you are actually a customer of some sort, you let them have your profile (linking in yesterday's discussion about IBM's miniature vegetable commercials).
Wouldn't this be nice? My company has a large number of business units, each with their own web site, and we've worked to setup a shared profile system so that, once you've told us something once, you don't have to tell us again. Wouldn't it be good if this extended to multiple businesses? Don't you think it's a pain in the ass to have to continually identify yourself and set up preferences on every site you want? Wouldn't it be nice to have a mini-profile that you could use to bootstrap your registration to new sites?
My point is that, with a self contained smart card, you can have a level of control over the information that you provide. It's the card that has the brains. A web site couldn't just tell the card "Give me the whole profile". It would have to say "Please validate me as being a trusted site and give me whatever information I am entitled to." And then, in something of an ironic twist, *it* has to identify itself to *you*, and you get to decide what to do next.
Will this happen anytime soon? I wish. I think the reason that digital certificate authentication didn't catch on is that it was too confusing to get the certificates into the browsers, people didn't want to give up their passwords, and the certificates weren't portable. In a world where you have a smart card reader built into your keyboard, these problems seem like they might go away. Nobody thinks twice about having to flash a passport when flying internationally, and they usually only grumble a little bit about being carded at the local bar. Is it really that much of a stretch to think that there'll come a day when you take your webId card out, stick it in the slot, and then periodically answer a question about how much information you want to provide to the web site you just visitd? I don't think it's really all that bad.
I'm curious to know if I'm, like, *way* off on this one. Are people going to flame the hell out of me on this one? Or agree completely?
d
www.HearMySoulSpeak.com
Please dont waste time. Read this artic le on the evils of cookies instead. Atleast these people know a bit about what they are talking about.
/.
If I am not mistaken, it talks about the security loophole that was created when GIF images were allowed to embed cookies in computers. This has been discussed on
... "follow me" the wise man said, but he walked behind
I really thought that the 'Cookies are Evil' was dying down as people realized that while they aren't the best solution,
they are as good as we're gonna get any time soon. Then to see someone who ought to know better get out and
throw fire ants into the mix to plug his software, well thats just really rubs me the wrong way.
Well, it may rub you the wrong way, but I wonder whether you are missing the most important point: there IS a technology out there that solves the problem of identifying yourself on hte 'net in a secure way, giving out only the information you want and only to those you want. It's based on NDS and it's working. Novell has baeen developing NDS for about 10 years now, it's a proven directory solution and there are many applications already that use, plug into, distribute data through or collect data through NDS. One of them is DigitalMe, and it solves the ancient mechanism of cookies. It's a flawed mechanism for many applications, and guess what? Novell has a solution that works today (Microsoft AD anyone?) and solves the problem. Is there anything wrong with that?
Sigged!
Isn't it more likely that this guy paid with credit card and a waiter wrote the number down? If I were going to commit credit card fraud I'd just get a job at Red Lobster and start writing.
Most shopping sites that I'm aware of, and most software packages that allow you to add a shopping cart to your web site, don't store the credit card info in the cookie. They store a session identifier--either a UUID or some other unique key generated by their database engine. So it's impossible for someone to lift your credit card from your machine by simply reading your cookies: they'd also have to be able to get into the shopping vender's database and look up your credit card. At which point, they could get *everyone's* credit card.
The only way a cookie could be used to steal from your credit card is if they copy the cookie to another machine and hit a site such as 'Amazon.com' when you have 'one-button' shopping enabled.
I think this whole cookie scare is total nonesense--there are easier ways to steal credit cards than trying to reverse engineer site-specific database key identifiers out of a cookie file. Such as working as a waiter for a restaurant...
Intel would love to use a CPU ID to help us. This has so many problems that I'm just not going to go into it. But it would work.
Many boxes already have HostID numbers, but the PC world has not had this, traditionally. I have not heard any complaints from Sun users, apart from when they need to fool a license server somewhere - but in a PC a hostid is suddenly something bad? (Well, you can change the ID in a Sun, but if it's etched into the CPU it might be harder to change.)
But what I was going to say was that it wouldn't work, since a CPUID/HostID identifies a machine, and not a user. Think about multiuser environments. Think about typical university setups, where you can sit at any one of hundreds of machines. Or when you set up individual accounts for each member of your family on your home box.
No, we absolutely need something that follows the user, and not the machine. I don't see any better solutions than cookies, but I'm sure that there are some.
I think one of the greatest dangers of cookies is that right now they're insecure an invisible.
I had a friend who had his browser set up to accept all cookies. I was ranting to him one day about how I hate being forced to accept cookies at some sites, and how I nearly always refuse to accept them. He decided to check out his cookie file. Guess what he found...
Some site (I don't remember the offender) had set a cookie that contained a ridiculous amount of information about him: full name, home phone number, home address, job title, etc. Obviously he had filled out some kind of form at some point and they just dumped the info into a cookie. This meant that without his knowledge, every time he used their website, all of his personal info was being sent back and forth in plain text.
A system that allows this kind of abuse is seriously flawed.
I don't think it's time to rewrite the whole cookie spec -- and I don't like the alternatives to cookies either, but this current situation isn't acceptable.
What I'd like to see is some "cookie" icon in the statusbar of your browser that's shown whenever the site you're communicating with is using cookies, and clicking on that "cookie" would give the full cookie details.
I also think that all new browsers should have cookie filtering built in. I don't mind accepting any cookie from Slashdot.org, but I don't want to accept a single cookie from doubleclick. I'd also like to see some content based filtering available. This would allow me to refuse cookies that try to do dumb things like store my password in the cookie.
In the mean time, I'll keep plugging Cookie Pal for Windows users. It does a great job of filtering and handling cookies, and is very unintrusive and small. I'm a satisfied user, but don't have anything to do with the company other than that.
I am Bob Washburne rcwash@concentric.net
I am a registered slashdot reader. But Slashdot refuses to accept my password even though I am looking at it on the screen.
I do not accept cookies. They can be harvested by any number of means (just check BugTraq) unless you devote your life to securing your box and don't make any mistakes. Ever. I have other things to spend my life on, so I take reasonable precautions and then refuse all cookies.
Cookies are not necessary. I fill in my Nickname and Passwd on the first screen and it is brought along through the Preview and subsequent screens. This is done without a cookie, so why any cookie at all?
I would be quite willing to enter my passwd each time I make a submission rather than leaving personal information lying around for a rogue marketing-bot to harvest.
That is the whole purpose of a password; to authenticate the action. Storing a password defeats the entire purpose. So why have a password at all if anyone can just walk up to your box and post without it?
I would even rather be mistaken for an Anonymous Coward than subscribe to the urban legend that cookies are safe. Anyone who thinks cookies are harmless obviously doesn't know much about them.
I could just start and speculate for hours as to how his credit card number was stolen. Maybe somebody sniffed a packet and read the card. unlikely but technically possible. Maybe the random card generator. Maybe it's not an online problem at all. But there is one thing I am pretty sure of, regardless of how flawed the cookie system might be, whoever got his credit card number in all likelyhood did not get it through a cookie!!
What's being stored in cookies? Well, a session id. Or a user name. Or maybe even some personal info or preferences. But I have never ever seen any site storing the credit card number in a cookie! And I shop online an awful lot.
If the credit card number was in fact lost online, and you must blame it on someone, blame it on the stupidity of this particular user. You don't send that info online in a non-encrypted format and as a general practice you probably should not shop online at a store you don't trust (for a variety of reasons, privacy and security being only some of those reasons.
I don't believe that his card number was stolen. He's making the whole thing up as a third-rate scare tactic.
It's just too damn cheap and easy, and frankly, it's pathetic.
I love Junkbusters, it lets you specify only the domains that you trust with your cookies, and filters out the rest. If you don't like the idea of arbitrary web sites tracking your every move (the eyes, the eyes), don't like all the 'accept this cookie' windows that pop up when you have the confirm option on in Netscape, and still want /. to auto-log you in, you should check it out.
;-)
Also, it lets me tell everyone that the web-browser I'm using is 'Flipper the web-surfing goat (C64 edition)'
God, that sounded to much like an advert, btw you can it from here.
I protect my privacy by linking my Netscape /dev/null (the infamous bit-
cookies files to
bucket). Netscape never knows the difference!
Works great!
I also refrain from shopping at grocery stores
which encourage membership cards. I hate people
keeping files on me.
How tragic that the CEO of Novell has been assaulted by a plush puppet. I'm glad to hear that he came away with nothing worse than a stolen CC#. Cookie monster can be pretty viscious when he's mad.
The big question in my mind -- Sure, Novell's new software may protect you from Cookie Monster, but can it protect you from other muppet menaces like the powerful Big Bird or Bert (who everyone knows is Evil)? The article doesn't say, and I'd have to assume not.
Which is of course where my software comes in. Sesame Shield is released under the GPL and is easily configurable to run as a daemon that will block all Sesame Street characters, and soon Muppet Show characters as well. Don't rely on closed-source programs to protect you!
The enemies of Democracy are
i use windows/ie5 (i have linux but only a 14.4 modem, my 56k is a winmodem , and i cant get X to work right with my vid card so i dont use linux much) ... IE stores cookies as seperate files, and sofar the cookies ive checked just have numbers, i want to see whats in the cookies, anyone know a cookie viewer or something that reads IE cookie files? please help
Assuming that SSL was in use, and the site he was at implemented some kind of expiration on the session ID stored in the cookie, the only way this hack could have occurred is if someone had actually cracked his computer to obtain his cookies file.
Now, WHY, pray tell, would someone who broke into the CEO of Novell's computer take JUST a credit card number? I'm sure there were FAR more interesting things lying around than a cookie file. Especially if it was a Windows PC - then there's all sorts of neat things like (crackable) password lists, etc., which could probably get you into some pretty interesting places at Novell. But no, none of this was stolen.
Hence, my bullshit meter has gone off the chart.
One of the Web browsers I use is IBrowse 2 on an Amiga. (I'm aware that I'm encouraging flames by even mentioning the Amiga here, but I'm going to take the chance :-)
IBrowse 2's cookie handling is very good. If you elect to be asked before accepting a cookie, the request that gets popped up give you a number of choices - accept cookie, accept cookie but don't save it, accept all cookies from this server for the rest of the session, reject cookie, reject all cookies from this server for the rest of the session. It's cool because when doubleclick.net (or whoever) sends me a cookie, I can hit "reject all". If Slashdot sends me one, I can safely hit "accept all".
Additionally, IBrowse 2 has a "URL prefs" feature, allowing one to set per-URL preferences, including cookie handling prefs. I can therefore set the brower up to automatically reject all doubleclick.net's cookies without asking, for example (this is a fake example, as I never get anything from doubleclick.net; it's aliased to 127.0.0.1 in my hosts file ;-)
I use Netscape 4.5 at work, and its cookie handling is primitive in comparison. Since IBrowse and Netscape are the only two browsers I use with any frequencey, I don't know how IBrowse's cookie handling features compare with (for example) MSIE's.
-Stephen
(or as they say in these parts al-u-min-ee-um)
i should be putting it in my walls, on my windows, heck i should be be wearing it. what, me paranoid?
seriously, if a cookie cost somebody their credit card number, the responsibility is on the web site, not on cookies. it was just a bit to promote there digitalme stuff, but in a high-tech world and as a head of a high-tech company, you shouldn't be making yourself look like an idiot. it might have sounded cool to some marketers, but it didn't come out that way.
The ideal form any secure transaction takes, whether it's cash or information changing hands, is one where none of the participants really knows any more than absolutely necessary about the other parties involved.
There are a lot of variations of this sort of scheme, usually including some sort of trusted third party or PKI (public key infrastructure,) as well as any non-vulnerable local authentication storage medium. Smart cards come to mind.
One really cool scheme I've seen involved having user info stored in a strongly encrypted form on a web page, where the user used a key exchange between his authentication info on a local chip card and a TPT to access his info automatically. Great idea, since the TPT doesn't know anything about the user's content, but just provides their half of the security info, nobody can go mucking around with it while it's inert, and the user isn't storing anything locally or in a publicly accessible format. Maybe an alternative to cookies, since the sort of infos they are used for is pretty small, and thus almost instantly retriavable via the net...
Cookies are a pretty dumb way of doing things in any case.
Cole's Law: Thinly sliced cabbage
In relation to using personal information on the net (including my e-mail address, you may notice that I did not "anti-spam" my e-mail address here on /. However, I only use that e-mail address in conjunction with a few sites, limiting the number of points from which my personal information can be derived to those sites with privacy policies that are up to spec, saving my regular e-mail address only being given to a much more private and personalized list of people that I am willing to receive information from. That way if there is a security problem, I know where it originated by my email address. Similarly, when I write software that uses cookies, I don't put any personal information in it. All of that type of information can and should only be kept in a back end database, well shielded from crackers, etc. For example, on one e-commerce site I designed, the cookie "knew" who you were, but in order to place a credit card order, you had to validate certain information within an encrypted page, even though the user had already "registered" their information (including the c.c. #) into the database via the web. We also included a fraud detection program designed to stop the c.c. # generators from ever being able to spoof an order. And folks, it just wasn't that hard to do!!
I agree with previous posters. The Novell CEO was trying to sell proprietary software, and claiming to have been attacked by the "poison cookie" monster in order to do so.
...Open Source isn't the only answer -- but it's almost always a better value than the alternatives...
In all fairness, it's actually a fairly cool idea. It was designed from the ground up to give end-users control over their own electronic identities, and control who can see and retreive what information. And it's designed with multiple profiles for each user in mind. All the information is encrypted and stored in NDS on Netware, Solaris, NT or Linux (current platforms). The idea is that user info would be stored in a lock-box that you have to give someone permission to retreive. The NDS admin can't see the content, assuming there aren't any encryption problems. I agree that the article is a little goofy, and it's a stretch for him to make the cookie claim, but it doesn't detract from the overall idea, which I suspect a lot of companies aren't going to like because it puts the customer in control.
A user rings
"Do you know why the system is slow?" they ask
"It's probably something to do with..." I look up today's excuse ".. clock speed"
I'm feeling very uncomfortable here. I mean...I've grown up worshipping the BOFH...and now...what doth my eyes detect, but...
A Bastard Chief Executive Operator From Hell?
You know, some strange part of me wants to see this as a complement.
The odds that Mr. Schmidt purchased something from such a fly by night operation that the credit card number was embedded in the cookie so low, that it stretches the imagination beyond repair to consider the idea that that same operation would ever have the technical desire or even knowledge to use Novell's new DigitalMe software!
Of course, he could have just been tricked by a *real* BOFH... "GEEK! HOW DID MY CREDIT CARD NUMBER GET TAKEN!" "Mmmm. Cookie." "I knew those things were trouble!" "Mmm. Oreo. Chips Ahoy. Yum."
Seriously, there's a gigantic amount of irony embedded in Novell proposing that their DigitalMe system would improve consumer privacy. Consider: Most sites that require state don't require your identity, pretty much because it takes time to get somebody to reveal who they are, and attention spans are small. Look how much traffic The New York Times loses from people too lazy to even lie on a form--MTV may have done more for consumer privacy than any other company in history.
Novell's DigitalMe changes that. Assuming the infrastructure is such that any site that wants to do trustable-state transactions(which is really what Schmidt and Novell is trying to sell) actually has enough DigitalMe access to not have to worry about Yet Another Single Point of Failure, DigitalMe lets the user disclose every piece of information the user could possibly expose in the click of a "OK, tell 'em whatever they want to know."
Heh, Novell--Suddenly everyone's finding out a hell of alot more about you!
And the worst part? Unlike that paltry $50 liability had, you'll never know what people are doing with your personal information. I find it interesting that in a place that espouses freedom and individuality so much, people don't own their identities.
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
The only potential issue I can see with this is the possibility that the limited size of the cookies may make decent grade encryption too big. I'm not certain though.
Personally I like the use of cookies as a session token for server-side session management. The only thing stored on the client is a one-use session ID which expires. Thus, even if somebody could get your cookie file, they'd have to take the session ID and use it within say 15 minutes, otherwise it would be totally useless. To further prevent fraud, you can link the session ID with the IP address, which eliminates all but the most complex hijackings that I can think of.
---
This sig has been temporarily disconnected or is no longer in service
I use a program called At Guard to deal with cookies. It does not just block those I do not want, but also allows me (upon visiting a site for the first time) to accept cookies from sites I wish to use them on (i.e. Slashdot.org). The program also has some nice firewall and add blocking features.
http://www.atguard.com/
NO!
TEH i5 t3|-| l33t sp3lling of THE
BY SAYING THIS YOU PROVE U R N0T 31337 LIEK ME!
Comment removed based on user account deletion
I've read that argument on the mod_perl list before (that session IDs are better because they aren't stored on your drive), but it just isn't true. Netscape, at least, stores every URL you visit in it's history file. I don't know about IE.
So I think they're worse, personally. You can make decently secure cookies (i.e. encode the time and the IP address in the cookie with an MD5 hash, so they only last an hour and only work from YOUR computer, otherwise you have to log in again)
I never really was a big fan of the cookie monster, and that's probably why it took me so long to appreciate death metal. I used to completely hate cookie monster vocals altogether, but recently I've had to grudgingly admit that some of the Gothenburg stuff like In Flames is actually pretty damn good. And I also recently heard Death's "The South of Perseverence" and was amazed.
So I won't completely condemn the cookie monster. But I still prefer clean vocals, like the immensely talented Warrel Dane. (I'm currently on a Sanctuary/Nevermore binge, and just can't get enough of Warrel.) And also Bruce Dickinson, Ralf Scheepers, Roy Khan, etc. These guys are great singers.
(Geoff Tate used to be good too, but I recently saw him on concert and I have to say that the man has just about lost it. On one hand, I was very glad that they played many songs from Operation:Mindcrime, but on the other hand, it exposed Tate's weaknesses, because he didn't sound anywhere near as good as the old recording.)
Look at Control Denied vs. Death. It's basically the same band, but with the cookie monster replaced with a real singer, and it just completely kicks ass. I hope Chuck Shuldiner realizes what a great thing he has going there.
So what am I trying to say? I guess I'm saying that the cookie monster doesn't necessarily ruin a band, but replacing him with a singer will almost certainly result in an improvement. I wonder what In Flames would be like if the got a power metal singer.
Wait a minute, you mean this article isn't about the cookie monster in a metal band? Oh, it's in reference to some internet thing. Oh. Never mind.
You pointed out the "Oops" if you bookmark a session. Doesn't matter if they do. The sessions (at least from a java perspective) time out - so the session logic should send back and "invalid session" response page. That's one reason why you should not bookmark the page. peace. JOe...
peace. JOe...
Offtopic slightly, I know, but here's the shamless plug, and pointer, to the BOFH Excuse server.
Cheers.
Good Fast Cheap. Pick any two.
Cold Fusion (by allaire) lets you designate the life of a cookie. so it will either expire after a predetermined time, or as soon as your browser closes.
When I started writing my own HTTP server I decided to try a new way of keeping sessions without using cookies. URL's looked like this:
i le.html
http://www.wherever.com/ss.asdf98cs/some/path/f
I tested it for months. Pros:
- No cookies at all.
- Very reliable. Session state is retained without problems.
- Works even in Lynx.
Cons:
- Search engines record the URL with the session ID. Although the session ID is invalid after only a short time, it's quite ugly.
- When people would try to tell each other what URL to visit, they would try to pronounce the session ID.
- Absolute links always cause the browser to ignore the ID. Solution: dynamic HTML or no absolute links.
- The browser reveals the session ID to other sites when the user follows a link there. The ID is even recorded in the referrer log.
- Browser redirects are required. However, cookie solutions often face the same problem.
Eventually, I decided that cookies were a better solution for our purposes and switched over.
One thing that people need to understand, however, is that there are cookies that never make it to the user's hard drive. It puzzles me that browser makers put all cookies in the same category. The Best Way, at this time, to keep session state is to send a cookie to the user's browser that is never stored anywhere but in memory.
Most systems store them in a readable format on your harddrive. Yeah, that kinda sucks. The storage has to be plaintext-equivalent, if not actually plaintext. What should browsers do, xor your cookie with susageP the way WinCE does with passwords?
Someday all net transmissions will be encrypted anyway.
Even discounting the substantial performance and political problems that stand in the way of that, that will still never happen. There's no reason to encrypt all communications, and it's not even technically possible in all cases.
Intel would love to use a CPU ID to help us. This has so many problems that I'm just not going to go into it. But it would work.
It would work for everyone with a Pentium-III and an OS/browser combination that is aware of it. As long as only one user ever uses the computer. The processor-ID scheme is flawed even if you ignore privacy problems altogether.
Some sort of third party big brother handling authentication.
On that, we agree. Uh, what, so I'm going to trust Novell with all of my information?
Now, what is really wrong with cookies. They're a substantial invasion of privacy, and they're being used to establish local and global click-trails. Allowing cookies only from the same site as the current page alleviates the problem sort of. Using Junkbuster can solve it entirely (and help you block ad banners!).
And what's really wrong with the Schmidt and most of the other people who whine about the insecurity of cookies: they don't get it. Odds are that his credit card number was not stored in the cookie. Even if it was, someone who gets access to arbitrary files on his computer can do a lot worse than steal one credit card number. People blame cookies when the real culprit is One-Click Shopping (patented!) and its ilk, which make a cookie a credit-card equivalent. Dumb, dumb -- you need per-session state for shopping carts and permanent state for preferences, but using permanent state for shopping carts is asking for trouble. Hooray for Amazon.
And hooray for the Internet Junkbuster.
rm ~/.netscape/cookies; ln -s /dev/null ~/.netscape/cookies
Comment removed based on user account deletion
Visa and MasterCard reiterate every quarter that neither one has traced a single instance of credit card fraud to online interception or acquisition of a credit card number.
Wow, what are the odds that the first guy it happens to is Novell's CEO? It's a good thing he has a plan to make sure it doesn't happen to anyone else! Phew!
Sounds to me like the second case of stealing money over the net is being propogated by Eric Schmidt himself!
Kevin Fox
www.fury.com
Kevin Fox
It's a pretty well-accepted fact today that trusting the end user to keep his/her keys and identification information is a fallacy. Such systems are securable but not secure, since you can expect most people to be careless, and occasionally, for instance, leave themselves logged in, or in the case of strictly single-user operating systems like DOS and non-NT Windows, one can just turn the computer on and assume the identity of the person.
This means that there has to be a mechanism by which the server can know who you really are, without trusting you to keep your key or identification information lying around easily accessible through the computer. (This is still not failsafe, because, in the case of password-based authentication, you might still do something stupid like tape your password to your monitor, or keep it lying around . . . the possibilities are endless, and worsen with each additional secret key one has to keep.) One fairly elegant solution is to have a trusted third party, who you can sue if your information is divulged, etc. As long as you can put the blame on them after the fact, it will be a reasonable deterrent for them preventing them from being dishonest.
The reason for having a trusted third party is that neither side needs to be suspicious of the other side -- the client goes to the third party to find out how to talk to the other side, and the fact that the other side can understand our end of communication and we can understand the other end means that the connection is secured.
Another advantage is that the number of times the shared secret (or shared key) is used can be minimized -- a new temporary session key based on the nonce (a temporary, session-specific quantity calculated to prevent replay attacks) can be newly computed and passed to the client and the server, and thrown away later -- so that the more long-lived key -- such as a password, or principal-auth server key, or auth-server-to-service key -- have a minimal chance of being compromised.
So just because an individual is paranoid and can guarantee that he or she will never compromise security by leaving their account wide open for anyone to access, does not make this true in general. Most people are not bothered as much about security and secure transactions to keep their cookies inaccessible by an attacker. So for the general case, it is better to opt for a trusted third party, where the keyword is trust. Perhaps additional legislation and additional penalties would help to enforce this trust.
You're absolutely right. When programming pages, you don't send clear text to cookies. Instead, you generate some random string as a cookie, and store the info on the server. Then, only the server has the data, and the server can match up the cookie with the data. Kids, stop using Frontpage to write web sites.
The biggest problem with cookies are places like doubleclick.net and imgis.com who, because people stick banner ads that go to their server, can track people across sites. There are four solutions to this problem. First is to have the web browser ask if you want to accept a cookie. Most tend to spam that dialog per page, so clicking 'no' is a time-waste. Second is disabling cookies. Then, a lot of functionality is lost. Third is adding all the Big Brother sites into your /etc/hosts and aliasing them to your loopback adapter. And fourth is (if you are on win32) is using a cookie munch program.
To heck with all that. Konquerer has a very elegant solution to the problem. I just wished it offered to allow selected Javascript commands to be executed, others ignored (such as popups if the site is some freeweb thing.) However, having the ability to not show your personal life to people who sell this info to anyone is great, anyway.
#include<stdlib.h>
intluhn_ok(
char*inp
){
return((luhn(inp)%10) ==0);
}
intluhn(
char*inp
){
staticint x[2][10]= {0,1,2,3,4,5,6,7,8,9,0,2,4,6,8,1,3,5,7,9};
char* p;
int s =0;
int sum =0;
char c;
if((inp==NULL)|| (*inp=='\0'))return -1;/*biteme, doughboy!*/
for(p=inp;*p !='\0';++p){}
do{
c=*--p;
if((c<'0')|| (c>'9'))continue;
sum+=x[s][c-'0'];
s^=1;
}while(p!=inp);
returnsum;
}
Shut up, be happy. The conveniences you demanded are now mandatory. -- Jello Biafra
You probably already know that this method is called "URL rewriting"; and comes standard with many server-side programming technologies, Java servlets come to mind. Of course, it probably would not be a problem to implement them with any good server and server-side programming technology combination. I agree to your points, and the pros and cons of the technology probably could not be summarized better.
I don't really understand all the negative publicity about cookies. URL rewriting is an alternative when session information is kept only for a short time, and there is no reliable way of keeping persistent state information on the client's browser other than cookies. I believe it's possible to keep temporary session state using cookies set to expire in a very short time, but there is still a need for cookies for keeping persistent state.
--
BluetoothCentral.com
A site for everything Bluetooth. Coming in January 2000.
Zigbee Central: A Zigbee weblog
Since the browser controls the flow of information in and out of the machine, and there are open source browsers available, anyone who really wants to should be able to create a browser which responds to remote information requests in whatever way he wishes. This makes all sorts of cookie management schemes possible. You might do something simple such as accepting cookies only from certain preselected sites, or you might do something more complex such as putting together different types of replies for different types of information requests. You could even have the browser lie by pretending to save cookies when it really isn't and sending back fake information when the cookie is requested. This would be useful for accessing sites which require cookies to be enabled, but without actually giving away any real information.
Companies aren't going to do anything to protect the privacy of the individual; it's not in their economic interest. Politicians aren't likely to be of much help, either, since corporations have a lot of political power while individuals have a great deal of difficulty organizing around a cause. So the only practical situation is for web users to take action on their own to screw up the information-gathering technologies and make them useless. Modifying the browser is one such approach.
(Another would be to write a worm to hnt down information about yourself and erase it, but that would get you thrown in jail.)
--- Brian
I'm pretty sure that those fortunes come from Zippy the Pinhead.
#ifndef disclaimer
I'm not humor impaired, I realize that Signal 11 doesn't actually claim to write those fortunes, I'm just trying to make sure that everyone enjoys the wit and surrealism that is Zippy.
#endif
Why can't I moderate something "Wrong" or at least "Grossly Misinformed"?
Free Advertisement. Novell's CEO has more money than I will ever see? So whys he all cranky about 50 bucks? Hes not. He just wants to sell you something.
It's so darn easy to see that he's totally fibbing and setting up his excuse ("well, I said i wasn't sure"). Give me a break. It was almost certainly guessed - or stolen from the trash. You'd probably add more security to your credit cards if you shredded your paper trash than if you stopped using cc's on the web altogether. Anyone with any sense will get not just expiration dates, but zip codes as well. Without a billing address you are SOL with the CC companies if anyone challenges it. The burden of proof is on the vendor, and those $25 chargebacks add up.
Listen up to some interesting facts:
NB: We DO, however, work with the FBI and local police and have had some success, but it's expensive to pursue.
To summarize:
(1) You're FULLY protected when you use your card online.
(2) Visa/MC/Amex don't care about online fraud, because the more there is, the more penalties they collect from vendors.
(3) When possible, let the vendor know you've been robbed, so they will reverse the charges. Then call the credit card company to cancel the card.
Reply to fraudchaserAnyProblems@hotmail.com without AnyProblems. Humans, you know what I mean!
I mean, he says he has no idea how his credit card was really stolen, picks the most unlikely suspect in the world (cookies), and then turns right around and markets his own 'alternative' to cookies.
Sup wid dat man?
--- Grow a pair, liberals... stop letting the Republicans bully you!
Instead of oldest first.
You can just skip the usually long first post thread and read the normal stuff which comes in later.
You can also moderate the new ones, which no one seems to do as much as the first posts.
"I disapprove of what you say, but I will defend to the death your right to say it" - F. Voltaire.
Tell your browser to accept all cookies. Did this several months ago with no problems.
There's probably an equivalent for MSIE, but since I don't use it, I don't know what it is.
y2k info - http://www.ecis.com/~alizard/y2k.html
Tech Public Policy stuff
Has anybody ever actually made an excuse generator? That would kick ass! :)
I don't do cookies either. I have set up a simple web site for a free Esperanto course. I ask participants to submit the minimum amount of information, promise to keep it absolutely confidential and keep the user ID in a URL.
To avoid the URL method with cookies is a cheap excuse at least for sites like Slashdot.
Yeah, URLs can be bookmarked but the act of bookmarking is very visible to the user. In fact, I very much like having personal URLs instead of personalized URLs.
Marko
I've seen poor implementation of cookies lead to server B looking at cookies that had been set and should only have been readable from server A. I've gotten spam because of it. Blame the Webmasters? Sure, but I'll stick to blaming the browsers. They ought to have more fine-grained control over cookies. Why, even IE4 (*suppresses gag reflex*), on which I am typing this post, only offers "cookies on" or "cookies off." What about "prohibit cookies from server foo.bar.com" or "foo.bar.com can only read foo.bar.com's cookies?" Then, the users who still wanted loads of customizable preferences could leave everything on and not worry about it, while people like me could turn on just enough cookies to keep our favorite tech support sites from barfing in a cookie-less environment.
Hope some browser writer is listening somewhere (or better, a knowledgeable user of an existing browser I don't know about).
Bye all....
--unDees
"I call a baby goat a 'goatse.'" -- my non-Internet-savvy 6-year-old stepdaughter
Everyone's posting about how terrible the Novell DigitalMe hype is, and that we should all be happy with our cookies. Cookies ARE used to link information together to violate your privacy. They also have many legitimate uses, as people have pointed out. I think we do need a better way to manage cookies. DigitalMe is a radical solution, but I don't think the idea of returning control over personal information to users is a bad idea. The only way to be completely safe right now is to comb through your cookies between visits to sites and weed out all the cookies you didn't authorize, or not use cookies at all and miss out on the benefits. Better solutions are possible, and I'm not upset with Novell for working on DigitalMe.
Using RMI/IIOP, RMI/JRMP, pure CORBA or any fancy protocol will not bring any new value in this case.
First of all, with those protocols, you will have to write a Java applets that use complex tricks to pass though firewalls, something pure HTTP does very easily.
Then, you will still be stuck with the same problem on the client machine: how do you store the state information between two different browser sessions? Your applet will have to ask for access to your hard-drive, and this implies pop-up windows, certificates and a lot of faith and trust from the user.
Optionnaly, the applet could upload everything to the server before exiting, so that the info is stored on the server-side, but then the user will have to relog again next time he visits the site if he wants the applet to retrieve the previous information. Something, again, that cookies and pure HTTP do very easily.
I'm rather happy with the Cookies/HTTP/JSP/Servlet mix for the moment. It's light, fast and predictable.
Just make sure your $Netscape/user directory (or equiva~1) is only readable by you, and check that https in turned on each time you're really sending confidential info, and you're as safe as you can be.
Kk.
I also saw something (this morning, I think, but I can't remember where) saying that companies are sending HTML mail which downloads an image which sets a cookie. The agency then has your e-mail address associated with a cookie, giving them (potentially at least) a lot more information about you. Not a problem for me, of course, since I use Pine for mail :-)
The essay on HTML enabled e-mail and cookies is at:
http://www.tiac.net/users/smiths/p rivacy/cookleak.htm
aarrgghh.. i _realize_ you like to put up humorous headlines, but DON'T GET MY HOPES UP LIKE THAT!!
there was only about a tenth of a second betwen the time i read the headline and the time i saw that you meant web browser cookies. But that tenth of a second was so filled with wonder and hope that maybe, just maybe it could be true.. that when those hopes came crashing down it felt horrible.
next time think about the consequences of your actions before you post..
then again.. maybe we could MAKE it true. i wonder what the security at the Childrens Television Workshop equipment storage areas are like.. hmm
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
I just dont get it.
if they want state, why use a stateless protocol like http?
why not iiop (that is stateful, no?)?
Why not a protocol like ftp or ssh (if you're a security nut) which is stateful?
Hack over hack over hack.. the statelessness of HTTP was a performance hack... the cookies are a statefulness hack... junkbuster is a stateless stateful statelessness hack...
Three Step Plan:
1. Take over the world.
2. Get a lot of cookies.
3. Eat the cookies.
Just create a session ID and pass it in the the URL. Also, associate an IP address with the session ID.
To avoid problems with bookmarking, expire them after an hour.
I do this on a bunch of different sites, and it works great, with no cookies. -Loopy
the CEO doesn't even know if the criminal used information from cookies to get his CC#.
it could have been a clerk at a retail store.
it could have been me sleeping with his secretary whom happened to have his CC#.
the discussion should be about how this CEO feels that his customers are so low on the brain cells to believe his hype.
the only good thing from the article is the ad for xcam on the lower left hand corner. yummy.
"you get hit and your head goes ping" --rocky horror picture show
I was posting to Deja when the connection was broken. Trying to reaccess the site I was unable to in Netscape but able to in MSIE. Clearing the caches, reinstalling Netscape, rebooting, nothing worked. I went to another machine and could easily access www.deja.com with Netscape. The solution was to go into the user subdirectory and delete cookies.txt. Netscape accessing deja.com suddenly worked again with no problem. Cookies and/or Netscape 4.7 are broken.
If not wanting my browsing habits tracked this way makes me "ultra-paranoid", sign me up.
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
Ecommerce sites should enable SSL by default. The performance difference is a small penalty to pay and can be addressed by hardware solutions for larger sites. With SSL, you already have a certificate and session, so you don't need cookies or encoded URLs. Unfortunately most web app APIs ignore this fact (though the new JSDK 2.2 spec has provisions for doing it in the Java world).
QWxsIHlvdXIgQmFzZTY0IGFyZSBiZWxvbmcgdG8gdXMh
Cookies are not harmless. As well as kitchen knives, golf or baseball clubs, [add you favorite misuse here], even the wheel and fire. But it looks like you mixed up the tool and the use of it. Someone can send you a cookie to truck your habits, another will dumbly put sensitive information in it (and browser will store it as a text file for anyone to read), but yet another will just use it to track your session, to help you see only what you want to see, to be better for you. So why do we continue to blame the tool?!
Yes. There are better ways, and maybe one day we all will be there to use them, but for now cookies are good enough, provided you can control what you send, where and when. Can you really do this with current browsers? Not really. What I personally saw is either everything or nothing, though there is a post in this discussion about better implementation in IBrowse. But should we eat raw food waiting for a fire to be put in stoves? Or we can still use it for our benefit?...
I don't want to give everybody my information... I usually browse the web with cookies turned off...
When are people going to get it through their heads that cookies can only return information the server sends to you? The only way cookies are going to "give" your information to a site is if you already told the site your information in the first place.
Why should I let my free email service know anything about me other than my real name...?
Maybe so they can pay for the free email service? Didn't anyone ever tell you There Ain't No Such Thing As A Free Lunch?
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
Hmm... I need to qualify that a little; as described below the banner ad servers can track their own cookie against the URLs used to fetch images, which doubtless have something to identify the corporate entity inlining the image. "Devilishly clever," I think Daffy Duck said.
However, that's just boosting the argument for practical user-level cookie filtering. Not the Nessie and Messie kind, which just pester and pester until you either accept or reject all cookies.
The thing to remember about cookies is that the server giving you the cookie may come belong to scumbag banner companies like DoubleClick that wants to track your browsing.
Question: Would you pay to visit all of the websites you visit? And I do mean all of them, from Slashdot to cNet to Yahoo to some two-bit page on GeoCities?
The reason I ask is that banner advertising is what pays for an awful lot of the web today. Unless the page is promoting a company's product (making the whole page one big ad) or supporting a company's product (you already paid for the page), banner advertising is the only alternative to charging for access.
If banner ads go away, then you will lose all of your free web pages. Web content providers will instead start charging for access. That will require you to -- guess what -- identify yourself to facilitate payment. And that identification process will be far more in-depth, involved, and intrusive then any banner ad from Doubleclick.
I am not saying this makes what Doubleclick does right or wrong. I am just wondering if you have considered the consequences of your actions, or if you are simply hoping for a free lunch, like so many people seem to do.
Be careful what you wish for. You might just get it.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
I do not accept cookies. They can be harvested by any number of means... I would be quite willing to enter my passwd each time I make a submission...
Interesting to note that the techniques for skimming cookies off net traffic can also skim that same password and user ID.
What's that, you say? Encrypt the password? Well, sure... but why not just encrypt the cookie instead?
Anyone who says "cookies are not needed" has obviously never done any programming. Without persistent, state information, computer programming is just about useless. Oh, sure, you can do one-way content delivery that way, but I, for one, want the web to be something a bit more interactive then a glorified TV broadcast.
I really get a kick out of the fact that you don't want people tracking you, but you post your email address in a public forum. Yah.
There are issues with cookies that make them less then perfect (to put it mildly), but treating them with extreme paranoia and fear is rather an over-reaction.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
Okay, so cookies are flawed. They're insecure and undiscriminating. But that isn't really the problem here. Online stores, plain and simple, should NOT store your CC info there. Why would they? The rest of your data (full name, address, etc.) is stored on their servers. All they should need is some randomly generated, IP address-tagged session id or customer id. Nevertheless, I am willing to accept the guy's assertion that there is some website that stored his CC num in a world-readable format.
If I ran a conventional store, and you bought something with a credit card, I could xerox 200 pieces of paper with the number on it and post them on telephone poles. This does NOT mean we need to blame telephone poles! Credit cards, not cookies, are the dangerously flawed technology we need to cope with here. You have a 20- or so digit number, which anyone can use to spend your money any number of times, for anything and for any amount of money, without your approval? Suddenly, cookies sound rather benign in comparison.
The opinions stated herein do not necessarily represent those of anybody at all. Deal with it.
Proving that two negatives (- x 2) do not equal a positive, the Lord High Admiral (c) Gilbert & Sullivan, charges CmdrTaco with endangering his vessel by navigating in red hot chilli infested waters, thereby causing his double-bottom to be scorched BER (beyond ecconomic repair). Further, although a civilian (and therefore ignorant of the dangers of red hot chillies to CmdrTaco's vessel's (double) bottom) Mr Schmidt, did with no malice aforthought, by displaying false navigation lights did lure ComdrTaco and his vessel into the aforementioned red hot chilli infested waters thus endangering HMS/USS (strike out as necessary, according to prejudice) 'Slash-Dot'. Mr Eric Schmidt is hereby demoted to Eric Schmidtlein (diminutive of Schmidt, for none linguists) with immediate effect.
I copy my cookies down on paper and delete them from my hard drive. That way they can't search my drive for information to send out to all the bad people.
Few people know that it is actually cookes that are behind the Y2K problem. Oh, yes, you had better believe it.
It does take some time to type them back in again, but it is well worth it.
Seriously, who was the clod that called them 'cookies'? Anything would be better, even 'feces'.
Well, here's another one.
That's the point. Why are we using the web for commerce? It was never meant for state-dependent operations.
Because it is there. It exists. It can be used.
CORBA is nice, fun, elegant, cool, whatever, but you cannot use it because it isn't available to the target market.
An inferior solution that works will always win over a superior solution that does not exist.
(It is also worth pointing out that a lot of things are used for purposes they were never intended. Thus do we evolve.)
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
The above ZDNN article quotes Richard Smith. Here's a link to his complete article (more informative): "The Cookie Leak Security Hole in HTML Email messages"
I am replying twice to one message, because two threads have sprung into existence. The other should be very close after this one (I cannot link them both to each other, unfortunately (chicken-and-egg problem)).
Anonymous digital cash is a solved problem.
I'm intrigued. Could you provide some more info on this? In particular, I generally see information technology leading to very easy tracking (to wit, the whole Doubleclick cookie issue). How does anonymous digital cash work?
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
I expect that banner ads will eventually die, as advertisers are discovering that they're pretty ineffective.
/. tee shirts)
:-)
:-)
Could be. Alternatively, consider highly targeted banner ads. I deliberately fill out a survey giving the advertiser demographics information, such that they can target their ads to
the sorts of things I am interested in. My interest goes up, clickthroughs increase, sales benefit.
Now, why would I fill out such a survey, you ask? Well, one the purposes of advertising is to inform potential customers of your product or service, whereas they may have been in the dark before. That is a useful thing, to me. If I am going to be bombarded with ads, at least they could be relevant ads.
I have to wonder just how "ineffective" banner ads really are. I see 'em. I read some of them. I even click interesting ones from time to time. Sometimes I learn something, sometimes I close the window in disgust, occasional I bookmark a site for future investigation. This works better, for me, then ads on the side of a bus, where I cannot easily remember the company or investigate their product.
there are other possible sources of website revenue
Okay...
sponsored links
Sponsorship is just another way of saying "advertising", is it not? Sponsors will likely want an attractive, thing to get my attention, no? How is that different from a banner ad?
merchandizing (get those
I somehow doubt Slashdot could be funded on the income from T-shirt sales.
affiliate programs
You mean like, "Link to our online store, and you get a kickback"? Frankly, I find those sorts of agreements more insidious then advertising. With ads, you see a product of possible interest and get the chance to evaluate it. The content provider gets their money regardless. With affiliate programs, I am locked into a choice. What if the affiliate provides lousy service? Do I use them anyway, and support my preferred content-provider? Or do I leave the C.P. out in the cold and use my preferred online store (or whatever)?
voluntary contributions (works for NPR and PBS stations)
Riiiight. Voluntary contributions are never enough. You think NPR and NPTV aren't funded through your tax dollars? There are too many things of possible interest to possibly get supported through donations. No, I don't buy it. Sorry. I want more then two channels worth of National Public Internet.
Supported by advertizing != free
Good point. Touche. However, supported by advertising is also not the same as paying cash.
Harder to measure is the psychological cost of being engulfed the sea of advertizing that encourages the culture of consumption in which we dwell.
Oh, please. I'm not going to crawl into a hole and isolate myself from the rest of the world just because I might fall in with a trend.
Anonymous digital cash is a solved problem.
Very interesting. See my post at #215 for a seperate thread on this.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
Let me take this opportunity (for those of you who use Macs) to plug iCab. Its cookie handling is close to perfect. You can set a preference to accept, reject, ask, or accept but expire all cookies at the end of the session. The cookie-query dialog displays the cookie name, data, expiration date, and server, and has options to accept or reject, to auto-expire at the end of the session, and to add this server to the always-accept or always-reject list.
It's also in a user interface that makes all this a lot simpler than my explanation. ;-) Has selective blocking of images (by server or by dimensions) and applets, too, and a built-in list of common banner sizes.
It's about as sexy as ascii-art, when you know you could almost as easily have a raytracer!
Cookies are just one of the symptoms!
gargoyle#stonedemon.yi.org
Seems strange that everybody is thinking of this as a direct replacement for cookies. I would think that the opportunity (for Novell to want to do it) would be to provide some added value.
As I understand it, the biggest hurdle for micropayments is that the processing cost for a typical credit card transaction is about US$0.15, plus profit!
So, my slightly off-topic question would be this: what does it take to make micro-payments work? Is it smart cards that operate in a debit fashion? Something that can aggregate millions of transactions an hour to the point that they are actually WORTH something?
EZ NOVEL OWNS JOO. novel is novel, which means ita new thingy.. you probablu difdnt even knwo that simple yawn.
last post
LAST POST
!@!
YOU CAN'T BeAT MORE FOR LAT POST YOU IW OWNED YO(U AHAHAHHAHAHAHAHAHAHAHA
_.......................__
||.....__...._._||_..||-\\..._...._._||_
||......_\\.(/_'..||....||-//.//.\\.(/_'..||
||__((_||_,_/).||_..||....\\_//.,_/).\\_
The final word; anything following is redundant.
What if your browser keeps a history that has all the URLs in it?
Sorry to be anal.
In general I think cookies are a fine.
just my two cents
Citrix
Leknor
http://Leknor.com
"So many idiots, so few comets"