⌘K

ssl

Value security? Avoid TalkTalk.

Update 18/10/2014: TalkTalk have now upgraded their SSL configuration; providing a much healthier "A-" on Qualys. More importantly, it's now PCI compliant. -- Cheap viagra, cialis & diet pills I could benefit from a diet pill or two, but I'm pretty sure my Dad isn't the source of this unbeatable offer. His TalkTalk email's been hacked! Trouble is, he runs 1Password, so his passwords all look like this: ls!4ahivKH=:wOMSkY>tM6_L/?n#3}?mWHTIqP5Fe10HSl I'm damn sure our residen

Council Tax, PCN & Benefits Payment Data Leaked! Are you affected?

Well, I guess it had to happen at some time. To be fair, I was parked on double yellow lines. No excuses, no basis to contest the penalty... I was in the wrong. In those 10 minutes however, I unwittingly caused Walsall Metropolitan Borough Council sufficient financial hardship to warrant a £70 fine; reduced to £35 if I paid within 14 days. In a cleansing act of contrition, I paid via the "secure online payment system". What's wrong? Your private, confidential payment details are being

cyberstreetwise.com - Really bad #infosec advice.

Be Cyber Streetwise is a cross-government campaign, funded by the National Cyber Security Programme, and delivered in partnership with the private and voluntary sectors. The campaign is led by the Home Office, working closely with the Department for Business, Innovation and Skills and the Cabinet Office. On January 13th 2014, I read an article on the BBC website about a new government initiative on cyber security called cyberstreetwise.com. With the above description in mind, I had a qui

CashPlus: "It is secure" - Ooooh no it isn't.

As part of a wider research project, I joined CashPlus in June (18th to be precise), which is purportedly... better than a business bank account So I paid the £29.99 annual membership fee and waited for the card to arrive. Less than a week later, the card arrived and I headed over to MyCashPlus.co.uk to register & activate the card. For those of you that don't follow me... I use AgileBits' 1Password to generate and manage my passwords. If you're still trying to think up and remember pass

Forgot your password? You're doing it wrong.

Have you ever struggled to remember a username or password? Join the club. Wouldn't it be great if you could log in to every site using the same password, without compromising your security? Now you can! Introducing AgileBits 1Password, the gold standard in decentralized identity & password management for Windows, Mac, iPhone, iPad, Android and unofficially, Linux. So, what's it do? In short, it removes all the hassle from any sign in/sign up process. Next time you're scratching

Experian CreditExpert ID Theft Protection - Security Review

Update : 10/05/2013 - 4PM: The community forum has returned - with site-wide SSL enabled. Appropriate cookies are httponly & secure and protocol support, key transmission and cipher strength all pass with flying colours. Superb. It's still not immediately clear to the user that the username/password required for the forum differ to those of the main site - which could lead to confusion, but there's arguably no security risk there. The register/login form actions however, should be explicitl

MyDish.co.uk Security - Missing a vital ingredient?

Update as of 15/03/13: I have received a number of emails asking for further comments on the situation @ MyDish. I firmly believe that every effort is being made to rectify the issues I've identified - and the insinuation that Carol or the team at MyDish have ignored the problem is entirely without merit. Beyond that, I'm not prepared to discuss the matter any further at this stage. If there are any updates, I will update this post accordingly. MyDish.co.uk is the brainchild of Carol Sav

companies house

Companies House Security Review - Part 2

Update(s): 18/Dec/2012 - One SSL bug now fixed (might want to put security testing out to tender next time!) - but still a few to go. Directory traversal still possible... hint encode/escape or strip, don't add slashes! Significant improvements have been made to the SSL implementation - now scoring a healthy Grade A @ Qualys SSL Labs. At least progress is being made... can't fault them for that. 17/Dec/2012 - WebCheck now uses cookies - but still not secure! At this point, I'm not sure wh

companies house

Corporate Identity Theft - Perhaps the biggest risk is where you least expect it...

Update(s): 18/Dec/2012 - One SSL bug now fixed (might want to put security testing out to tender next time!) - but still a few to go. Directory traversal still possible... hint encode/escape or strip, don't add slashes! Significant improvements have been made to the SSL implementation - now scoring a healthy Grade A @ Qualys SSL Labs. At least progress is being made... can't fault them for that. 17/Dec/2012 - WebCheck now uses cookies - but still not secure! At this point, I'm not sure w