Thinking About Passwords

2012-11-15T13:00:18-05:00

The other day I was thinking about passwords and the “forgot password” links that are common on websites today. I got to thinking just how many passwords I have and how many I forget.

I use a different password for pretty much every site I belong to. I have a simple algorithm I can do in my head to remember that password (usually). But does it matter? Do multiple passwords really provide you with any added security?

Your entire online life is protected only by your email password, and identified by your email address

With the advent of the “forgot password link” that will email you a reset link, there is really only one password that is the key to every account you have. Your email password. If you got my email password you could gain access to all my accounts on the internet. All you have to do is reset my password, check my email, and bob’s your uncle.

Email addresses today are actually used as the single point of identification, if you really think about it. But at the same time, your email address is your SSO security key. With access to your email you have access to all accounts that implement the “forgot password link”.

Any site that I’ve seen that implements the “forgot password” feature, only requires you to click a link in your email. There is no other stage of identification required, with the exception of my online banking. The bank requires I call in and identify myself via my address, my Date of Birth, etc.

So why aren’t other sites doing this? Obviously you can’t have a call in to an agent, too many expenses for that. But why not have some other personal information stored to identify the person that clicked that link. As I wrote that last sentence, I realized how much of a privacy concern that would be. Especially after reading about so many DB dumps on Ars recently.

It comes down to a single password, a single email address. Your entire online life is protected only by your email password, and identified by your email address. The two most important things you have online.

Would you be willing to provide additional personal information to some random site? If you think about it, you already provide your email address, the thing that identifies you to each and every site out there. How much more info is required to properly secure your identification? Is a single email address enough?

I think I’ll go change my email password right now.

GMail, Almost Perfect

2009-02-10T21:12:42-05:00

One of the great things about Google Apps for Domains is they run a mail server for you, and you get the GMail web interface for email. Not only that, but you get a fully functional IMAP server as well.

Unfortunately, GMail has a few annoyances.

GPG

The first annoyance is the lack of support for GPG. Fortunately this is easily overcome with the use of FireGPG extension for FireFox. FireGPG provides a simple easy interface for using GPG, including, but not limited to, digitally signing emails, encrypting email and attachments, and GPGAuth.

If your not into GMail, FireGPG can also support Rouncube Webmail. It also provides an easy mechanism to import GPG Keys, you know those big hash like things people paste on their sites; with one click you can import them.

Fixed-Width Fonts

The other major annoyance, which I find extremely annoying, is GMail displays all emails in a variable-width font instead of fixed-width. There is a “labs” feature that gives a toggle switch to change to fixed-width font, but you cannot make it the default. Fortuantely, again, FireFox comes to the rescue, with it’s “user defined style sheets”. With only a couple of lines of CSS you can haz your email in fixed-width fonts.

User style sheets are located your FireFox profile directory, and is named userContent.css. Any CSS you put in the file will be applied to each and every site you visit, so we can use it to get back our fonts. In Ubuntu it’s located at ~/.mozilla/firefox/xxx.default/chrome/userContent.css.

Just add the following to that file:

/* GMail fixed-width font: see http://3cx.org/item/34 */

div.msg div.mb, div.ArwC7c {
    font-family: monospace !important;
    font-size: 12px !important;
}

div.yxEQwb {
    display: none;
}

div.ckChnd textarea, textarea.tb {
    font-family: monospace !important;
    font-size: 12px !important;
}

td.ct {
    font-family: monospace !important;
    font-size: 12px !important;
}

This will give you fixed-width fonts for all plain text emails, in the old and new, GMail interface, and it will hide those annoying “Sponsored Links”. Also, it will give you fixed-width fonts on Google Groups. Awesomeness!

Customizing GMail With Labs

In the GMail Labs section there are a bunch of goodies to be had. My favorites are Tasks, Advanced IMAP Control, and Navbar drag and drop.

Tasks are very simple. It gives you a little pop-out at the bottom for which you can add tasks, mark them as completed, link them to corresponding emails, etc. Lovely little TODO list keeper.

Advanced IMAP Controls gives you the ability to Choose which labels show up in IMAP, turn off message auto-expunging, or trash messages when they’re deleted from IMAP. I love being able to choose which label/folders IMAP can use.

Pretty simple, title says it all. You can drag around all the little gadgets to the order of your choosing.

GMail Almost Rocks

As long as you have FireFox, the GMail web interface is almost a complete replacement for those old and clumsy desktop mail apps. Hopefully we’ll see some cool new Labs features roll out, like plain text/fixed-width only email ;).

As long as I don’t have to maintain a mail server, I’m happy with GMail.

Matt Read, Weblog

Thinking About Passwords

GMail, Almost Perfect

GPG

Fixed-Width Fonts

Customizing GMail With Labs

GMail Almost Rocks