Macrotone Blogs

Macrotone blogs upon Joomla, our products and other matters.
Categories
Tags
Archives
Calendar
Categories:   All Categories
Suggested keywords
x
Geoffrey Chapman

HTTPS Everywhere a browser add-in



Came across this some time ago but now seems an appropriate time to mention it, especially with the on-going ‘mania’ with web security.

HTTPS Everywhere is a Firefox and Chrome extension that encrypts your communications with many major websites, making your browsing more secure.  It is with a one-click installation,which can  seriously increase your security on over 1,400 web sites by encrypting your connection.

Many sites, like Gmail (and Facebook, with caveats) have options that let you browse with HTTPS always turned on, but the HTTPS Everywhere extension makes this simpler.  Instead of turning it on for individual sites, HTTPS Everywhere will automatically routes all your data through a secure connection on any of its 1,400 supported web sites, keeping your information safe and away from prying eyes—in short, it's an extension everyone should have installed.

Essentially a win win situation.  Unfortunately not available for IE, Safari and other browsers except Firefox and Chrome.   

Tags:
Tools Privacy installable plugin browser
Geoffrey Chapman

sh404SEF graphs, Akeeba Admin Pro and .htaccess

Just tracked down a configuration problem with the .htaccess file generated by Akeeba Admin Tools Pro which was causing the sh404SEF Analytics display to fail to display the generated site view graphics.

The problem was that the .htaccess rule was preventing the sh404SEF component from accessing the graphical data that it has created.  I could see that the graphical png files were being created but they were not being displayed.

Turning off the .htaccess effect by renaming the file, enabled the graphs to be displayed so it was obviously .htaccess that was at fault.

So then it was a case of finding the creation rule in the Akeeba Admin Tools Pro htaccess creator.

The solution was to add the directory to the list of exceptions:

Under 'Server Protection -> Exceptions -> '  add the path to the sh404sef_analytics directory to the list.

This then generates an exception which means that it is not picked up by the rule identified above.

Tags:
Akeeba Analytics joomla sh404sef
Geoffrey Chapman

Three Strokes and you are out

I have previously written about Spam entries on the web site and their elimination, but now I turn to 'Invalid Login attempts'.

I have been watching these with interest for a few weeks, and it is particularly interesting to see where they originate from.

Like the Spam entries a lot of these seem to originate from the Far East.  I am currently adopting a policy of immediately blocking 'Administrator Login attempts'.  No quarter given, I can think of no valid reasons why they should be tried by anyone other than those authorised to do so.

Turning to normal login attempts I have a policy of seeing how many different user names are tried from a specific IP address.  Once they have tried 3 different ones I immediately block them.  I must admit I am building up quite a long list.  Perhaps I should generate a graphical display of the souces, it could be quite interesting to see, and watch how it changes over time.

Given a single host country as being the source of a lot of these attempts, one could always block all the IP addresses assigned to that specific country but it does seem like 'using a sledge hammer to crack a nut' approach.  Possibly I will come round to that approach eventually.

The one single thing that I have not yet investigated is how accurate the IP address actually is.  Programs such as 'tor' generate anonymity of the IP address so do we actually know where they come from at all?  If its' use became widespread blocking of IP's might be a little bit of a waste of time anyway!

 

Tags:
SPAM Privacy joomla Blog
Geoffrey Chapman

LinkedIn Password Check to see if it was compromised

I see that Mashable has announced that LastPass has released a tool to allow users to check if their password was one of those compromised in the recent hack incident.

Being very cynical I wonder why anyone would want to use a tool such as this, since it seem much more sensible to just assume the password has been compromised and change it straight away.

The article suggests, and I tend to agree that the use of a ‘password management tool’ might also be a good idea.  I personally use one to keep track of all the passwords that I use on all the sites I visit.  That way I can use a different (automatically generated) password on each site, and all I have to do is remember the password to get into the password manager, so that I can copy and paste the appropriate password when I need it.  Of course LastPass has released this ‘tool’ to promote sales of its own product, which is very understandable but also is very opportunistic.

I would suggest that rather than use such a tool that LinkedIn user just change this password whether it is compromised or not.  The old saying being ‘Better safe than sorry!’.

Tags:
LinkedIn Privacy
Geoffrey Chapman

PECR-Cookies and Joomla Part 3

In my last post where I mentioned System - EU e-Privacy Directive I have carried out some tests and can confirm that it does indeed work very well. Code inspection reveals if is very light weight and tightly coded so should be very efficient on busy sites. Highly recommended. I note a newer version is also available so the author seems to be quite intensive in updating/improving the code and very responsive to reported problems and suggestions. It also supports Joomla 1.5 as well.

I have however decided to roll my own code and will shortly be releasing an update to our ‘Password Control Plugin’. The reasons include being able to store easily the cookie acceptance in the database, which means that even if the browser is configured to clear the cache when it closes (my personal preferred setting) it will still prevent the user being re=prompted every time. I can also add additional IP checks to check for the country of the site visitors, and also disable the banner display for ‘private’ IP addresses, within a company for example.

One discovery that I can confirm is that the basic Joomla front end works successfully without any untoward impact. Of course our site is not making use of compute intensive applications. I would add though that the same cannot be said of the back end which definitely requires cookies to work at all. [Note to self: Must never turn off cookies in the browser!]

New software announced for cookie privacy include the following:

8. PixCoookiesRestrict a commercial offering displaying the banner in the main page display area.

Tags:
PECR joomla cookies
Geoffrey Chapman

Blogging problem using WLW (Windows Live Writer)

Just found a small problem when using Windows Live Writer (WLW) as a blogging tool.

The situation is that for network reasons when WLW attempted to get hold of the blog entry on the server it failed yet still displayed the article.

Then when the article was changed and published it overwrote the original post, even though the title and most of the text had changed.   Never seen it do that before but will need to watch it very closely from now on in.

Now all I have to do is get back the original post from the backup.  - Never mind.

Seems it doesn't like it when you change destinations either for an entry, as it assumes that it is a new rather  than an edited old entry.

Tags:
Blog joomla WLW
Geoffrey Chapman

LinkedIn password follow-up

Since my previous post  there have been additional reports of hacking into Last.fm and also Dating website e-Harmony (a US-based relationship site) has admitted that a "small fraction" of its users' passwords have been leaked.

Whilst the majority of our readers will not be so interested in the latter, there does seem to be a current spate of web site hacks around.

LinkedIn has said on its blog that it had reset the passwords of the affected users, who would receive an email with instructions on how to set new passwords.

What to do

Security experts have advised users to change their passwords on LinkedIn even if they were changed yesterday. Here's how:

 

  1. Visit www.linkedin.com, and log-in with your details
  2. Once logged-in, hover over your name in the top right-hand corner of the screen, and select 'Settings' from the menu
  3. You may be asked to log-in again at this point
  4. On the next screen, click the 'Account' button which is near the bottom of the page
  5. Under the 'Email & Password' heading, you will find a link to change your password

If you use the same password on other sites, be sure to change those too.

Tags:
Blog LinkedIn social
Geoffrey Chapman

Problem remote posting blog entry with htaccess rule - resolved.

I recently implemented the strict htaccess rules generated by the Akeeba Admin Tools utility.   I then discovered that it was not possible to use Windows Live Writer to post entries to the blog anymore.   It was obviously a problem with the htaccess rules since a simple test removing the htaccess file enabled a post to complete successfully.

Looking at the configuration in more detail the most obvious cause appeared to be two rules related to access the xmlrpc directory:

RewriteRule ^xmlrpc/(index\.php)?$ - [L]
RewriteRule ^xmlrpc/ - [F]

But these rules permit access, they do not deny access. so they were obviously not the cause of the problem.

Then the light dawned.  There was a rule to redirect www addresses to non-www addresses:

RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R,L]

Because the Windows Live Writer (WLW) blog account was set up before the htaccess setting were changed it was set up to use the ‘www.xxxx’ address NOT the ‘xxxx’ address.

For this reason the posting was being disallowed.   The redirection was getting in the way.  Just disabling this one rule enabled the posting to proceed.  It was desirable to have the rule in place, so once I had changed the WLW blog account to use the non-www address posting could resume and complete successfully.

I hope others find this interesting and perhaps do not spend as much time as I have trying to resolve it.

I thoroughly recommend Akeeba Admin Tools Professional as a user since it has stopped SPAM on the site almost completely.  That alone is a triumph.

Tags:
Blog htaccess Akeeba joomla
Geoffrey Chapman

LinkedIn Users note!

I have been watching the unfolding news that details of LinkedIn users and their passwords have been leaked out into the wider web.  The most recent story is here.

I don't (currently) have a link to LinkedIn on my site although I do have an account, and have done for many years.  It seems sensible to at the very least to change your LinkedIn account password ASAP, and check that your information has not been changed, which as least one report I have seen has suggested.

Tags:
social LinkedIn
Geoffrey Chapman

Use of ampersand or not

I have recently been looking at the use of ‘Strict Standards’ and the impact upon any Macrotone written extensions.  One thing that has struck me is the use of the ampersand when making calls to JFactory (and other similar functions).

A lot of the examples on the Joomla documentation site show the call with the ampersand present, but it then generates a warning message if ‘Strict Standards’ reporting is turned on.

i.e.  Is it:

1.   uinfo = JFactory::getUser($user_id);

or

2. uinfo = & JFactory::getUser($user_id);

My understanding is that the ampersand after the equals sign is not required.  It was necessary to let PHP4 know that we wanted to assign a reference of the object to the variable instead of a copy. In PHP4 if the ampersand was not supplied it created another copy of the requested user information.   The default behaviour in PHP 5 is to assign by reference and using the ampersand produces a notice.  Joomla! 2.5  only runs on PHP 5, so the ampersand is not only redundant, it also throws a  strict notice.   I suspect that in PHP5 that if any extra instances are created by the use of the ampersand that they will be closed by the garbage cleaning when the containing function or class is closed, so apart from the Strict Standards warning message it is not really a problem at all.

Tags:
PHP joomla
Go To Top

Joomla! Debug Console

Session

Profile Information

Memory Usage

Database Queries