Tag: opinion

2

Security isn’t a dirty word, Blackadder

I’m often surprised at just how some websites treat their users when it comes to security.

As any decent website developer knows, one of the basic tenets of application security is that you should never store a user’s password in an unencrypted format – and you shouldn’t really be storing a password in an encrypted format, either. The correct way to deal with storing a password is to use a password hashing algorithm (note: “password hashing”, not just “hashing”)

I’m not going to pretend that I’m perfect at this. It took me an embarrassingly long time to stop using MD5 for hashing passwords in my code (although, in my defence, it was at least salted and not just a straight hash) but I caught up with the zeitgeist and all’s well again. Of course, it seems these days I do most of my work with existing frameworks and applications, so don’t really have to worry too much about that kind of thing any more.

The fact that there are so many frameworks and other tools out there to help devs with this kind of thing just makes it all the more upsetting when I see someone doing it so drastically wrong. Someone like whoever it was that developed KidsPass.co.uk

For those unfamiliar, Kids Pass is a website aimed at parents that offers many discounts and other offers on things to do with their little’uns. It’s not a website aimed at children, which is just as well because with password security as poor as theirs that would be absolutely terrifying.

What’s wrong with it?

The only thing right with it is that the website uses HTTPS, although even that isn’t as good as it could be (it uses an obsolete key exchange, in this case RSA)

Let’s start with the sign-up process:

Nothing too horrific there. You’ll note that it doesn’t ask me for a password, and also that it asks for credit card details. The latter there isn’t that unusual, but with how they deal with password security the thought of them having my card details fills me with the sort of dread that I feel if I ever find myself having to watch The Only Way Is Essex.

When you successfully pay for your membership, Kids Pass send an activation link that you use to complete your registration. More on this below.

Should you wish to continue, it is at this point that you choose your password. Which they then email to you, unencrypted, in plain text.

Still, that doesn’t necessarily mean that they store the password insecurely, right? Could just be that they send it to you after you submit it (which is still horrible from a security standpoint) and then hash it before saving it to their database. Fortunately, there’s an easy way to check.

Ah, the old “forgotten your password” trick

If you forget your password, a decent website will give you a link to click on where you enter your email address or username, and it will send you a “token” to that email address that can be used precisely once to change your password to something else. A truly great website will make the use of that token time-limited as well, usually 24 hours.

What Kids Pass do is this:

(note: I have changed my password for the purposes of this image, I’m not that silly)

Yep, they send you your password – as a reminder – completely naked and unencrypted. Sending passwords like this is bad enough, as SMTP (the method used to send email) is completely and utterly insecure, and could quite easily be pulled out of the ether by an attacker.

The real danger though, is that they are clearly storing those passwords either in plain text form, or in a way that they can be decrypted. The latter is better than the former, but not by much because it wouldn’t take a skilled hacker with access to their server long to figure out how the decryption process works, and when that happens they may as well not be encrypted.

I’ve sent emails and tweets to Kids Pass about this before (back in December), and have had no reply whatsoever.

Let’s go back to that activation process

When I first started writing this post, the goal was to talk about the lax password security – but in the process of writing it and performing the various actions contained within, I discovered something far more serious. Remember the activation link that they sent me earlier on? Well, it contains a unique identifier that ties the activation link to your registration, and the activation page looks like the below:

Note: I’ve removed my activation code, changed its format and redacted any personal details from the screenshot above.

The problem with this is that the activation code is entirely predictable – it’s not a 32 character token like many websites use, and all you need to do to access other people’s personal data is change the code in the URL that the link takes you to. It would be horrifically easy for someone to abuse this and harvest personal details – names, email addresses and postcodes.

This is unacceptable – not only is it a serious violation of the basic principles of information security and the Data Protection Act, but it’s inexcusable for a developer in this day and age to have not thought this through to that degree.

It should not be trivially easy to get access to other people’s personal information.

Oh, and about those credit card details

Because they collect credit card details directly on-page through their site, unfortunately there’s no way for me to identify who they use to process card payments. The server does do some sort of validation on the card details, as it spits out an error if I use an obviously fake card number, or a test number (4242 4242 4242 4242 for example)

The submitted number will clearly end up on their server somewhere though, be it in memory or in a logfile somewhere. Hopefully they don’t store the card details on the server for manual processing later on, or indeed for any reason whatsoever – because if they do, I shudder to think about how they’re storing them based on the revelations above!

They’re not the only ones

I wish they were, but of course they’re not. It’s frighteningly common – just take a look at Plain Text Offenders.

Sort it out, Kids Pass – before you have a serious security breach.

3

Alien: Covenant – Movie Review

WARNING: Contains minor spoilers.

Those who know me will know that the Alien franchise is, hands-down, my favourite series of movies of all time. I am too young to have actually seen any of the “original” four at the cinema (when they were released, at least) but I have since seen Alien (the Director’s Cut) on the big screen, Prometheus and now Ridley Scott’s new release, Alien: Covenant. I don’t really count the AvP movies as part of the franchise, although I did go and see them when they were released.

It occurred to me as I was planning this review out, that I haven’t actually written any sort of review or retrospective on the other movies in the franchise, which I really must do – but first, a review of Covenant.

Is it set in a nunnery?

That was my first thought when I saw the subtitle, although I soon remembered that that is a convent and not a covenant, which made me feel like a bit of an arse. Not as much of an arse as I felt having paid for two IMAX tickets to see Alien: Covenant, though – and yes, that does mean that I didn’t think that much of the film.

Let’s start with the good bits, shall we?

The Good

Like Prometheus before it, Alien: Covenant is an absolutely beautiful movie. I saw both movies in IMAX (although Prometheus was in 3D also) and the larger screen really does the movie’s visuals justice.

Ridley Scott has obviously not lost his ability to direct a movie either, because the shots themselves are also very well done – from the “landscape” world-building shots of the planet featured in the film to the tight, close-up shots on the various spacecraft – everything is a veritable spectacle.

Two of the characters in the film are excellently portrayed, and it is no coincidence that both of those characters are played by the same actor, the always-worth-the-ticket-price Michael Fassbender. In Prometheus, he played David – a synthetic (sorry, artificial person) – one of only two survivors of the titular spaceship. In Covenant, David returns but Fassbender also plays Walter, an “upgraded” synthetic of the same lineage as the original David. They both have very different personalities and mannerisms, with Walter being empathetic and caring and David being the opposite, narcissistic and uncaring. Fassbender effortlessly deals with this “ambivalence” of character throughout the film.

The musical score is also great, and makes good use of Jerry Goldsmith’s original Alien Theme to get you feeling all nostalgic.

Err… that’s about it for the good bits.

The Bad

I’ll get this first one out of the way quickly. I’ve grown very weary of science fiction films (well, films of any genre) that rely on nonsense or stupidity to allow the plot to move forward. Prometheus was a horrific offender in this regard – everyone on that spacecraft was a certifiable moron and had no business being on such a mission. A cartographer who uses mapping drones to create a map of the pyramid they visit, and then proceeds to get lost in said pyramid?

Covenant does not fare much better in this regard. The vast majority of the havoc wreaked upon the crew of the Covenant is as a direct result of their stupidity. In one particular instance, after the excrement has severely hit the fan, the Captain does something so outrageously, mind-bogglingly idiotic that I was taken completely out of the movie – my suspension of disbelief shot to pieces.

Apart from this, there are serious problems with the film’s dialogue. The vast majority is there purely to act as an exposition dump and little else – the characters even go so far as to tell you what has just happened even though you (and they) just saw it as clear as day.

As a consequence of this, there isn’t a great deal of character development. One of the elements of the story is that the crew of the Covenant consists of couples, on their way to another planet to start a colony. However, only three of the eight pairings are explicitly mentioned, so when a couple start snogging in a shower later in the film it comes out of nowhere and almost seems like it’s been put there to fulfil a horror movie trope.

The film is also off in its own little world, thematically speaking. It answers some questions posed by Prometheus, and creates more of its own. My issue with it (and Prometheus, really) is that, without the connection to the Alien movies, they would actually be better. The ending of Covenant is positively terrifying (in a good way) but I find myself not wanting to see a sequel because eventually it’s going to be connected up to the beginning of Alien and (almost certainly) not in a way that makes a lick of sense.

As standalone movies, Prometheus and Covenant would be incredible – sure, they’d still suffer from the poor storytelling and other flaws, but at least they would be interesting and not constantly compared to the Alien franchise.

The Ugly

The CGI – only on the creatures, though. In the film we see “Neomorphs” and “Xenomorphs” (although people online seem to be referring to the latter as “Protomorphs” because they’re not quite the same as the “classic” Alien) and Ridley Scott has not decided to shy away from showing us absolutely every part of them.

Alien and Aliens worked really well because the xenomorph was an unknown entity, that stalked in the shadows and killed you without warning. They were suspenseful and dripping with atmosphere. In Covenant, there’s no mystery to the creatures. It never hides in shadows, it’s not concerned with staying hidden and getting the drop on people. Consequently, it’s very important that the CGI is good enough to pull this off without looking silly.

It doesn’t manage it.

The “Protomorph” Jazz Hands scene will go down in history as one of the strangest things ever put on a cinema screen, in my view – as will a memorable (for all the wrong reasons) scene where David is teaching Walter to play the recorder and says, “I’ll do the fingering.”

TL;DR

The film is enjoyable, and is passable as a movie experience. If it had no connection to the Alien universe, I would be far, far more forgiving of its many flaws, but Alien and Aliens are (quite rightly, in my opinion) considered to be bona fide classics, and by pushing out this movie it’s starting to reflect badly on those films.

Rating: 2/5 – 1 of those points is for Michael Fassbender, the other point is for Katherine Waterston, who does admirably well with the diabolical script.