Love, Sex, Secret, and ... God

This post originally written for my personal blog on January 11, 2009.

This past week saw two high profile security breaches on twitter.com and macrumorslive.com, each one a classic example of poor login management by websites. For full disclosure, I do not know anyone at either site but have read about each here and here as well as other websites. The short version on twitter is that an admin at twitter had a common word password and twitter has no limit on the times you can try your login. The short on Mac Rumors Live is that they either had no password on their admin interface or that the login page was sniffed, either way it was a bummer for them.

As a system administrator it is a constant challenge to keep our systems and the web applications that run on them secure while still keeping the usability that our great developers have created. So when I see things like the twitter and mac rumors issues I get very frustrated because the prevention of this is so simple. If you develop a website with user accounts, and most of them do, please consider the following.

Complex password requirements. Google returns about 232,000 results for javascript to check for strong passwords so you don't even need to invent the wheel to add this to your change / create password page. If you don't want to bother your users with this at least take some time to require it on admin accounts.

HTTPS, the S is for secure. Developers, please use ssl to encrypt your login page and use redirects to ensure that users don't accidentally end up there without ssl. As more of us move out of the office and into the coffee shop we are also moving off of a private network and onto a public one. We log into twitter, brightkite, our blog, our email and most people give no thought to the idea that everyone else in that coffeeshop could now have your account and password, unless we use something secure like https. Webmail sites learned this lesson long ago and it's time for the rest of the web to learn it too. The worst part of this is that most sites already have an https version of their site and it would be a very simple fix for them to redirect to it. For those sites that don't ( I'm looking at you brightkite ), it's time to step up, spend the money and get https going. For you wordpress users, setup a self-signed certificate (or purchase one) and wordpress has a plugin to do all the wp-admin encryption redirects for you.

More services are being provided via websites and as users of these we need to demand that they are secure. Give them feedback asking that logins be secure by default so that what happened with twitter and mac rumors doesn't happen to you.