Deprecated: Joomla\Input\Input implements the Serializable interface, which is deprecated. Implement __serialize() and __unserialize() instead (or in addition, if support for old PHP versions is necessary) in /homepages/13/d380392445/htdocs/Jlive/libraries/vendor/joomla/input/src/Input.php on line 41

Deprecated: Return type of Joomla\Input\Input::count() should either be compatible with Countable::count(): int, or the #[\ReturnTypeWillChange] attribute should be used to temporarily suppress the notice in /homepages/13/d380392445/htdocs/Jlive/libraries/vendor/joomla/input/src/Input.php on line 170
Geoffrey Chapman - Macrotone Blogs - Page 17

Macrotone Blogs

Macrotone blogs upon Joomla, our products and other matters.
Categories
Tags
Archives
Calendar
Categories:   All Categories
Suggested keywords
x
Geoffrey Chapman
Subscribe to updates from author Unsubscribe to updates from author

An IT professional with a wide experience of IT systems, specialising in Database Management and Security.

Geoffrey Chapman

Thoughts on the EU data protection regulation and Joomla

In January 2012, the European Commission announced two important pieces of legislation affecting the personal data of EU citizens: the EU data protection directive and the EU data protection regulation.  Of the two, the data protection regulation will have the greater effect on most businesses that collect, hold or share data within the EU. 

Continue reading
Tags:
compliance Europe ICO joomla Privacy
Geoffrey Chapman

PECR– Cookies and Joomla Part 4

Several new product announcements to add to my growing list.  The JED now even has a separate section for Cookie Control

8. Cookie Choice is a non-commercial JED entry.  It does not block cookies but informs the user, which is what the current interpretation of the PECR regulations is understood to be required.

9. JE Cookies a commercial JED entry.  Details are a little light but it offers various colour options. 

One I have mentioned earlier 6. Cookie Alert does offer the country determination options, something we have in our own version.  We have tested our own version and it works reasonably well, although the impact on checking the country of origin on each screen refresh is something we are giving serious thought to, and would impact this product offering as well.

Our own home grown version is being tested and is working well.  One thing we have found is a small problem where if a visitor does not accept the cookies, and just leaves the banner displayed, continuing to browse the site, IF a separate modal window is opened, we have observed a situation where the model window is also presented with the cookie banner.  Not every modal window, just some, so we are investigating further. 

Tags:
Privacy PECR joomla Europe cookies cookie
Geoffrey Chapman

The Tor Project

Mentioned the Tor Project in a recent post so decided to expand a little upon the topic. 

Tor is free software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis.

It is a browser that exists on your machine, but is not installed as such, so can be placed on a USB key and used as a remote app.  Its’ purpose is to anonymise your web communications by bouncing then around a distributed network of relays all around the world:  it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location.

Useful for accessing sites that may be blocked by you ISP for what ever reason.

Tags:
browser Communications Privacy Tools
Geoffrey Chapman

HTTPS Everywhere a browser add-in



Came across this some time ago but now seems an appropriate time to mention it, especially with the on-going ‘mania’ with web security.

HTTPS Everywhere is a Firefox and Chrome extension that encrypts your communications with many major websites, making your browsing more secure.  It is with a one-click installation,which can  seriously increase your security on over 1,400 web sites by encrypting your connection.

Many sites, like Gmail (and Facebook, with caveats) have options that let you browse with HTTPS always turned on, but the HTTPS Everywhere extension makes this simpler.  Instead of turning it on for individual sites, HTTPS Everywhere will automatically routes all your data through a secure connection on any of its 1,400 supported web sites, keeping your information safe and away from prying eyes—in short, it's an extension everyone should have installed.

Essentially a win win situation.  Unfortunately not available for IE, Safari and other browsers except Firefox and Chrome.   

Tags:
Tools Privacy installable plugin browser
Geoffrey Chapman

sh404SEF graphs, Akeeba Admin Pro and .htaccess

Just tracked down a configuration problem with the .htaccess file generated by Akeeba Admin Tools Pro which was causing the sh404SEF Analytics display to fail to display the generated site view graphics.

The problem was that the .htaccess rule was preventing the sh404SEF component from accessing the graphical data that it has created.  I could see that the graphical png files were being created but they were not being displayed.

Turning off the .htaccess effect by renaming the file, enabled the graphs to be displayed so it was obviously .htaccess that was at fault.

So then it was a case of finding the creation rule in the Akeeba Admin Tools Pro htaccess creator.

The solution was to add the directory to the list of exceptions:

Under 'Server Protection -> Exceptions -> '  add the path to the sh404sef_analytics directory to the list.

This then generates an exception which means that it is not picked up by the rule identified above.

Tags:
Akeeba Analytics joomla sh404sef
Geoffrey Chapman

Three Strokes and you are out

I have previously written about Spam entries on the web site and their elimination, but now I turn to 'Invalid Login attempts'.

I have been watching these with interest for a few weeks, and it is particularly interesting to see where they originate from.

Like the Spam entries a lot of these seem to originate from the Far East.  I am currently adopting a policy of immediately blocking 'Administrator Login attempts'.  No quarter given, I can think of no valid reasons why they should be tried by anyone other than those authorised to do so.

Turning to normal login attempts I have a policy of seeing how many different user names are tried from a specific IP address.  Once they have tried 3 different ones I immediately block them.  I must admit I am building up quite a long list.  Perhaps I should generate a graphical display of the souces, it could be quite interesting to see, and watch how it changes over time.

Given a single host country as being the source of a lot of these attempts, one could always block all the IP addresses assigned to that specific country but it does seem like 'using a sledge hammer to crack a nut' approach.  Possibly I will come round to that approach eventually.

The one single thing that I have not yet investigated is how accurate the IP address actually is.  Programs such as 'tor' generate anonymity of the IP address so do we actually know where they come from at all?  If its' use became widespread blocking of IP's might be a little bit of a waste of time anyway!

 

Tags:
SPAM Privacy joomla Blog
Geoffrey Chapman

LinkedIn Password Check to see if it was compromised

I see that Mashable has announced that LastPass has released a tool to allow users to check if their password was one of those compromised in the recent hack incident.

Being very cynical I wonder why anyone would want to use a tool such as this, since it seem much more sensible to just assume the password has been compromised and change it straight away.

The article suggests, and I tend to agree that the use of a ‘password management tool’ might also be a good idea.  I personally use one to keep track of all the passwords that I use on all the sites I visit.  That way I can use a different (automatically generated) password on each site, and all I have to do is remember the password to get into the password manager, so that I can copy and paste the appropriate password when I need it.  Of course LastPass has released this ‘tool’ to promote sales of its own product, which is very understandable but also is very opportunistic.

I would suggest that rather than use such a tool that LinkedIn user just change this password whether it is compromised or not.  The old saying being ‘Better safe than sorry!’.

Tags:
LinkedIn Privacy
Geoffrey Chapman

PECR-Cookies and Joomla Part 3

In my last post where I mentioned System - EU e-Privacy Directive I have carried out some tests and can confirm that it does indeed work very well. Code inspection reveals if is very light weight and tightly coded so should be very efficient on busy sites. Highly recommended. I note a newer version is also available so the author seems to be quite intensive in updating/improving the code and very responsive to reported problems and suggestions. It also supports Joomla 1.5 as well.

I have however decided to roll my own code and will shortly be releasing an update to our ‘Password Control Plugin’. The reasons include being able to store easily the cookie acceptance in the database, which means that even if the browser is configured to clear the cache when it closes (my personal preferred setting) it will still prevent the user being re=prompted every time. I can also add additional IP checks to check for the country of the site visitors, and also disable the banner display for ‘private’ IP addresses, within a company for example.

One discovery that I can confirm is that the basic Joomla front end works successfully without any untoward impact. Of course our site is not making use of compute intensive applications. I would add though that the same cannot be said of the back end which definitely requires cookies to work at all. [Note to self: Must never turn off cookies in the browser!]

New software announced for cookie privacy include the following:

8. PixCoookiesRestrict a commercial offering displaying the banner in the main page display area.

Tags:
PECR joomla cookies
Geoffrey Chapman

Blogging problem using WLW (Windows Live Writer)

Just found a small problem when using Windows Live Writer (WLW) as a blogging tool.

The situation is that for network reasons when WLW attempted to get hold of the blog entry on the server it failed yet still displayed the article.

Then when the article was changed and published it overwrote the original post, even though the title and most of the text had changed.   Never seen it do that before but will need to watch it very closely from now on in.

Now all I have to do is get back the original post from the backup.  - Never mind.

Seems it doesn't like it when you change destinations either for an entry, as it assumes that it is a new rather  than an edited old entry.

Tags:
Blog joomla WLW
Geoffrey Chapman

LinkedIn password follow-up

Since my previous post  there have been additional reports of hacking into Last.fm and also Dating website e-Harmony (a US-based relationship site) has admitted that a "small fraction" of its users' passwords have been leaked.

Whilst the majority of our readers will not be so interested in the latter, there does seem to be a current spate of web site hacks around.

LinkedIn has said on its blog that it had reset the passwords of the affected users, who would receive an email with instructions on how to set new passwords.

What to do

Security experts have advised users to change their passwords on LinkedIn even if they were changed yesterday. Here's how:

 

  1. Visit www.linkedin.com, and log-in with your details
  2. Once logged-in, hover over your name in the top right-hand corner of the screen, and select 'Settings' from the menu
  3. You may be asked to log-in again at this point
  4. On the next screen, click the 'Account' button which is near the bottom of the page
  5. Under the 'Email & Password' heading, you will find a link to change your password

If you use the same password on other sites, be sure to change those too.

Tags:
Blog LinkedIn social
Go To Top

Joomla! Debug Console

Session

Profile Information

Memory Usage

Database Queries