Deprecated: Joomla\Input\Input implements the Serializable interface, which is deprecated. Implement __serialize() and __unserialize() instead (or in addition, if support for old PHP versions is necessary) in /homepages/13/d380392445/htdocs/Jlive/libraries/vendor/joomla/input/src/Input.php on line 41

Deprecated: Return type of Joomla\Input\Input::count() should either be compatible with Countable::count(): int, or the #[\ReturnTypeWillChange] attribute should be used to temporarily suppress the notice in /homepages/13/d380392445/htdocs/Jlive/libraries/vendor/joomla/input/src/Input.php on line 170

Deprecated: Joomla\CMS\Input\Input implements the Serializable interface, which is deprecated. Implement __serialize() and __unserialize() instead (or in addition, if support for old PHP versions is necessary) in /homepages/13/d380392445/htdocs/Jlive/libraries/src/Input/Input.php on line 31

Deprecated: Joomla\CMS\Input\Cookie implements the Serializable interface, which is deprecated. Implement __serialize() and __unserialize() instead (or in addition, if support for old PHP versions is necessary) in /homepages/13/d380392445/htdocs/Jlive/libraries/src/Input/Cookie.php on line 21

Deprecated: str_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated in /homepages/13/d380392445/htdocs/Jlive/libraries/src/Uri/Uri.php on line 141
Privacy - Macrotone Blogs

Macrotone Blogs

Macrotone blogs upon Joomla, our products and other matters.

The Tor Project

Mentioned the Tor Project in a recent post so decided to expand a little upon the topic. 

Tor is free software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis.

It is a browser that exists on your machine, but is not installed as such, so can be placed on a USB key and used as a remote app.  Its’ purpose is to anonymise your web communications by bouncing then around a distributed network of relays all around the world:  it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location.

Useful for accessing sites that may be blocked by you ISP for what ever reason.

HTTPS Everywhere a browser add-in



Came across this some time ago but now seems an appropriate time to mention it, especially with the on-going ‘mania’ with web security.

HTTPS Everywhere is a Firefox and Chrome extension that encrypts your communications with many major websites, making your browsing more secure.  It is with a one-click installation,which can  seriously increase your security on over 1,400 web sites by encrypting your connection.

Many sites, like Gmail (and Facebook, with caveats) have options that let you browse with HTTPS always turned on, but the HTTPS Everywhere extension makes this simpler.  Instead of turning it on for individual sites, HTTPS Everywhere will automatically routes all your data through a secure connection on any of its 1,400 supported web sites, keeping your information safe and away from prying eyes—in short, it's an extension everyone should have installed.

Essentially a win win situation.  Unfortunately not available for IE, Safari and other browsers except Firefox and Chrome.   

Three Strokes and you are out

I have previously written about Spam entries on the web site and their elimination, but now I turn to 'Invalid Login attempts'.

I have been watching these with interest for a few weeks, and it is particularly interesting to see where they originate from.

Like the Spam entries a lot of these seem to originate from the Far East.  I am currently adopting a policy of immediately blocking 'Administrator Login attempts'.  No quarter given, I can think of no valid reasons why they should be tried by anyone other than those authorised to do so.

Turning to normal login attempts I have a policy of seeing how many different user names are tried from a specific IP address.  Once they have tried 3 different ones I immediately block them.  I must admit I am building up quite a long list.  Perhaps I should generate a graphical display of the souces, it could be quite interesting to see, and watch how it changes over time.

Given a single host country as being the source of a lot of these attempts, one could always block all the IP addresses assigned to that specific country but it does seem like 'using a sledge hammer to crack a nut' approach.  Possibly I will come round to that approach eventually.

The one single thing that I have not yet investigated is how accurate the IP address actually is.  Programs such as 'tor' generate anonymity of the IP address so do we actually know where they come from at all?  If its' use became widespread blocking of IP's might be a little bit of a waste of time anyway!

 

LinkedIn Password Check to see if it was compromised

I see that Mashable has announced that LastPass has released a tool to allow users to check if their password was one of those compromised in the recent hack incident.

Being very cynical I wonder why anyone would want to use a tool such as this, since it seem much more sensible to just assume the password has been compromised and change it straight away.

The article suggests, and I tend to agree that the use of a ‘password management tool’ might also be a good idea.  I personally use one to keep track of all the passwords that I use on all the sites I visit.  That way I can use a different (automatically generated) password on each site, and all I have to do is remember the password to get into the password manager, so that I can copy and paste the appropriate password when I need it.  Of course LastPass has released this ‘tool’ to promote sales of its own product, which is very understandable but also is very opportunistic.

I would suggest that rather than use such a tool that LinkedIn user just change this password whether it is compromised or not.  The old saying being ‘Better safe than sorry!’.

Macrotone Web Site Cookies

Cookies Overview

Cookies are small text files that are placed on your computer by websites that you visit.   They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

The table below explains the cookies we use and why.  View our Privacy Policy to learn more about cookies.

First Party Cookies

Cookie Name Purpose More info
Google Analytics __utma
__utmb
__utmc
__utmz
These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. Disallowing the use of these cookies prevents us from accurately analysing visitor numbers and visitors trends.
Click here for more information on Google Analytics and the Cookies it uses.
Macrotone Consulting Web site bb2_screener_

This cookie is used by Bad Behavior  to ensure the security of the site and each visitor’s session.

This cookie is believed to be exempt from the regulation because it is a site security cookie meant to help comply with the seventh data protection principle.

 
 

‘encrypted name’

Encrypted session cookie used by the web site to track the visitor.  Both the name and the value are encrypted.

Expires at the end of the session.

The session cookie name is an MD5 hash of logged in username (if logged in),  ip address, and some other info. 
The names and values are to all extents meaningless. 
In addition to the session cookie, if you have set the "remember me" flag there is also a remember me cookie saved with an encrypted version of your username and password.

  cookieAcceptanceCookie Indicates acceptance of Cookies policy.  Created when visitor has accepted cookie policy.

 

Third Party Cookies

Cookie Name Purpose More info
Twitter 'Tweet' button unique id pid This cookie is set by twitter.com to save a unique anonymous id for each website visitor.
Only present if Twitter is used on the site.

Please visit twitter.com to find out more. To delete this cookie you must manually delete this via your web browser settings.

PECR, ICO cookies regulations

The new Privacy and Electronic Communications Regulations (PECR), announced by the Information Commissioner’s Office (ICO) in 2011, comes into effect on 26th May 2012.  In advance of the ICO cookies compliance date, organisations are expected to take appropriate steps to be compliant, which include making proactive changes to their websites.

We have blogged about this topic before and reference should be made to the official EU cookie compliance guide (registration required) which contains news and advice for organisations in Europe and around the world for complying with the cookie law.

The ICO provides specific guidance on PECR compliance.  However this is not all that clear (to me at least), so the absence of clear guidance on cookie compliance, and the range of practical difficulties that will be encountered in determining what to do with each identified cookie, may lead many website operators to struggle with the compliance process.

Continue reading
Go To Top

Joomla! Debug Console

Session

Profile Information

Memory Usage

Database Queries