Everything, Everything

I'm starting to find their articles quite annoying. Their most recent article is this one: Sophos advises online shoppers to use caution this holiday season. Because it's okay to throw caution to the wind the rest of the time? Even worse, check out the final bits of advice:

Sophos offers the following online shopping security recommendations:

Precautions for consumers

• Read website privacy policies and procedures to ensure appropriate measures are in place
• Only buy from reputed sites
• Do not follow links from unsolicited email
• Never enter sensitive information from an internet cafe or machine that you do not know to have a fully up-to-date security policy
• Ensure you have a firewall, patches and anti-virus up to date and running
• Protect your password

Precautions for online shopping sites

• Use HTML encryption technology
• Enlist a firewall
• Limit access to your server to only those who absolutely need it
• Check your system and weblogs for suspicious activity regularly, especially when traffic is high

Where to start? Policies mean nothing unless the website sticks to them. Anyone can say they won't sell off your details and then sell or abuse them anyway - cybercriminals are hardly likely to tell the truth. I think they mean only buy from reputable sites (ones with a good reputation, which is still a bit too generic for my liking), as reputed means "commonly put forth or accepted as true on inconclusive grounds" (e.g. a fake website that looks legitimate?). It's probably a good idea not to follow links from emails, but what if you signed up to the mailing list and received a unique link that gives you a £5 discount on your purchase? I'll skip the AV issue, but a well configured firewall and up to date software is good advice - as is running as a standard or low level user. A large number of problems are caused by users that run as Administrator. And, perhaps it'd be more useful if they told you how to protect your password.

And then it gets worse. What the f**K is HTML encryption? I think they've confused it with a secure HTTP server (where the URLs begin with https://) that uses an additional encryption/authentication layer between the HTTP and TCP. And just because a site has a padlock in the corner or in the address bar, it doesn't mean that consumers can assume it's a legitimate site, and it's possible (although unlikely) that the site is using weaker protocols/ciphers, such as SSLv2 and/or 56-bit ciphers. A firewall is a good idea, again assuming it's configured properly. The "limit access to your server" advice is a bit silly if you're running a web server that's meant to be accessible to consumers across the world, and trying to geolocate users by their IP address to restrict access, for example, to UK shoppers is a bit messy. Checking server logs would be a good idea, but an automated solution might be more useful, you don't want to take a look at your logs on Monday morning if you were hacked the previous Tuesday, or perhaps throughout the weekend when they think there's less chance their activity will be quickly blocked.