Category Archives: tech

First off: I really like Archie Mcphee. They have awesome, fun stuff and you should go there right now and buy a cool gift for someone for the upcoming Christmas season. But I found a Web security expert there who graduated from WTF University.

A few months back, I attempted to purchase a gift certificate from Archee McPhee’s wonderful online store, McPhee.com. In the middle of filling out the form, formerly located at http://mcphee.com/info/gc.html, I noticed that it had fields for credit card information; however, a quick glance at the URL showed me that there was no SSL connection, and thus any info I’d submit would’ve been in the clear for any enterprising person to snatch. So I started a conversation with Mr. Archee McPhee, who served as a very helpful and friendly go-between for me and their IT person. After explaining to their IT person that credit card information submitted via plain old port 80 HTTP is as naked as a newborn, the IT person replied thusly:

“the gc buy page is NOT secure, in that it doesn’t use SSL, but in this case it doesn’t matter. this particular page kicks off a script on the server which then transfers the information to us via an encrypted email. no credit card information is ever passed on via HTTP, therefore the SSL certificate doesn’t come into play. A sniffer would have to be running on our actual server, since no internet traffic is generated by the form post. In fact, the gc.html page does not even touch the cookie.”

Those of you who are familiar with how the web works will see the flaws in this logic right away. Basically, it’s like a waiter at a restaurant putting my credit card information in their protected safe while taping a copy of the information to the front door.

Thankfully, they have taken down their online gift certificate ordering page. Hopefully they will put up a secure form soon so I can resume giving the gift of bacon strip bandages, bobblehead Jesus dolls, and avenging unicorn playsets. Despite my experience, I still highly recommend Archie McPhee – don’t let this post stop you from buying stuff from them!

And here is an interesting related post from spugbrap.

Tonight, I was surprised to find that BoingBoing, one of my favorite sites, posted my submission about the audio recordings I made of “phone phreaking” (a.k.a., phone hacking) back when I was a troublemaking teen. The recordings are a snapshot of a seemingly by-gone age of hacker culture when it existed primarily in BBSes and compromised voice mail box systems. I kind of miss those days. My Apple //c’s 2400 baud modem was a speed demon!

Many, many thanks to Jason Scott of Textfiles.com and BBSDocumentary.com for his gracious support and efforts with hosting and cataloging my recordings. Be sure to visit his sites and see all of the wonderful work he has done to preserve computing history.

Link

Update: I just wanted to post a pic of the type of recording device I used to obtain these recordings.

Prior to purchasing it, I spent a lot of time scribbling down on paper the codes and numbers I heard on the voice mail boxes. Some of the phreakers spoke too quickly, so I bought the recorder in an effort to keep up. It was crude but very effective.