Active Web News: Don’t Send Prospects Packing with Poor Web Design.

Possibly Related Posts:

• Bumble and Bumble Shampoo – Free Sample
• Bumble and Bumble Conditioner – SalonSavings.com
• Discontinued Bumble and Bumble Hair Products
• SalonSavings.com Valentines Day Bumble and Bumble Hair Products
• 15 Reasons Why Consumers Will Leave Your eCommerce Site

15 Reasons Why Consumers Will Leave Your eCommerce Site

You can make a safe assumption that the reason I am visiting your online store is because I have an intention to buy something from you. All I need from you is to help me find what I am looking for and then take me from point A (product page) to point B (checkout). I am ready to fork over my money if you show me a clear path. So it is up to you to decide how easy or difficult you want my journey to be. 15 Conversion Hot Spots Don’t Require Registration. Do not force me to register during the checkout process. If I click on checkout, that is usually a safe assumption that I have made a decision to purchase. Please get out of my way so you can take my money as quickly as possible before I change my mind. Don’t present me with unnecessary registration steps or other information that would slow me down. If you want to give me an option to register after the checkout is complete, sure, I will consider it. Write for Humans. Remember that Google is not your target customer – I am. Don’t write your product descriptions or other content containing tons of SEO keywords with a sole purpose to please Google. Sure you need to focus on SEO but the product description has to make sense to customers first. At the end of the day, you might get a good ranking on Google but if consumers don’t understand the content on your site, you will not win. Watch Out-of-stock Items. Don’t let me add something to the cart if later you will tell me that it is out of stock. If you already know that something is out of stock, can you please show that upfront on the product page so we don’t waste each other’s time? Delete Empty Categories. Do you have categories that do not have any products online? Can you please disable those categories so that I don’t have to click those categories, just to find a “No Products Found” message? Clean-up Your Home Page. Just because you have a lot of promotions and products on your site, you don’t have to show all of them on your home page. Please keep the home page clean and focus only on few key promotional or merchandise messages that truly tell a compelling story. If you have more than 100 links on your home page, you are trying too hard. Establish an Arrival Date. It would be nice to know when I will receive an item – not just when you plan to ship it. You know my zip code – you know the delivery times with UPS and FedEx, you know your processing time – so can you please show me a date when I should expect to see the item at my door instead of having me do all guesswork in my head? Don’t Over-recommend. If I add something to the shopping cart, please show me the cart before showing any other recommendations or offers that I might be interested in. Don’t slow me down by showing 10 recommendations before I get to my cart page. I have a short attention span and if I get overwhelmed with too much unnecessary information, I might just leave. Be Careful with Email Addresses. If you take my email address during checkout, please make good use of it. For example, if would be nice of you to follow up few days later to check if the item arrived properly, and if I would be interested in writing a review for the item. I don’t mind writing an honest review – you just have to ask and remind me. Which is a good segue to the next point. Don’t Change Negative Reviews. If I write a negative review about a product, please don’t go out of the way to moderate the review to put a positive spin to my content. Please remember that customer reviews are supposed to be unbiased and any attempt from your side to hide or suppress the negative reviews is a sure way to lose trust with your loyal customers. Disclose Final Price Early-on. Don’t wait until the final step in the checkout to show me the final price including the coupon discounts, taxes and shipping costs. I would like to know that information at the shopping cart page so there are no surprises during the final step. If you need my zip code in the shopping cart page to calculate these costs, just ask me and I will be happy to provide that information to you. Which leads me to the next point. Avoid Duplicate Entries. If I have told you anything about myself such as my zip code, please try to remember it. Don’t make me re-enter that information at the time of checkout. There is a good probability that I will not change that information, but just give me an option to change it later if I need to. Help Customers Reach You. Please don’t try to hide your contact information just because you want to minimize the number of customer service calls. If you have an 800 number hidden somewhere on the site, please display it prominently. Customers need to know upfront that there is an easy way to contact you if something goes wrong with their order. Don’t Ask for Too Much Info. When I am providing my credit card information, you really don’t have to ask me what type of credit card it is because you can figure it out from my credit card number. Just show me the credit card type for confirmation and I will let you know if there is a problem. Simplify Security Checks. While you are thinking about that checkout experience, can you also do something about that Captcha? It is nice to know that you are concerned about our security and want to make sure that I am a human. But for the sake of humanity, please don’t make me decipher that 10-character Captcha image. Just try to keep it simple, if possible. Turn Off Advertising. If you display any AdSense ads on your retail store, can you please turn those off? That sends a mixed message to me as a customer. If you are truly an online retailer, your focus should be on selling products, not making a few bucks from customers who accidentally click on those ads and end up somewhere else. Some of the above points may seem obvious but it is amazing to see even large online retailers who end up building complex checkout processes, overlooking some of these points just because they have a complex business. If you think from customer’s perspective, they really don’t care about complexities in business – they are looking for a simple and intuitive shopping experience.

David Montalvo is the CEO of UnReal Web Marketing LLC . He has achieved over 100,000 top 10 positions for Fortune 500 companies since 1997.

UnReal Website Marketing LLC. All Rights Reserved. – Long Island – New York – 631-891-8536

This message was sent from UnReal Web Marketing to metz83@optonline.net. It was sent from: UnReal Web Marketing, P.O. BOX 519, Mt Sinai, NY 11766. You can modify/update your subscription via the link below. Email Marketing by

Manage your subscription

Share this message with others:   del.icio.us Digg reddit Facebook StumbleUpon

Possibly Related Posts:

• Don’t Send Prospects Packing with Poor Web Design
• Dealing with Identity Theft
• High Performance Vista
• Conversion Rate Exercise: Communicating Value
• Customer Segmentation and SEO

Desktop Computers Notebook Computers Motherboards Hard Drives LCD Monitors Video Cards Digital Cameras Tech Tips Geeks.com

Dealing with Identity Theft By Scott Nesbitt – Sunday, July 12, 2009

It starts off innocuously enough. A few small purchases that you don’t quite remember making appear on your credit card or debit card statement. They look plausible, but you’re busy and will check them out later. Then the real fun begins. Someone racks up a credit card bill of several hundred dollars in a state you’ve never been to. You get a phone call wanting to confirm the purchase of a laptop computer for someone overseas. A bank or finance company starts calling you about payments on a car loan or mortgage that you know nothing about. Welcome to a club that has several million members in the United States alone. If something like that’s happened to you, then you’re the victim of identity theft. If it hasn’t happened to you, then you might want to read this TechTip for advice on how to protect yourself from identity theft. Just what is identity theft anyway? As its name states, identity theft (also called identity fraud) involves someone assuming your identity. Their reason for doing it is pretty easy to understand. They want to get hold of your money (or worse). They want to defraud companies. They want to accumulate cash and goods, on your dime, for personal gain or satisfaction. The key point, and the key danger, of identity theft is that someone is pretending to be you in order to commit a crime. They’re using your name, your Social Security Number (or the equivalent in wherever you live), and maybe even your own financial accounts to do illegal deeds. And identity theft isn’t just limited to taking your money or using your name to defraud. Some perpetrate identity theft for spying, blackmail, drug trafficking, or money laundering. The different forms of identity theft Most cases of identity theft fall into two categories. The first, and best known, is financial identity theft. This involves someone accessing your bank, credit card, and investment accounts. From there, they gradually bleed your money away or just snatch away outright. The other category is criminal identity theft. That’s when someone becomes you. It might be a criminal on the run, or someone who is trying to make a clean break with their past. They assume your identity – including your education and work history – in order to find legitimate work or to build a new life for themselves. How the identity thieves can sting you There are a number of ways that this can happen, both offline and online. In the online world, one of the most popular of these is the use of fraud emails. Some of these emails will alert you to a situation with an account – for example, at a bank, with eBay, or with PayPal. Of course, the email includes a link. You click that link and you’re taken to a Web page that’s a better-than-decent facsimile of a legitimate site. Once there, you’re expected to enter your account and personal information. And you can imagine what happens after that. This sort of thing is easy to spot (as you’ll see soon), but a lot of people do fall for it. Another way identity thieves can catch you is by hijacking a legitimate online merchant’s payment page. You know the one, where you enter your address and credit card information. Unfortunately, that page is one the identity thieves have set up and your information becomes theirs to toy with. In the offline world, it can be quite easy for someone to get information from you. Sometimes, all it takes is a phone call. Many people don’t think twice about answering certain questions. It can be an easy matter for someone to lift documents that contain your vital information. More than a couple of unfortunates have been stung by simply tossing bank statements or pay slips into their garbage or recycling. Some bold thieves will actually steal mail from mailboxes. It’s amazing what information people can glean from your bills or even a letter from the tax man. And let’s not forget about someone lifting your wallet. Far too many people carry far too much identification with themselves, making their wallets a treasure trove of personal information that an identity thief can use. Don’t become a victim There are a number of ways in which you can protect yourself from identity theft. The most important of these is to keep your wits about you. If you’re vigilant, your chances of getting taken are reduced. If you’re disposing of old documents – like pay stubs and bills – don’t throw them out or recycle them. If you can, shred those documents using a cross cut shredder. This type of shredder doesn’t cut paper into strips, but turns it into confetti. A number of these types of shredders can also grind up old credit and bank cards. When at an ATM or making a purchase with a debit card, shield the keypad with your hand or with your wallet. You never know who’s looking over your shoulder. Speaking of wallets, try to lighten your load a little. Don’t carry all of your ID with you. If possible, take only what you need. When doing a secure transaction online (or one that you think is secure), look in the bottom right corner of your Web browser window. You should see a padlock icon. If you double click that icon, a smaller window will open that shows you the security information for the page and site. One way that many Web sites ensure their security is by getting a signed digital certificate. Most sites get their certificates from certificate authorities. Two of the best know certificate authorities are VeriSign and Thwate. In fact, most Web sites use them; you can generally trust sites with certificates from either firm. Earlier, I talked about fraud emails. The easiest way to not be taken in is to read those messages carefully and not to click the links. If you do click a link, remember to check your Web browser’s address bar. The URL won’t be one that you’ll recognize; it will probably be a strange, long, and convoluted address. Remember: if in doubt, don’t click any suspect link or give out your information either online or over the phone. Check the source out. Recently, a friend of mine got a new credit card. He received a strange phone call purporting to be from the bank that issued the card. The call was to confirm an online transaction he’d made. My friend wouldn’t confirm anything, and he called the bank immediately to check this out. It turns out that the call was legitimate. It could have gone the other way, though. What to do if you’re a victim Even if the identity thief has only made a few small, illicit purchases, contact your local or national law enforcement authorities. Get a copy of their report and, if possible, the case number. You may need this information for the next steps. Next, contact your bank, financial institution, or credit card company. Close any accounts that have been compromised. If the identity thief has opened any other accounts in your name, close them if you can. Then, contact all of the credit bureaus in your area. In North America, there are three: TransUnion, EquiFax, and Experian. Let them know that you’ve been the victim of identity theft and that a fraud alert should be applied to your accounts. By doing this, the identity thief will not be able to open a new account; a representative of the financial firm will have to contact you first. In the United States, a key piece of government-issued identification is the Social Security Number. Many other countries have something similar – like the Social Insurance Number in Canada. An identity thief can do a lot of damage if he or she gets hold of that information. In the United States, contact the Social Security Administration (or the equivalent department in your country) to report a theft. If the identity thieves have really been active, it can take a long time for you to clear up the mess. Your credit rating could be damaged, even just temporarily. You’ll face a lot of stress, and probably a number of collection calls and letters. And there’s a good chance that you won’t be able to prosecute the thief. That person may never be caught. Where you can go for more information If you need more information about identity theft and what to do about it, there’s a lot of information available from government departments around the world. In the United States, check out the Web sites of the Federal Trade Commission and the Department of Justice. The Canadian Privacy Commissioner and Minster of Public Safety also have more information. For some reason, Europeans seem to be less susceptible to identity theft. Even so, you can get information on this subject from the European Anti-Fraud Office. Australia has an anti-fraud awareness week, and in New Zealand identity theft is rare but the government has at least one Web page discussing it. Do you have any tips about avoiding identity theft? If so, feel free to leave a comment on this TechTip.

Computer Geeks – Your #1 Source for Computer Parts! Disclaimer: Occasionally we miss something, make a mistake, or don’t cover everything on the topic but we are trying hard to give you the most unbiased and well-written information that we can. This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License. © Copyright 1996-2009 Geeks.com™ All Rights Reserved

Possibly Related Posts:

• Don’t Send Prospects Packing with Poor Web Design
• 15 Reasons Why Consumers Will Leave Your eCommerce Site
• High Performance Vista
• Talk About Outdoor Furniture
• Find Classy Bedroom Furniture

Tip of the Week

High Performance Vista

Microsoft Vista comes with a new set of battery and power plans.  If Vista seems a bit slower than you anticipated it because the default power setting limits the CPU to 50 percent.

For high performance:

• Click Start, Click on Control Panel
• Open the Power Options control panel and change it to High Performance to give push your processor to its top rated speed.

Email questions to Scott@act-li.com

We offer the following services:

Cabling (Data / Phone)
Database Back / Off Site Backup
Data Entry
Custom Data Design
Customer Relationship Management
GIS / Aerials
Home Automation / Security
Network Services
Outlook Web Access (OWA)
Radio Frequency Identification (RFID)
Remote Access
Smart Phones /PDA
Software Training Courses
Technical Support (PC and Business Apple)
Upgrades
Video Security and Surveillance
Web Site / Internet Solutions

Possibly Related Posts:

• Don’t Send Prospects Packing with Poor Web Design
• 15 Reasons Why Consumers Will Leave Your eCommerce Site
• Dealing with Identity Theft
• Talk About Outdoor Furniture
• Find Classy Bedroom Furniture

Possibly Related Posts:

• Don’t Send Prospects Packing with Poor Web Design
• 15 Reasons Why Consumers Will Leave Your eCommerce Site
• Dealing with Identity Theft
• High Performance Vista
• Find Classy Bedroom Furniture

From ultra contemporary to old school classy, people looking for new bedroom furniture have a variety of looks to go for. Irrespective of the look you go for comfort should be your number one priority. However with the kind of beds available at the furniture store Onewayfurniture.com you need not compromise on comfort for style or vice versa.

Those looking for contemporary style furniture will find the collection of modern beds by the company to be very impressive. Amongst the ultra modern sets is the Modloft Monroe Platform Bed with Side Lights & Nightstands. Make the ultimate statement with the unique style and design of this bedroom set. The design is compact yet practical and spacious enough to provide you with ultimate comfort. The low rise slender construction of the bed gives it a sleek look where as the espresso finish lends it class.

The company also produces a host of traditional style bedroom furniture. The Hillsdale Brook land Leather Bed Bedroom Furniture Set in espresso has the traditional square box construction with a simple yet imposing design. The dark colored complimenting dresser and cupboard give your bedroom serial appeal.

Another unique concept to bedroom furniture is that of transitional beds. This is a fusion between traditional designs and modern concepts. The results of this fusion can be a sleigh design bed with a metallic finish giving a totally different look to your bedroom. The source sited above also produces a bedroom sets for children in its collection of Baby Furniture items.

Possibly Related Posts:

• Wood Bar Stools – Free Shipping
• Document Holders by Randmh.com
• Office Supplies – Desk Supplies – Binder Clips
• Furniture Grade Steel Literature Organizer
• Don’t Send Prospects Packing with Poor Web Design

By Bryan Lambert – Sunday, June 14, 2009

On June 3, 2009 Microsoft officially unveiled its latest incarnation of the search engine: Bing! Yes, Bing, as in cherry, as in Crosby as in BING! I found it! Bing is not so much a search engine as it is a “decision engine”. Bing is what Google was 10 years ago, fresh, innovative, and (dare I say it) cool. But how does it stack up to the behemoth of the search engine world? Pretty well actually, and with this Tech Tip I’ll give you FIVE reasons why Bing outshines Google!

ONE – It’s all about the results baby!

Face it, why do more people today use Google than any other search engine out there? In a word, results – pertinent results to what you’re looking for. However, sometimes to get the results you want, you have to wade through a lot of chaff. It’s analogous to dumping a waste can of papers onto the floor and searching for one tiny scrap. With Bing, you get “enhanced results” – what I mean by that is that you get intelligently organized results quickly and efficiently. With many of the search results, you can hover over the right-hand side and get a pop-up window with more information on that particular result. However, along with these results you also will find that you have a plethora of refinement tools to drill down to exactly what you’re looking for. These refinement tools brings us to reason Two.

TWO – The silver platter – that cool left-hand navigation pane

Under the heading of “how could something so simple and elegant be so powerful,” you can now add Bing’s left-hand navigation pane. This pane saves you so many steps in searches that in a short time you’ll wonder how you lived without it. With it, you get your search results categorized, possible related searches, a “reference” pulled from Wikipedia (if one exists), a quick link to images and videos as well your search history – all in one convenient package. Speaking of images and videos, let’s take a look at reasons Three and Four.

THREE and FOUR – Images and Videos done right

Every search engine can search images and videos, and they can mostly come up with what you want – but many times the presentation leaves a lot to be desired. With Bing you get image and video results on steroids. For instance, with the image results it is actually possible to just continually scroll down (instead of hitting next, next, next), and the next set of images are dynamically loaded (they call this the “infinite scroll” feature). Also, with the image results you get some really cool filters (in that nifty left-hand navigation pane) that filter not just by size, but by layout, color, type and “people” (very cool). Hover over an image, and you can also get an option to “show similar images.”

The videos are cool in that if you hover over the video, it starts playing a snippet of it right in the search result box (some have complained about this, but the content filter is set to “moderate safe” by default – turn it off and you see that same kind of “results” you’d see on any other video search engine (just without the auto-playing snippet part)). The videos too have easy to use filters in the left-hand navigation pane such as length, screen size, resolution and source just as the images have. Click on a video and a larger version of it pops to the top of the results page giving you the option to watch it right there, or go to the actual website. It is actually this and other little things that really make Bing shine. Speaking of little things, this brings us to reason Five.

FIVE – The little things

There are so many little cool things that come along with Bing that it is hard to know where to start. From “instant answers” where you can literally type in “traffic” and get your local traffic, to its Local Search (which runs circles around other local search features I’ve seen on other search engines), you’ll be amazed at the usefulness of the Local Search features where you can not only find what you’re looking for, but can get one-click directions and a bird’s eye view. It seems the folks at Microsoft sat down and decided to do the search engine right – or rather decided to bring the search engine, rather, decision engine into the 21st century. All this and I haven’t even touched on the travel or shopping features of Bing. For more information, I’d really recommend checking out Bing’s product guide at http://www.discoverbing.com/.

Final Words

Really, the more you play around with Bing, the more you’ll love it. Now, I know that some of you are thinking that Google fulfills all your search needs and that “Bing is just there to be there” so why bother checking it out. To this I say, “give it a try” (or as Microsoft would say, “Bing and decide”), and you too will find out why Microsoft’s Bing will outshine Google.

Computer Geeks – Your #1 Source for Computer Parts! Disclaimer: Occasionally we miss something, make a mistake, or don’t cover everything on the topic but we are trying hard to give you the most unbiased and well-written information that we can. Computer Geeks 1890 Ord Way Oceanside, CA 92056 | www.GEEKS.com This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 2.5 License. © Copyright 1996-2009 Geeks.com™ All Rights Reserved

Possibly Related Posts:

• Don’t Send Prospects Packing with Poor Web Design
• 15 Reasons Why Consumers Will Leave Your eCommerce Site
• Dealing with Identity Theft
• High Performance Vista
• Talk About Outdoor Furniture

What can be done to make Web browsers
secure while preserving their usability?
BY thomaS WaDLoW anD VLaD GoReLiK
“sealed In a depleted uranium sphere at the bottom of the ocean.” That’s the oft-quoted description of what it takes to make a computer reasonably secure. obviously, in the Internet age or any other, such a machine would be fairly useless as well. We live in interesting times. That computer on your desktop embodies the contradiction that faces a security engineer in the 21st century. It must be kept safe; and a lot of time, effort, and money is spent attempting to do exactly that. firewalls are built to separate that machine from the Internet. Security audits tell us what programs must be deleted and what permissions changed so that the machine cannot be compromised. Virus checkers test all new software loaded on the machine for malicious content. And yet, to make that fortress useful to us we demand that holes be chopped through the walls to permit us to run a Web browser.
We complain if that browser is not given enough access to the rest of the computer. We insist on ease of use and speed, even if it makes all of our other defenses meaningless. And in many cases, we use browsers downloaded from the Internet without precaution, and configured by the owner of the desktop who has no security training or interest. Browsers are at the heart of the Internet experience, and as such they are also at the heart of many of the security problems that plague users and developers alike. the use model is evolving…Key features of early browsers included encryption and cookies, which were fine for the simple uses of the day. These techniques enabled the start of e-commerce, and monetizing the Web was what brought in the rest of the problems.
Attackers who want money go where the money is, and there is money to be had on the Web. Today, users expect far more from a browser. It should be able to handle sophisticated banking and shopping systems, display a wide variety of media, including video, audio, and animation, interact with the network on a micro scale (such as what happens when you move the cursor over a DVD selection in Netflix and see a summary of the movie), and update in as close to real time as possible—all without divulging sensitive information to bad guys or opening the door for attackers. Consider AJAX, also known as Asynchronous JavaScript and XML. A Web page can contain code that establishes a network connection back to a server and conducts a conversation with that server that might bypass any number of security mechanisms integrated into the browser. The growing popularity of AJAX as a user-interface technique means an enterprise network often allows these connections, so that popular sites can function correctly. The underlying mechanism of AJAX (which, despite the name, may not necessarily use JavaScript, XML, or be Asynchronous), is a function called XMLHttpRequest, 6 originally introduced by Microsoft for Internet Explorer, but now supported by Firefox, Safari, Opera and others. XMLHttpRequest allows a part of a Web page to make what is effectively a remote procedure call to a server across the Internet and use the results of that call in the context of the Web page. It is a powerful tool, but one that is open to a number of attacks.
2 Flash, JavaScript, and Java all allow programs written by unknown third parties to run within the browser. Yes, there are sandboxes and safeguards, but as any attacker will tell you, a big step toward penetration is getting the target machine to run your code. …and So is the threat model Early browsers had several major and noteworthy vulnerabilities, but they also had fewer types of attackers. The early attackers tended to be motivated by curiosity or scoring points with their peer groups. Modern browsers must defend against increasingly well-organized criminals who are looking for ways to turn browser vulnerabilities into money. They are aggressive, methodical, and willing to try a variety of attacks to see what works. And then there are those who work in gray areas, not quite violating the law, but pushing the envelope as much as possible to make a few dollars. With more aggressive threats come more aggressive defenders. Security experts wanting to make names for themselves can release vulnerability information about browsers faster than browser developers may be prepared to react. While the roots of this type of disclosure are often driven by noble motives, the results can be devastating if they are not handled properly by all parties. The flip side of early disclosure is the zero-day exploit. In this type of attack, an attacker learns of a flaw in a browser and moves to exploit it and profit from it before the security community has an opportunity to mount a defense. Injection attacks (sometimes known as cross-site scripting, XSS) are when an attacker embeds commands or code in an otherwise legitimate Web request. This might include embedded SQL commands, stack-smashing attempts, in which data is crafted to exploit a programming vulnerability in the command interpreter, HTML injection, in which a post by a user (such as a comment in a blog) contains code intended to be executed by a viewer of that post. Cross-site reference forgery (XSRF) is similar to XSS but it basically steals your cookie from another tab within your browser. This is relatively new, since tabbed browsing has only become popular in the last few years. It’s an interesting demonstration of how a browser feature sometimes amplifies old problems.
One of the reasons Google engineers implemented each tab in a separate process in Chrome was to void XSRF attacks. A similarly named but different attack is the cross-site request forgery, in which, for example, the victim loads an HTML page that references an image whose src has been replaced by a call to another Web site, perhaps one that the victim has an account on. Variations of this attack include such things as mapping networks within the victim’s enterprise for later use by another attack. Add to this threats that are more social and less technical in nature—phishing,5 for example, where a victim might receive a perfectly reasonable email message from a company that he does business with containing a link to a Web site that appears to be legitimate as well. He logs in, and the fake Web site snatches his username and password, which is then used for much less legitimate purposes than he would care for. A phishing scam depends much more on the gullibility of the user than the technology of the browser, but browsers often take much of the blame. There are attacks of this nature based on the mistyping or misidentification of characters in a host name. A simple example of this would be that it is tricky to spot the difference between “google.com” and “googIe.com” (where the lowercase “L” has been replaced by an uppercase “I”) in the sans-serif font so frequently used by browser URL entry fields. Expand that attack to Unicode and internationalization and you have something very painful and difficult to defend against.
Cookies are a long-used mechanism for storing information about a user or a session. They can be stolen, forged, poisoned, hijacked, or abused for denial-ofservice attacks.4 Yet, they remain an essential mechanism for many Web sites. Looking through the list of stored cookies on your browser can be very educational. Similar to browser cookies are Flash Cookies. A regular HTTP cookie has a maximum size of 4KB and can usually be erased from a dialog box within the browser control panel. Flash Cookies, or Local Shared Objects (LSO)s are related to Adobe’s Flash Player. They can store up to 100KB of data, have no expiration date, and normally cannot be deleted by the browser user, though some browser
extensions are becoming available to assist with deleting them. Although Flash is run with a sandbox model, LSOs are stored on the user’s disk and may be used in conjunction with other attacks. In addition to Flash Cookies, the ActionScript language (how one writes a Flash application) supports XMLSockets that give Flash the ability to open network communication sessions. XMLSockets have some imitations—they aren’t permitted to access ports lower than 1024 (where most system services reside), and they are allowed to connect only to the same subdomain where the originating Flash application resides. However, consider the case of a Flash game covertly run by an attacker. The attacker runs a high-numbered proxy on the same site, which can be accessed by XMLSockets from the victim’s machine and redirected anywhere, for any purpose, bypassing XMLSocket limitations. This trick has already been used to unmask users who attempt to use anonymizing proxies to hide their identities.
Clickjacking is a relatively new attack, in which attackers present an apparently reasonable page, such as a Web game, but overlay on top of it a transparent page linked to another service (such as the e-commerce interface for a store at which the victim has an account). By carefully positioning the buttons of the game, the attacker can cause the victim to perform actions from their store account without knowing that they’ve done so.
Security vs. usability
Usability and security have long been at odds with each other in software design. The browser is no exception to that rule. When browsing the Web or downloading files the user constantly needs to make choices about whether to trust a site or the content accessed from that site. Browser approaches to this have evolved over time—for example, browsers used to give a slight warning if you accessed a site with an invalid HTTPS certificate; now most browsers block sites with invalid certificates and make the user figure out how to unblock them. Similar approaches are taken with file downloads. Internet Explorer tends to ask the user several times before opening a downloaded file, especially if the file is not signed. Prompting the user for actions that are legitimate most of the time often creates user fatigue, which makes the user careless in walking the tightrope between software with a “reasonable but not excessive” security posture and a package that is either too open for safety or too closed to be useful. Most browsers today have evolved from the “make the user make the choice” model to the “block and require explicit override action” model. In some cases the security of the browser has had a major impact on Web site design and usability. Browsers present a clear target for identity theft malware, since a lot of personal information flows through the browser at one time or another. This type of malware uses various techniques to steal users’ credentials. One of these techniques is form grabbing—basically hooking the browser’s internal code for sending form data to capture login information before it is encrypted by the SSL layer.
Another technique is to log keyboard strokes to steal credentials when the user is typing information into a browser. These techniques have spawned various attempts by Web site designers to provide more advanced authentication methods, such as multifactor authentication with a hardware token and use of various click-based keyboards to avoid key loggers. In some cases some banks ask the user to authenticate each transaction with a hardware token. Although some of these techniques definitely improve security, they can place a pretty heavy burden on the end user. Another usability feature of the Web browser that has been attacked by malware is the auto-complete functionality. Auto-complete saves the form information in a safe location and presents the user with options for what he typed before into a similar form. Several families of malware, such as the Goldun/Trojan Hearse, used this technique very effectively. The malware cracked the encrypted autocomplete data from the browser and send it back to the central server location without even having to wait for the user to log in to the site.
Given all the vulnerabilities out there and the willingness of attackers to exploit them, you might think that users would be clamoring for more security from their browsers. And some of them do…as long as it doesn’t prevent any of their desired features from working. Let’s start with the browser software itself. From a security engineering perspective, the obvious choice for browser software (or any software) is to ship it in a “locked down” state, with all security features turned on, and let the user or enterprise weaken the security by enabling functions that they want. Consumer software that has done this has generally failed in the marketplace. Consumers want security, but they don’t want to think about it or configure it. If the shipped configuration does what they want, they probably will not alter the configuration much, if at all. So the browser designer faces the Goldilocks problem. Either the porridge is too cold (not usable because of the demands of the security lockdown) or too hot (too easy to abuse because not enough security measures are in place, or are too weak). Designing a configuration that is “just right” is nearly impossible because of evolving threats, uncovered bugs, and differing user tolerances for frustration.
There are a number of documents available that list steps one can take to lock down a Web browser. For example, one of those steps often is something like “Disable JavaScript.” But few people actually ever do that—at least not permanently, because using a browser with JavaScript turned off is annoying, and in many cases prevents you from visiting sites you have legitimate reasons to visit. Cookies, while sometimes flushed to solve a problem, are essential to many Web sites, and having them disabled will prevent a wide range of services from working.
What is a Browser Designer to Do?
Browser developers have been working overtime to try and address some of these issues— and with some success— but it is definitely an uphill battle. Proactive and reactive developers can generate an endless series of software updates. As a responsible defender, your dilemma is that allowing user these untested updates may break applications or even introduce security holes, but not allowing them may leave our enterprise open to even more serious attacks. Distributed management provides some help in this area, but all major browsers are weaker than many defenders would like them to be. Microsoft provides the free Internet Explorer Administration Kit, which sets the bar for enterprise browser deployment and management tools, but that bar is lower than many would desire. FirefoxADM, an open source project for managing collections of Firefox browsers, is far more limited but a step in the right direction.
FrontMotion provides a Web-based tool that allows a defender to create packages with approved software, configuration, and plugins for Firefox. All are available for the Windows platforms only. Firefox and Google’s Chrome browser have implemented “sandboxes,” in which code run by the browser (such as JavaScript or Flash) is run in a compartmentalized area of the program that provides only limited resources for the program to run and whose design is heavily scrutinized for security flaws.
Internet Explorer uses a zone-based security model, in which security features are enabled or disabled depending on what site is being accessed. Under Vista, it runs in what is known as Protected Mode, which limits the operating system privileges that the browser program can exercise. However, open source developers must be especially careful about designing and implementing sandbox systems because their sandbox source code is available to the attacker for study and testing. This is, of course, no surprise to the sandbox developers and one reason why open source sandboxes tend to improve quickly.
Browser developers have come up with several ways to combat phishing attacks as well, primarily heuristics to detect an attempted visit to a fraudulent site, techniques to aggregate lists of and warn about known phishing sites, and augmentation of login security. Injection attacks are most properly defended against at the server, but the victim will often be the browser user, not the server owner. Therefore, browsers may implement policies that hamper the injection attack by limiting where resources may be accessed from within a particular page. Firefox has aggressively pursued a strategy of patching known vulnerabilities and generates updates regularly.
Internet Explorer 7 is a significant improvement over Internet Explorer 6 in this regard, though many more knownbut- unpatched vulnerabilities exist in IE 7 than in Firefox. Chrome seems to be emulating Firefox, though it lacks the mindshare of the other two at the moment so fewer eyeballs are looking critically at it for flaws.
3 Some browser developers are employing and refining their system for detecting, reporting, and responding to security flaws. Mozilla.org, the support and development organization for Firefox, enlists open source developers to assist with code reviews and offers open bug tracking systems so that bugs can be reported and the follow-up tracked. From a defender point-of-view, these efforts are a mixed blessing. Because browser software may be freely downloaded from the Internet by any user, all browsers are suspect. A prudent defender might hope that the browser is sufficiently rugged, but he cannot count on that fact. Desktop *nix systems and Mac OS X allow browser software to be run at a lower permission level than Windows often does, but that safeguard may be circumvented by other user-driven configuration changes.
conclusion
From a network security perspective, a browser is essentially a somewhat condesigntrolled hole in your organization’s firewall that leads to the heart of what it is you are trying to protect. While browser designers do try to limit what attackers can do from within a browser, much of the security relies far too heavily on the browser user, who often has other interests besides security. There are limits to what a browser developer can compensate for, and browser users will not always accept the constraints of security that a browser establishes.
As this issue gets more exposure, browser developers are cooperating to some degree to share strategies for defense. Google has published an excellent Browser Security Handbook1 that compares various browser features and defenses. Attack and defense strategies are coevolving, as are the use and threat models. As always, anybody can break into anything if they have sufficient skill, motivation and opportunity. The job of browser developers, network administrators, and browser users is to modulate those three quantities to minimize the number of successful attacks. And that is a very big job indeed.

Possibly Related Posts:

• Don’t Send Prospects Packing with Poor Web Design
• 15 Reasons Why Consumers Will Leave Your eCommerce Site
• Dealing with Identity Theft
• High Performance Vista
• Talk About Outdoor Furniture

by Lee Koo (ADMIN) – 5/29/09 1:02 PMQuestion:

Is there a life expectancy on external hard drives?

I have been using the same 250GB external hard drive for more than five years. I backup quicken files, thousands of photos and a lot of other files to a portable drive several times a year. I would like to know if it has a life expectancy and should I eventually retire it? Are there maintenance procedures that will enable me to prolong the life of these drives or is it just a matter of luck when it goes south? Thanks so much!

Submitted by: Ted V.

Here are some featured member answers to get you started, but
please read all the advice and suggestions that our
members have contributed to this question.

Life expectancy of external hard drives varies –Submitted by ben_myers
http://forums.cnet.com/5208-7588_102-0.html?messageID=3048631#3048631

Life span? Definitely! –Submitted by Zorched
http://forums.cnet.com/5208-7588_102-0.html?messageID=3048701#3048701

Life expectancy –Submitted by Hforman
http://forums.cnet.com/5208-7588_102-0.html?messageID=3048661#3048661

Do external hard drives have a life expectancy? –Submitted by StephanBer
http://forums.cnet.com/5208-7588_102-0.html?messageID=3048643#3048643

Life of an external hard drive –Submitted by waytron
http://forums.cnet.com/5208-7588_102-0.html?messageID=3048865#3048865

Is there a life expectancy on external hard drives? –Submitted by alswilling
http://forums.cnet.com/5208-7588_102-0.html?messageID=3049941#3049941

If you have additional information and advice for Ted, please click on the reply link and post your answer. Please provide as much detail and information as possible in your answer. If you have proven facts, laboratory researches done, or referenced materials done for this topic please cite those resource and links in your answers to give credit to those folks who deserve it. Thank you!

Possibly Related Posts:

• Don’t Send Prospects Packing with Poor Web Design
• 15 Reasons Why Consumers Will Leave Your eCommerce Site
• Dealing with Identity Theft
• High Performance Vista
• Talk About Outdoor Furniture

by TONI H – 9/16/05 3:56 PMNow that I have piqued your curiosity, I’ll post this also into Grif’s Tips thread……

Vendor-built Computers pitfalls

If you order a computer built by a vendor such as Dell or Gateway or HP (or if you purchase one off the shelf from Wal-Mart), you are getting pretty good systems for the money, and I don’t fault you for getting your systems that way rather than custom home-built or custom built at a local shop where you can tell the vendor exactly what you want and expect to get.

However, there are pitfalls to those systems that you need to be aware of and protect yourself from. Here are a few of things you can expect and not be able to change.

1. Vendors will create their own installation disk called a Master/Restore/Recovery disk and it will include everything on one cd…….your Windows version, all drivers for the computer built, special programs as a ‘bonus’, propaganda advertising hidden as tours, tutorials, a lite versions of programs that are limited in function in the hopes that you will upgrade to full-featured programs for more money, spam/spyware that phone home behind your back when you’re on the net that track your surfing, antivirus programs that are trial/demo versions only but unless you read this carefully you will be under the assumption that you don’t ever have to upgrade/renew and that you got this ‘bonus’ as a freebie just because they like you, and more than likely you will have an extra partition created that holds restore/recovery information with a shortcut icon to it on your desktop so if you need to reinstall a file, you can use that shortcut to do so. The reason for this is that if you can use the shortcut to replace/restore a file or add a component, you won’t have to use the Master/Restore/Recovery disk which normally will automatically format the drive and start you back all over to where the system was the day you got it (and wipe out all the stuff on the harddrive in the process causing you to lose all your files before you have backed them up).

2. Many vendor’s disks are PROPRIETARY to the computer built at that time. If you replace ANY of the hardware (including getting a new harddrive or adding ram), the cd will NOT work to restore/format the drive to start over on a clean install because the hardware has changed from what the cd expects it to be. In that case, you are stuck in a dark and scary place knowing you have a system that has been formatted without any way to get it back up and running again. You have the option of saving your old hardware and temporarily putting it back in (or removing extra ram you installed), getting the system back up and running, then removing the old hardware again or adding your ram back in and going from there…….this is a huge pain in the butt and inconvenient and unfair as all get out. But it also means that you may panic and take the machine back to where it came from (ship to Dell/Gateway/local vendor but never Wal-Mart) and paying somebody else to ‘fix’ it for you when you shouldn’t have to do this.

So what can you do to protect yourself? Here are a few ideas.

1. First and foremost………as soon as you get your system home and set up, pop in a blank cd and burn two or three copies of the vendor cd immediately. If you should EVER lose that original, you will be S-O-L trying to get a new one from the vendor or you will have to wait a long time to get it or you will pay for it dearly, when you’ve already paid for it once. ALWAYS WRITE DOWN THE PRODUCT CODE KEY FOR THE WINDOWS INSTALLATION….TAPE IT TO YOUR COMPUTER, WRITE IT ON THE CD ITSELF, WRITE IT ON THE CD JEWEL CASE. Cover your butt because if you take it back to a shop somewhere and forget to bring your own cd and code key, they will use an OEM cd from the shop and the product code key will be THEIRS and not yours. You might not be able to activate XP if they use a temporary setup at their shop and it expires after 30 days.

2. Always assume that vendors and ISP providers are going to LIE to you. They figure if you don’t know enough about computers that you brought the system to them to fix it in the first place, they can get away with telling you/selling you anything….and if your modem can’t connect, it will ALWAYS be your fault and not a problem with their servers at their end. You must have messed with the settings or got hijacked is what you will be told, in addition to being told to ‘bring it in and we’ll set it back up for you’…….and it will cost you a minimum of $50 for that ‘service’.

3. Insist when ordering your computer to be built that they give you SEPARATE installation disks for everything they are going to install. That means a Windows install disk, drivers disks for each piece of hardware, and install cd’s for all programs they have installed. It costs them 20 cents for a cd and about two minutes to burn each one….tell them you will pay an extra $25 to get separate cd’s. Most will do this for you…..but people don’t realize they have the right to demand it so the subject never comes up.

4. Insist that they give you a MOTHERBOARD manual, not just a crappy user manual that gives you a tutorial about hooking up your speakers/monitor/keyboard/mouse to the case when you bring it home. A motherboard manual will tell you everything you need to know about that board and what it is capable of being upgraded to later on, and if you have on-board sound or graphics rather than separate cards inside the case. Also insist on getting the motherboard drivers cd so you will have them handy should you format the drive to start over.

5. Burn two or three copies of every cd you get and use the COPIES to do your installations with later on. Save the originals in a safe place so if the copy goes bad/gets scratched, you can burn more copies from the original.

6. If you have the extra money to spend while ordering your computer, and if the vendor says he can’t give you separate disks for everything, tell him you want an OEM full or update install version of the Windows at the very least. This may cost you an extra hundred or so, but with it you will have the choice later on of downloading newest drivers for all of your hardware and burning it all to a cd including motherboard drivers, and then if you want to start from scratch without using the vendor specific cd, you can install everything separately yourself….and save money in the long run. The update cd has exactly the same information on it as the full version and will only ask you to prove via the installation that you have another version of windows that makes you eligible for the update. Inserting an old W98/ME cd into the drive when asked for it gives you that proof. The rule has always been that if you buy a piece of hardware from a vendor (and a system qualifies), you can get an OEM version of Windows……so get one….and make sure they give you the Product Code Key that goes with it.

7. Now that you have protected yourself and become more knowledgeable about your rights as a buyer, have a good time with the new toy.

TONI

Possibly Related Posts:

• Don’t Send Prospects Packing with Poor Web Design
• 15 Reasons Why Consumers Will Leave Your eCommerce Site
• Dealing with Identity Theft
• High Performance Vista
• Talk About Outdoor Furniture