Cenzic 232 Patent
Paid Advertising
web application security lab

Archive for December, 2008

ToS Abuse Abuse

Tuesday, December 16th, 2008

Sorry I haven’t posted in a while. Not for lack of wanting to, but alas, the real world keeps pulling me away from the fun stuff. Maybe I’ll get a chance to post more over the holiday. No the title of this post isn’t a typo, I actually just wanted to spend some time iterating this case regarding the Megan Meier case about Cyberbullying and what that means for the average consumer. Like most cyber law I’ve come across, it’s not good.

Basically the verdict is that any violations of ToS can earn you jail time and fines. Yup, it’s a felony. So now, let’s put some haXor filters on that decision and talk about other consequences. Firstly, let’s look at Google’s ToS:

2.3 You may not use the Services and may not accept the Terms if (a) you are not of legal age to form a binding contract with Google, or (b) you are a person barred from receiving the Services under the laws of the United States or other countries including the country in which you are resident or from which you use the Services.

So if you are under eighteen and you DO you use Google, does that mean you committed a federal crime? And if so can you be tried as an adult, or do your parents take the rap? Or does your upstream for letting you use Google in the first place? Okay, that’s funky, but what about the fact that Google’s search engine is actually built into Firefox for domains typos? Does that mean if you typo a domain and you are underage you are committing a crime? How about those search boxes on everyone’s website that use Google? What about clicking on ads? Yah…

So, there’s a few ways to force people to commit crimes it seems. By creating hard to find TOS (Google’s isn’t on their front page, I might ad) and confusing language, it appears you can convict anyone of just about anything unless they really take the time to read your documents. That is, of course, unless your TOS strictly prohibits the reading of any part of their website. What about CSRF TOS abuse? Yah, you too can rickroll your friends right into the pokey. Believe it or not I’m actually not picking on Google here. They are just one of a million websites that can get you arrested for legal minutia. This is just a stupid law. Maybe the woman does deserve some jail time for what she did, but not for violating TOS - which she never even read. Her, along with every other MySpace user.

Browser Power Consumption

Monday, December 1st, 2008

This isn’t like most the other posts I do on here since it’s only tangentially security related, but it was a fun experiment that we spent a few days working on over the last few weeks. We were researching “green” browsing, and found that certain client side internet technologies, like Flash and JavaScript, to name a few, were the worst in terms of power consumption. For anyone interested in this topic feel free to review the paper here.

For those of you who don’t have time to read the whole thing, the jist is that Noscript and Adblock Plus do a very good job of reducing the power consumption of the least “green” websites. Just another reason to use them! I don’t consider myself to be much in the way of a conservationist, but stuff like this fascinates me since I live so close to the browser world. I hope everyone had a good Thanksgiving, for those in the US!