Comments on: Who says safe computing must remain a pipe dream?

Web surfing gets riskier all the time. Computer security guru Bruce Schneier outlines a 12-step plan to protect yourself.

get free av, always good to have

av good to have b/c u never kan tell!!!!! charlene must mean cheap in french or something but dun wurrie b/c u kan git freeee av sofware todaay! www.grisoft.com
sav lot uv $$$$$$$$$ n' stay safe

p.s. gud lucks w/ ur worms

Online Banking

Not using online banking does not mean your account is safe.

Good call on insisting that one's bank use SSL exclusively for any page involving account info. And as stated, the backend servers need attention as well.

"Secure Sockets Layer (SSL) encryption does not provide any assurance that the vendor is trustworthy or that its database of customer information is secure."

Just because you don't access your account online doesn't mean it isn't on the same backend database server of customers that do bank online. Any weakness to that database server puts your account at risk just as much as anybody's who is using online banking. In simple terms your account might be accessible online(maybe not easily) wether you access it that way or not.

Debit Cards....etc.

A.B. is right. Debit cards are just as good as Credit cards. In regards to fraud...this card will give you the same benefits.

As far as deleting the command.com and cmd.exe files go...why even bother if they only regenerate themselves! Was so silly for him to even mention this. Sheesh!

HTML links in messages

"Never click links in e-mail unless you're sure about the e-mail; copy and paste the link into your browser instead. Don't use Outlook or Outlook Express."

Hmm, as I sit here reading a link that was posted in the weekly SANS Newsbites update (and marvel at the concept of removing the one truly useful feature of Windows - the command line interface), I wonder about living in a world where far too much data is sent so rapidly to so many people, but so few turn it into information...

What actual difference to the average Windows newbie is there between a link that appears in a non-HTML e-mail (Outlook 2003 actually has a 'read everything as plain text' switch that's off by default - but at least it's there), and dropping it into their browser - almost undoubtedly Internet Explorer? Unless Microsoft is bundling Firefox into Windows XP OEM versions now?

Great artcile, but...

Can anyone explain why, in order to sign up to CNet, and subsequently post this comment, I was expected to provide personal and professional details in the clear?

Firefox has this excellent feature that turns the address bar yellow when the page is encrypted, and it stayed white as snow on the registration page...

In other words, I agree wholeheartedly with many of Bruce's suggetsions, particluarly the one about lying if you're uncomfortable giving out personal details. Oh, and to all those 'people' trashing Bruce, his hair style &c, allow me to lower myself to your level: learn to formulate an argument, losers.

Schneier is way off-base

The purpose of this article, and its predecessor, "to give home users concrete actions they could take to improve security" is a noble endeavor, but it was not fulfilled in this article.

A home PC is a productivity tool and an entertainment center, and asking that users disable/uninstall/avoid all programs and features of the PC that make it easy and enjoyable to use comes from an elitist attitude that the PC is far too complicated for the average user to operate securely and responsibly. This is EXACTLY the attitude that has previously caused Microsoft so many problems with security, in order to make the PC full-featured and user-friendly, Microsoft had opted for default security settings that were extremely too low, under the assumption that users cannot be educated as to how to loosen security settings to enable features that they want and/or need. Microsoft is currently making an effort to change this strategy (look at Windows XP SP2, with stricter default settings to see the new trend from MS) by providing more intuitive user interfaces to security settings.

Absolute computer security is IMPOSSIBLE unless the computer is NEVER connected to a network, has no way of inserting removable media, and is contained in a locked room, therefore the thrust of any article attempting to give users security advice on PCs that connect to the Internet MUST explain the concept of balancing security and functionality, educating them as to potential risks associated with their actions and allowing them to make informed decisions in this regard.

This strategy seems to work well with those home users (friends and family) I advise, although I will admit that often it takes that first virus/trojan/spy-ware to drive the point home.

[adaviel]

Cookies are your friend

Cookies have had a bad rap for years - but
they can't execute code or (on patched systems) leak
information to third parties. What they do is let
a website recognize you as a previous visitor.
This is a good thing - it protects you from phishing sites. The real site says "welcome back Joe; here
are your favourite topics" and the bogus one does
not, because the domain in the cookie does not match and your browser does not send it.

More cookies! More personalization ! Copying
branding and look/feel is too easy on the Web.
If I turn my bank's site green, I'm not going to
so easily fall for a blue clone.

(client-side SSL certificates would be better
than cookies, but I only know one site that tried
that (BC Hydro) - too complicated for most people,
I think, installing certificates etc.)

Andrew

Don't Delete Windows files!!

In this article "Operating Systems," it says, "If you must use Windows...And delet the files "command.com" and "cmd.exe." I am looking for an explanation for this from the author because this has disabled my computer until I can find replacement files or I will have to pay to have the date retrieved (I have no restore disks).

[Ubber geek]

looking for an explanation

http://www.analogstereo.com/cadillac_owners_manual.htm

[Nemesis_MK2]

Whoa your advice is gona Skrew peoples machines

Hi Everyone

Ok i started off reading your ideas, in the begining
i was thinking "This guys good...."

Then it fell apart :S

"The best way to destroy CD-Rs is to microwave them on high for five seconds."
- Great idea, if you want a broken microwave

"Run them through better shredders"
- Thats gona break the "better" shredder

"Don't use Microsoft Windows"
- I sound piece of advice (Good)

"Keeping your applications patched is important,
but don't lose sleep over it."
- Sounds like you do!!!



"And delete the files "command.com" and "cmd.exe."
- You Really Dont want to do that. A lot of
programs but mainly installers are going to
roll up and die. Not to mention programs to
figure out why things arnt working like
tracert + ping.

"Don't use Microsoft Internet Explorer"
- Another good idea. I personaly use Firefox for
internet + Thunderbird for email. Get at
http://www.mozilla.org/

"Create long random passwords and write them down"
- Urm im not a genius in that department but i
would have thought that is just a bit stupid

"Turn off HTML e-mail"
- We are talking about normal users. This may be
valid if we are talking about a normal poeple.
When they get there next email and it looks
like crap they aint gona be thinking "im dam
good, they cant get me" are they?

"He is one of the world's foremost security
experts."
- Sorry mate, dont bielive it. Few more years
as a school Techy and maybe.... :)


Note:
Some of the advice he gave is good. Like using
seperate firewall insted of the normal crud that
comes with pc's today is good. Also attachments
are to be wary of. Now be carefull becouse im
about to shout

<------DO NOT DELETE CMD.COM OR COMMAND.EXE------>