Password Security and Schools

For those who don’t know, when attackers successfully breach a system, they often share the information they find publicly on the internet. For those on the illegal side of Information Security, this awards them the satisfaction of adding another notch on the scoreboard and further shames those who have poor security. For people like me on the legal side, we receive the ability to gather passwords used in the real world and analyze commonalities, variations and patterns. For this reason, I have several automatic searches that notify me when certain information gets leaked.

Recently, I was alerted to a situation that occurred at the George Washington Middle School in Ridgewood, New Jersey. I won’t link to the actual leaked data, but suffice to say it contains enough administrative information to access their systems. I did not verify this to the point of logging in, but it certainly looks correct and the leak has already been plugged, thus illustrating the sensitivity of the information revealed. Besides the data mentioned above, the leak also contained usernames and passwords for 246 sixth graders.

You’d think with 246 young students, you’d see 200, perhaps even 225 unique passwords, right? And if default passwords were created for them by a network administrator, you’d hope all 246 were unique. When analyzing the data, however, there were only 34 unique passwords. 34!

Here they are:

glasses = 13 (5.28%) finish = 12 (4.88%) button = 12 (4.88%) dinner = 12 (4.88%) oranges = 12 (4.88%) apples = 12 (4.88%) letter = 12 (4.88%) stormy = 12 (4.88%) gentle = 11 (4.47%) cupcake = 11 (4.47%) winter = 11 (4.47%) butter = 11 (4.47%) carpet = 11 (4.47%) joyful = 11 (4.47%) summer = 10 (4.07%) middle = 10 (4.07%) friday = 10 (4.07%) person = 10 (4.07%) football = 10 (4.07%) people = 10 (4.07%) soccer = 10 (4.07%)

butter32 = 1 (0.41%) butter27 = 1 (0.41%) dinner20 = 1 (0.41%) letter38 = 1 (0.41%) summer17 = 1 (0.41%) summer83 = 1 (0.41%) winter34 = 1 (0.41%) apples74 = 1 (0.41%) letter28 = 1 (0.41%) Password = 1 (0.41%) summer22 = 1 (0.41%) letter48 = 1 (0.41%) winter64 = 1 (0.41%)

Note the right hand column. Those are the passwords that are truly unique. This means that of 246 passwords, only 13 of them are not like the others. Of those 13, only one wasn’t based on the shared list. And even that one was the always original “Password.”

In all the analyses I’ve done, this is by far the worst.  There are a handful of possible scenarios here. Ignoring the possibility this is completely fabricated (the usernames of the children make that seem somewhat unlikely), this is either a set of passwords that were generated for children or by children. Given how evenly matched the passwords are in distribution, it seems more likely there was a list of 21 “default” passwords that were generated and then the students were asked to change them. Given the passwords on the right hand column, it seems as though the instructions were “add two numbers to the end of your password to make it secure.”  The password of “Password” matches a username of “Username,” so it’s probably a header or a default value and can be ignored.

So, what’s wrong here?

First, selecting passwords in this way means if someone knew their password and wanted to try to get into other accounts, they’d be able to get into at least 9 other accounts and possibly as many as 14 … and that’s with doing no work at all. If you look at word pairs you get summer/winter, apples/oranges and soccer/football. This raises the number of breached accounts with inside knowledge to 25. Now, if you decided to attack this system with a default word list, it would take about a day to get hits on most of these. If you had a list of usernames, you could easily gain access to every account on this list in a day.  In some systems, it would take as little as a minute to crack each account.

So no one expects sixth graders to be security geniuses, but sad to say, habits get set early. Assuming the right hand column contains passwords that people changed, only 12 students changed their passwords as instructed. If we assume they were given instructions, this means we can expect 4.88% of people to follow directions. If personal experience indicates anything, sixth graders are even more likely to follow directions than adults, so in an average organization, we can assume less than 5% of people will follow best practices … and they’ll probably do the bare minimum required of them.

Now take a minute and think what this would have looked like if the following changes were made to the system:

• Users are assigned completely random passwords
• The system required passwords to be at least 12 characters long.
• The system required passwords to have a mix of upper case, lower case, numbers and punctuation

What would happen?  First, the student would probably write his or her password down somewhere. Now that code is as safe as a locker and/or the student’s resistance to bullying.  Maybe there’s a better way.

What if the system were set up to allow users to register themselves and had a password complexity rule. Suppose it had to hit a specific score of something like 100, where the scoring worked this way:

• base starts at 0
• Upper case character base+10
• Lower case character = base+10
• Number = base+10
• Punctuation = base+10
• Space character = base+10
• Score = base * length of base

If someone wanted to use a basic word like “winter,” the system wouldn’t accept the password. “Zoologists” on the other hand, would be accepted. If you wanted something shorter, you could go with “like2″ to obtain your required score of 100 (a base of 20 * 5). This is the basic idea of password scoring. You could decide for yourself what metrics to use, but by raising the threshold score and weighting various characters differently, people are driven to select their own passwords.

Using the rules above, suppose you wanted a specific score of 1000. “Jooxiepa8da X1Zaode!” would work, but so would “Ask not what you can do for your country.”  Which is easier to remember?

This is how you generate passwords to meet an arbitrary security threshold that are easy to remember and hard to crack. Since people don’t follow directions (5% change rate) and write down hard things to remember, this is one of the best systems you can implement. Sure, multifactor systems are better, but I don’t think sixth graders would be very good at keeping track of their magic “log me on” device. So instead of teaching them horrible password security from an early age, maybe we should implement a system that understands that humans, of whatever age, are human.

In fact, maybe we should do this in business too.

 

 

(This article original posted at the RJS Insider)

Angry Birds and Security

There are many exciting projects going on at my new company, so when I started this post I thought I might talk about the new security website we’re building or how we’re expanding our security offerings in 2012. But then I realized it’s December and December blog reading should be fun… so you get a post about improving your security with strategy lessons taken from Angry Birds!

In the world of Angry Birds, we have a small group of birds that are serially preyed upon by a kleptocratic monarchy of green pigs. In this world, the pigs steal the birds’ eggs and hide them in poorly-constructed shelters while the birds fling themselves at the pigs in efforts of destruction. Despite this vicious onslaught perpetrated by the birds, the pigs continue in their egg thievery, thereby allowing for a continuing series of episodes.

Clearly, there is room for improvement in terms of both offense and defense.

The Pigs

Let’s start by analyzing the Pig Empire. Their goal is to obtain eggs. It is implied they are for eating, raising the uncomfortable question as to where the pigs get their bacon. However, they are inefficient. If they were to take a lesson or two from real-life attackers, they would change their operations in the following ways:

1) Preparation

The root of their’ constant downfall is they expend insufficient effort on shelter construction. Even a cursory inspection of history would indicate a high likelihood of retaliatory avian attack, so it would be wise to prepare. The average shelter is shabbily built and falls to a mere handful of birds. If the pigs focused on quality over quantity, they could invest in sturdier materials and protect far more pigs. Building defenses prior to egg theft would result in a much more successful attack as well.

2) Planning

Another problem facing the pigs is the birds attack using a massive slingshot. I presume this provides additional impact force, but it does introduce a point of weakness. Modern attackers often focus on crippling their target’s ability to retaliate. In other words, if the pigs simply stole the slingshots when they stole the eggs, the birds would be seriously hampered in their efforts to counter-attack.

3) Sacrificial Hierarchy

It appears as though the pigs exist within a hierarchy consisting of a large king pig, a handful of mature leader pigs, some adult pigs and a large number of little pigs (that presumably cry “wee wee wee” all the way home). Malware teams have similar hierarchies, with the people funding development at the top, developers and project leaders below them, marketers below that and finally, those responsible for smuggling the money from your bank account overseas. If the pigs were to learn from this, they would hide their king and leaders in the best shelters possible, well out of reach of the birds, and draw their fire with an array of poorly defended little pigs. This structure allows for organizational continuity favoring the pigs and causes the birds to burn their resources inefficiently.

Common flaw of pig-based construction

A more secure design

The Birds

The birds seem to be structured as a loose confederation. Much in the way business owners band together to discuss and develop shared defenses, birds of more than one feather collaborate to combat the pigs’ designs. Just as there is room for improvement on the part of the pigs, there are areas where the birds could learn from the advice we give our clients as well.

1) Reduce Scope

First of all, the birds face the fundamental problem of constantly losing their eggs. The easiest way to protect against fundamental issues is to narrow the scope. If you’re protecting credit cards or health records, this means identifying the data and centralizing it for better protection. Now, in the case of eggs, there is clearly some risk from putting all one’s eggs in the same basket, but there is no rule that scope has to be limited that far. It could be limited to two or even three baskets. The key is to limit the scope as far as you can and then to boost the defenses around that area.

2) Improved Retaliation

Surprisingly, while the world of Angry Birds has a great many birds, none of them seem to be able to fly. This, as noted earlier, places them at significant risk from the loss of their slingshot. It also means their attacks must all originate from a single point. In the business world, we have several areas from which we can detect and respond to attacks. We detect attacks with technology, forward issues to security teams and law enforcement and, where needed, involve a judicial system. Similarly, an avian attack should be mounted from numerous locations. It should not require a specific bird attack from the East. Any flight-capabable bird should be able to respond to attack.

3) Agility

Agile security involves being aware of your environment, your capabilities and your attackers’ capabilities. You can then make defense plans and execute quickly in the case of attack. There are times when the appropriate response is to tighten security, others when one should involve law enforcement and still others where it makes sense to allow the attack and learn as much from it as you can.

In the case of the birds, while they seem to be masters of resource utilization (expending minimum force to achieve their goals), there is still room for improvement. Their technique works because they face an enemy that fails to adapt. If this ever changes though, it would be impossible to regain the eggs and the birds’ continued existence would be at risk. Simply reviewing the Pig Empire defenses and dynamically selecting the number, species and order of attack would allow a significant increase in agility.

Conclusion

Perfect security is impossible so there are inevitable flaws on both the part of the birds and the pigs. While today’s birds are able to achieve their goals, if the enemy boosts their capabilities, the birds’ limited structure puts them at serious risk. The problem is that eggs keep getting stolen. If the birds improve their defensive strategy to such a point that egg theft drops significantly, the pigs might find it substantially easier to obtain sustenance from another source… Falldown 3D, perhaps.

Launching attacks is easier than defending against them. An attacker must only succeed once, but a good defender has to be vigilant all the time. A small improvement on the part of the pigs’ attack would place the birds themselves at risk of extinction. So it is essential that the birds improve their defenses and capabilities. With luck, they’ll manage to do this before things reach a point of criticality.

 

(This post originally published at the RJS Informer)

It’s a matter of trust

Warning: this blog entry covers sensitive current events and some of the links may use strong language.

When a big news story hits, do you ever notice a pattern or significant fact, that despite 24/7 coverage, everyone appears to be missing? The world has had three events in recent weeks get considerable attention throughout television, newspapers, radio and social media; and each of these events are catastrophes that occurred because of poor policy choice and unplanned reactions. Let’s briefly explore them.

PayPal v. Regretsy

Paypal is known to “freeze” the assets of somewhat questionable groups. However, many are saying they crossed the line by pulling the plug on a fundraising effort to get Christmas gifts for 200 children in need. Yep, you read that right. Paypal followed their policy and basically profited three times off of preventing children from receiving gifts. Is it surprising that this blew up in their face?

April Winchell, of the popular website Regretsy.com, wrote up her story and published it online with a follow-up. Not only did she get a massive movement behind her, but due to the fame of regretsy.com and the nature of what Paypal’s employee said, the story went viral and is being spread throughout Facebook, Twitter and other social networks. The story has been reported so widely,  there are now over 20,000 hits on Google with titles like:

– PayPal ruins Christmas for over 200 kids

– Paypal has no problem ruining Christmas for Children

– Paypal – The Christmas Grinch

There are posts claiming “Paypal is evil” and people should “stop doing business with them immediately.” On top of that, there is a public list of Paypal and Ebay employee phone numbers and email addresses being spread along with this story.

Carrier IQ
As we have covered previously, Carrier IQ is the company that writes activity-monitoring software for cell phone providers. Some call it the rootkit of all evil but others say it’s not so bad. The news started within a rather small technical community, but rapidly expanded throughout the internet and has resulted in a class action law suit and a senate inquiry. Carrier IQ’s customers are also being sued.

Pepper Spraying Cop

Most everyone today knows the story about the cop that sprayed pepper spray in the faces of protesters at the University of California-Davis. While such events happen often, the fact it was captured with cameras and posted all over the internet made it famous. The incident has started a national discussion about militaristic police forces, a personal investigation into Lt. John Pike and endless parodies.

What does this mean?

In each case, someone did something no rational person would do if presented with the given scenario. The various parties all defended themselves by citing law and policy, yet each instance caused a catastrophic public relations nightmare they may never be able to fix.

If you asked John Pike, weeks before the instance, if he would ever walk past a line of passive college students and cover them with pepper spray, I’m sure he would have said no. If you asked the CEOs of ATT or Sprint a month ago if they ever thought about tracking every single action their customers took on the internet, they would have dismissed the idea as ridiculous. If you asked the leadership of Paypal if they planned to steal money from impoverished children for Christmas, they’d have called you insane.

Yet, each of these events happened. Why? It comes down to policy. Policy’s role is to guide behavior. It sets expectations and makes individuals accountable. Sadly, the latter is often phrased in a negative manner so employees do the bare minimum to protect the organization and, in the process, open up the potential for these types of unfortunate events.

A better way?

Think about what would have happened if the Paypal representative had taken the call and responded with “That sounds like a good cause to me. I’m not authorized to allow it, but let me get my boss on the phone.” Maybe their officers wouldn’t have gotten inundated with spam and phone calls. Maybe their name wouldn’t be equated with thievery and evil. Maybe working with the offended party would be a better approach than a half-hearted apology.

Similarly, what if Carrier IQ had entered into discussions with TrevE about his findings and then worked with ATT and Sprint to resolve the issue instead of immediately going to the legal system (and getting trounced)? Maybe the whole issue could have been avoided.

Lastly, what if, Norm Stamper’s reforms of the police system gained traction? Maybe Occupy UC-Davis would have looked a lot more like Occupy Iowa City.

It’s a matter of trust

When I write policy for a client, the goal is to protect the business from mistakes made by employees. The goal is never to restrict employees to the point their only answer is always what the rule book states regardless of gray area. If you need something done exactly the same way every time, use a computer. They’re actually pretty good at repeatable tasks. People, in contrast, are really good facing unique situations and resolving them in creative ways. As soon as a policy prevents an employee from making improvements, there is no longer use for the employee. Just automate that job and be done with it. If that’s not your goal, your policy is broken. You can fix it by looking for scenarios which can be read literally and, as a result, cause catastrophes like the ones mentioned above.

There are many ways to fix these problems, once they’re found. Some businesses give their employees discretionary budgets. What if Paypal had said “Sorry for the mix up, and since it’s a good cause, here’s $100 to buy a kid a present.” Some businesses have an official PR escalation team. What if TrevE’s report hadn’t been met with hostility, but instead they said “Huh, good point. If we give you $1,000 can you give us some consulting on doing this better?” Some organizations create an expectation of personal responsibility, where it is illegal to obey an illegal order. Might that not have helped things at UC-Davis?

If you’re going to have people working for you, you have to let them be people. Let the policy be the guideline and trust them to follow the guidelines. If you do not trust your policy to guide, and not prescribe, action, you need a new policy. If you do not trust your people to be guided by a good policy, you need new people.

 

This blog entry was originally posted over at the RJS informer.

Leaked Password Analysis – 2011-06 Edition

As most of you likely know, several months ago saw a shift in how a certain type of attack was being done on the Internet. Instead of breaking into a website and simply stealing information, people began breaking into sites to steal information and then release it publicly on the Internet. It is not my intent to discuss the choice of targets or the motivations of these groups. Others have written plenty on this topic and really, if you’re not working for a target or one of the attackers, anything you can say about their motivations is likely to be guesswork at best.

Instead, I want to talk about the passwords. I’ve been following these leaks and collecting password information. My goal is not to break into people’s accounts or to discuss whether or not the leaked data supports the claims of either side. I only have one goal in doing this. I want to find out what I can about people and passwords so I can help everyone choose better ones. So here is my initial analysis. If time permits, I hope to come back to this and do the analysis with more rigor and dive more deeply. However, since my initial rough analysis is done, I wanted to share my preliminary findings. I think they’re interesting, so I hope that you will as well.

 

Data Set

I’ve combed leaked data for all the cleartext passwords I could fine. Realistically, this means that the passwords I’ve analyzed here fall into two categories. The first category is passwords that were stored unencrypted or very weakly. The second is passwords that were weak to begin with and were easily cracked by those who released the data sets or analyzed them later. So, the important takeaway here is that this is not and analysis of typical passwords used on the Internet. This is an analysis of bad passwords used on the Internet combined with passwords that were stored poorly. Still, since I want to learn what not to do, this seems like a worthy use of my time.

The data set exceeded half a million passwords… but likely involved some duplicate records. I hope to tighten up the analysis in my next go-around.

 

Common Passwords

Everyone starts these analysis with a list of the most common passwords. I do not wish to disappoint, so here is what I found.

So what can we learn from this? First of all, note the number of passwords that are just numbers. 123456, 12345678, 12345, 111111, 1234, 1234567, and 123456789 were seven of the top 20 bad passwords. This is ridiculous. Who on earth thinks this is a good idea? A lot of people, apparently.

Second, notice the surprisingly large number of people who thought that trustno1, baseball and superman were good choices. Perhaps choosing passwords based on popular culture is unwise.

 

Password Lengths

I then looked at the average password length. There’s not much of a surprise here, but here’s the graph if you’re interested:

What I found most interesting was how relatively few passwords were seven characters long. I expected six and eight to be large, but not for seven to be so short. Also, note how quickly it drops off after 8. Nine characters and up are ridiculously small.

 

Keyspaces

This is where things get interesting. We have been talking for years about how people should use a mix of lower case, upper case, numbers and symbols in their passwords. I don’t want to bore you with math, but the reason is that the more characters you have to pick from, the longer it’s going to take to guess the password. If, for example, your password is one character long, if you use a lowercase letter and the attacker tries those first, it will only take 26 tries to get it. If you use a character from any of these sets, it will take 26 (lower case) + 26 (upper case) + 10 (numbers) + 32 (symbols) = 94 tries. If your password is longer, then it will be increasingly harder.

Let’s use a few pictures to make this easier to talk about.

 

This is what we’d like to think people are doing. We know that not everyone is following our advice, but at a guess, we’d expect there to be a reasonable mix of people doing it the right way and some overlaps within the other spaces.

 

Our ideal, of course, would be to widen the overlapping space. This way, more people are using more complex passwords and would be safer.

 

… and this is where we actually are today. The spaces aren’t the same size, which isn’t terribly surprising I guess. However, I didn’t expect not only for the special characters space to be so small, but I also didn’t expect the overlap to be so tiny. In fact, of the 519,229 I analyzed, only 315 had a mix of lower case letters, upper case letters, numbers and special characters. No wonder they got hacked. This means that 0.06% of all the passwords were considered minimally secure.

Really… is it so hard to add an exclamation point or question mark in there somewhere?  Here, I’ll even give you some you can use.  I mean, really!?!?!?!?!?!?

 

Other Metrics of Interest

When I compared the list of passwords to itself and weeded out the duplicates, I found that 65.71% of the passwords overlapped. I must say, folks are just not as creative as I had hoped.

For those that follow math, the average entropy score of the password set was 29.63. I hope to make a neat graph comparing entropy to things like length and commonality, but will apparently have to get more proficient with better graphing tools first. My existing tools found graphing 500,000+ data points somewhat challenging.  :)

When I ran the list of passwords against the standard Linux word list, I got 85,196 hits out of 178,049 unique passwords. That’s a 47.85% rate of people that aren’t even trying. Again, we’re talking about the easily-cracked passwords, so this number is inflated… but it’s still much too high.

Surprisingly, I did not see many passwords that were just dates. Those stories of people using their kids’ birthdays as passwords seem to have been exaggerated… or perhaps people today don’t care about their kids very much.  :)

So What Do We Do?

Given that this was a set of easily broken passwords, the key things to do to prevent your password from being broken is to make them not fit these patterns. This means:

1. Use a mix of lower case letters, upper case letters, numbers and special characters. Use at least one of each.
2. Make your passwords longer than eight characters. To lay outside of this data set, 10 would be fine. Personally, I’m going up to 16. After all, if you can remember an eight character password, you should be able to remember two of them stuck together.
3. Avoid basing your password on popular culture, sequences of numbers (or keys on the keyboard) or sports. Those passwords are much more common than you’d think.

That’s it. If you do these three steps, you’ll be well outside of this data set and therefore, much less likely to get your password stolen. Of course, the one thing I couldn’t measure was how much these passwords are shared between accounts of the same person. The 65.71% overlap rate suggests that there is a lot of this going on, but I can’t prove it. Still, it’d be a good idea not to do that.

Do these suggestions sound familiar? They should. If you’re still not following them, maybe you should. We don’t suggest them to be annoying or to help protect against some amorphous threat in the future. We suggest it because if you don’t follow these rules, you will be hacked.

We’ve just seen it happen.

Over half a million times in the last six months.

Firefox and Facebook

I am involved in a great many groups that are (ostensibly) focused on technology or security to some extent.  One somewhat disturbing trend that I’ve noticed in recent months is people complaining about their significant others and how they constantly put their shared system at risk through Facebook.  Now, I could make this post about how being with someone means accepting their flaws along with their virtues or even go so far down the path of “all you ever do is complain, why on Earth did you marry them in the first place?”, but this isn’t that sort of blog.  Instead of doing that, I’ll point out that we have all the tools we need to secure someone else’s connection and you’re having issues isn’t because your spouse is stupid, it’s because you’re lazy.

Here’s how to be less lazy… involving Firefox profiles and Facebook.

This is not another “how to secure Facebook” post.  To do that, please see this post from Sophos.  This is also not about basic Internet security.  No, this is about how to use some built-in functionality in Firefox to create walls between dangerous sites.  By itself, it will help a lot against account takeovers and complex leveraged attacks… but if you don’t follow basic security practices like using complex passwords and not sharing them between systems, the benefit will be limited.  Keep this in mind as we go through this process.

Profiles

Firefox uses profiles to separate different settings.  They are amazingly powerful, and yet, shockingly, people hardly use them at all.  What we’re going to do here is create a specific profile for Facebook use and then adjust the default profile to block Facebook.  The important thing to remember here is that this technique can be used to protect ANY website, not just Facebook.

Let’s start by installing Firefox if it is not already installed.  To do that, just go over to Mozilla.com and download and install Firefox. Once it’s installed, we have to launch the profile manager. The way you do this is going to vary based on operating system. Under Windows 7 and Vista, go to the search box at the bottom left of the start menu and type firefox.exe -ProfileManager -no-remote. If you are running Windows XP, go to the start menu, click Run… and in the dialog, type firefox.exe -ProfileManager -no-remote. If you are running an older version of Windows, just give up now. Those operating systems are dead and cannot be secured. Either upgrade to Windows 7 or look at running an alternate operating system like Ubuntu Linux.

If you are running Linux, you can just open a shell and run firefox -ProfileManager -no-remote

Now we need to create a new profile for Facebook use.  To do this, go to Create Profile -> Next -> Enter Facebook for the profile name and click on Finish.

Now you can just select the Facebook profile and click on Start Firefox.  This will launch a basic web browser for you.  Now we need to configure the appropriate add-ons.

Add-ons

Firefox supports “add-ons” (also called “extensions”) which supply additional functionality to the browser.  Each profile maintains its own set of add-ons, so if you like any of the one’s we’re adding here and want to use them in your regular browsing, you’ll have to add them into the default profile as well.

To select your add-ons, you should open the Firefox menu and select the Add-ons link over to the right.  For the rest of this section, we will be adding each add-on by searching for the name in the search box at the top right and then clicking the Install button by the Add-on name.  The links provided are so you can read about the add-on before adding it if desired.  However, please add them through the Firefox interface so that they will be automatically updated for you.

• RequestPolicy – This prevents the so-called “like-jacking” attack by explicitly allowing the browser to connect to specific sites.
• Web of Trust – This connects your browser to a free service that compares sites you try to visit to known list of bad sites.
• NoScript – This prevents your browser from running scripts except for the ones that you explicitly allow.
• AdBlock Plus – Prevents ads from displaying, however, this may break some games.  If you play games, please see note 1 at the bottom of this post.
• Certificate Patrol – Improves the HTTPS security within Firefox.
• Force-TLS – Allows Firefox to refuse to connect to a site if it is not secure.

Once these are installed, you will have to restart Firefox to activate them.  Either click on of the Restart Firefox links or close the browser and re-launch it using the -ProfileManager -no-remote trick above.

Automatic Tuning

Once you’ve restarted Firefox, it will launch into the automated tuning process and you’ll have to specify some configuration options.

The first thing that will come up is the RequestPolicy configuration window.  By default, it allows for some automated tuning… but this makes it less secure than we really want here.  Uncheck the “International” checkbox and click on “OK”.  We’ll tune the rest of this add-on shortly.

The next dialog is Web of Trust (WOT).  The WOT add-on just needs you to accept the EULA before you proceed.  Read the EULA and then click on “Accept” if you accept the terms of the EULA.

Now you should have four to five tabs open.  The order will likely depend on the order in which you added the add-ons.  We will be tuning the NoScript and ForceTLS later in this process, so just close those tabs.

Web of Trust
This is where things start to get complicated.  The RequestPolicy addon, by default, will conflict with WOT.  You can tell because there is a red flag icon in the bottom right corner.  You need to click on the flag and go up to the “Temporarily allow all requests” option.

NOTE:  This is something you should do only during the tuning process.  Allowing all requests basically turns off the protection that Request Policy allows, and since this is the key protection for Facebook, it should usually be on.

Once this is selected, the page should reload and give you a configuration page for Web of trust. Basic is good enough for us, so just click on Next.

The next option is to register.  You do now have to do this, but if you wish to do so, fill out the form and click Finish.  Otherwise click on the little red X at the top of the “window” in the browser.  Then close the tab.

Adblock Plus

If you chose to install Adblock Plus, this tab will appear.  If you chose not to do this, just skip to the next sub-section. On this pane, you select the subscriptions you want.  Most users will be fine with just EasyList which should be selected by default, so click on Add subscription and that tab will close.

Options

Now we need to tell Firefox that this profile is to launch Facebook.  To do this, click on the Firefox menu and then go to Options and select the top Options option.  (And please accept my apologies for that sentence.)  You should be in the General tab (far left) of the options dialog.  In the area where it says Home Page, please enter in https://www.facebook.com.

Now click on the Content tab.  Where it says Enable JavaScript look over at the right and click on the Advanced button.  In the tiny little window that comes up, uncheck each checkbox and click on OK.  This will help prevent Javascript-based attacks, which are very common on Facebook.  We will protect against the rest of them shortly when we configure NoScript.

Now click on the Privacy tab and select Never remember history in the drop down.  The less data you store, the less there is for an attacker to steal.

Now click on the Security tab.  For the most part, the defaults are good, except that it defaults to storing passwords.  Remember that every password you store is a password that could be stolen by an attacker.   Uncheck the Remember passwords for sites checkbox.  If you have used this profile in the past, you may also wish to click on Saved Passwords and select Remove All.

Now for the complicated step.  By default, most browsers choose user convenience over security.  We discovered this problem back when Comodo was hacked a few months ago, and this is what you need to do to fix it.  Select the Advanced tab.  Then select the Encryption sub-tab at the far right of the list of tabs below the primary tabs across the top.  Click on Validation and click the bottom-most checkbox.  Then click OK to close the sub-dialog and then OK to close the options dialog.  The drawback to this is that if Facebook’s OCSP server goes down, you will not be able to connect.  The upside is that if Facebook is attacked, you won’t be able to connect to a compromised site.

Now it’s time to restart Firefox again.  This will clear the temporary setting change we made and get us to where we can start tuning the system.  Run Firefox with the -ProfileManager -no-remote trick again and select the Facebook profile.  You should automatically-connect to Facebook and be prompted to log in.  Just log in as usual and we can start the manual tuning process.

Manual Tuning

Request Policy

This is going to be the most annoying aspect of accessing Facebook this way, but it is very much worth the extra time it takes.  When you start Facebook, you will see a bunch of missing images and some grey flags in their place.  This is because RequestPolicy doesn’t yet know which sites are safe, so it blocks everything.

To fix this, click on the little red flag icon in the bottom right of your browser (this is in the status bar of the browser window, not in the Facebook section).  This will allow you to let RequestPolicy know which sites can talk to other sites. First we need to go to the Preferences option at the top of the RequestPolicy menu.  Click on the Advanced tab over at the right and then select Allow permanent whitelisting when using Private Browsing.  Now click on the red flag again and allow the two sites akamaihd.net and fbcdn.net to be accessed by Facebook by selecting the option in bold at the top of each sub-menu.

NoScript

Now we need to allow Javascript so more of Facebook will work.  To do this, click on the Options button on the yellow bar along the bottom of the screen.
This works much like RequestPolicy.  Just click on the Allow Facebook.com option in bold and the page should refresh.

At this point, Facebooks should be looking pretty normal.

ForceTLS

Now we need to force secure connections in the event that Facebook changes that option (again).  To do this, right-click on the Facebook page and select View Page Info, click on the Permission tab, scroll down to where it says Secure Connection and click on both checkboxes.

Games

At this point, things should be more or less working securely for basic Facebook services (reading and posting to walls, getting messages, etc).  If you play games, you may have to go through the RequestPolicy and NoScript steps above to allow different sites, but be aware that for every site you add, you increase your risk significantly.

Default Profile

Now we have to tweak the default profile.  Restart Firefox again (sorry), and run Firefox with the -ProfileManager -no-remote trick again.  This time, select the default profile and go into the Add-ons section as before.  This time, we will be adding only one add-on.

LeechBlock

• LeechBlock – Prevents access to specific sites.

After it’s installed and you’ve restarted Firefox, it should come back to the Add-ons Manager.  If it does not, you can get there by going to the Firefox menu, then to Add-ons then the Extensions.  Now click on Options next to LeechBlock.  The Block Set 1 tab should be selected.  Under What to Block enter *.facebook.com.  Then click on Next to go to the When to Block tab.  Just click on the All Day and Every Day buttons as you never want to access Facebook from the default profile.  Now, click on OK to activate this change.

Note, if you are doing this to protect someone other than yourself, you may wish to turn on some other options in this add-on to prevent them from unblocking Facebook.  You may also wish to replace the standard page with one that says that Facebook is only available via the dedicated Facebook profile.  These steps are out of scope for this little How To guide.

Optional Others

If you plan to do anything risky in the default profile, consider using the other add-ons that we used on the Facebook profile.  After you’ve used them a bit for Facebook, it should be pretty easy to adapt them to other uses.  You may also wish to load LeechBlock into the Facebook profile to prevent people from using that profile to go to other common sites (online banking, webmail, etc) from that profile.

You can also create a dedicated Firefox profile for each of these common uses, if you wish.

Desktop Configuration

Now for the final step.  You don’t want people to have to manually type in -ProfileManager -no-remote every time they need to access this profile.  Instead, we’ll modify the Firefox icon on the desktop to do this automatically.  To do this, right click on the Firefox icon on your desktop and add  -ProfileManager -no-remote to the end of the Target section (outside the quotes).  Then click OK to save your change.  Now when you double-click on the icon, you will be prompted for which profile you wish to run.

If you wish, you can read a bit more about Firefox profiles and make an icon that launches the Facebook profile, but this How To is long enough already, so I won’t be getting into it.

There you go, that’s it!  While there’s no “Safe” on the Internet, if you take these steps, you’ll be a whole lot safer than the vast majority of Facebook users.

---

Notes:

1. It would be best if you don’t play games at all on Facebook.  There have been numerous problems with game developers being less than trustworthy… and you probably have better things to do with your time anyway.  ;)   If you must play games, consider using two Facebook accounts and creating a second “Facebook Games” profile to access them in.  This way, if you have your friends in one account and your games in another, a bad game won’t put all of your friends at risk.
2. You should still use a strong password on your account and not share it anywhere else.  If you have a weak password, an attacker can figure it out without your involvement at all, and none of these protections will help.  If you share passwords, an attacker can use your password to steal a lot more from you.  You can generate strong passwords over at Strong Password Generator.
3. You may wish to add different Firefox themes to each profile so there is a visual reminder where you are and what you can do.  You can find lots of Firefox themes at the Firefox Themes Site.
4. If you are technically-skilled, both RequestPolicy and NoScript allow you to export your configuration so you can import it elsewhere.  If you have to set up multiple computers, this can be a time saver (or you can just copy the profile directories).  In case it’s useful, here are my exported policy files:
   • RequestPolicy
   • NoScript