Bad Networks... really baaaaad.

StopBadware.org relased a new study showing almost 50% of the Web sites pushing malware are registered to 10 domains, 6 of them in China. http://www.theregister.co.uk/2008/06/24/stopbadware_report/

Think how much less identity theft, credit card theft, and cleaning up after infections we've have if we could globally block these networks. Not as easy as it sounds, but blacklisting even part of these networks at your ingress points would have to be bonus round material anyway you look at it...

SSL Thoughts

How will we ever effectively educate users not to click through SSL warning boxes while our own systems have expired or invalid certificates? I've come across SSL certificate warnings on a federal agency site that liaisons with the private sector on security. I've seen them on vendors sites selling security products and services. And of course I come across them regularly on retail sites on the Internet. When they become pervasive and common, coupled with the fact we do a really poor job educating users what those warning boxes really mean, we've in essence trained them to click through and ignore them.
Misinformation from well meaning sources is another issue. I've seen articles that said to look for the golden padlock at the bottom of your web browswer, and if you see it, you're safe.
We know that's not the case, but the average end user reads that and takes it as accurate information and makes their on-line experience less secure through false assurance.
I appreciate the effort to try and educate; I just wish they had consulted someone knowledgable in security before writing the article.
Put that one right next to the tip about how hiding the SSID on your access point makes your wireless more secure.