Madness

Thursday February 12, 2009 at 12:38

Backing up Delicious Bookmarks

I often go through these moments of fear, that a site I use often for services will start charging, or disappear, etc. (or even worse, start showing ads). Fortunately, most sites I use have API’s so it allows me to capture and store data I’ve provided them. One such service is Delicious. I’ve used this service on and off for years, more so of late. Delicious has a rather robust API, and allows users to easily access data. So, I figured, why not just go ahead and keep a backup of my bookmarks. With crontab and our trusty friend curl, this is really easy to do:

curl -k --user username:password -o delicious.xml -O 'https://api.del.icio.us/v1/posts/all'

That’s all it takes. Of course, I then slurp this into a database, and look for new entries, but that’s just me.

Monday January 05, 2009 at 16:03

Permalink ∞ | Tags Twitter hacks

Twitter’s Cookie Fiasco - Authentication the Wrong Way

Twitter has come under attack the last couple of days because of a phishing scam. After looking at this scam, and thinking about how Twitter maintains a user’s session, I decided to play around a little bit with my account.

First, I’m using Safari on OSX, but all browsers have the same problem, it’s just easier to explain with Safari. When you log into Twitter, it sets several cookies. Each of these are tied to your account. Fortunately, the cookie ID, though the same in each of them (first x digits) is not your user id. However, after taking a closer look, I realized that since all of these are stored in Cookies.plist in the user’s Cookies directory, it would be very simple to modify the plist with a plist editor. Getting the right combination is actually very difficult, and since my goal was not to hack another user’s account, I decided to test my initial theory. Since Twitter does not re-authenticate the user with each session, and instead relies on cookies, what if I copied my Cookies.plist and saved it for later? I made a copy, removed all my cookies, and went back to Twitter. It correctly asked me to log back in. Closed the browser, over-wrote Cookies.plist, and re-opened my browser. When I went to Twitter, it believed I was already logged in, and therefore didn’t ask for any credentials.

Test one was a success, or a failure depending on your point of view.

The second test is a bit more scary. Since I have this Cookies.plist file, what if I changed my password? So, I went into Twitter, changed my password, logged out, deleted my cookies, and closed the browser. I then copied my Cookies.plist file back (a file with a different password authentication) and started over again. To my horror, when I went to Twitter, it believed I was logged in, even though I had changed the password. Now granted, in order to change the password you have to know your password, but this got me thinking. I don’t have to know anything to change my email address. I changed my email address, and then changed my password. I deleted my cookies again, and went back to Twitter. I proceeded to ask Twitter to send me my password, since I no longer knew it. In a couple of minutes, I got my password, at the new email address I had set up.

Conclusion, until Twitter changes the way in which users authenticate, no compromised account is safe.

-Update: In order for this to work, you must check the “Remember Me” box when you log in the first time.

Wednesday December 17, 2008 at 11:36

Permalink ∞ | Tags osx hacks

Get off my desktop

If you’re like me, you constantly take screen captures, for a long list of different reasons. OSX has made this incredibly easy, but it also tends to leave a mess. Next thing you know, you’ve got 20+ screen grabs littered around your desktop with the great name Picture (number).png. Here’s a way to clean up the clutter, and put those screenshots in their place.

In a terminal, type the following:

defaults write com.apple.screencapture location /Users/YOURUSERNAME/Documents/Screenshots

Just replace YOURUSERNAME with, your username. Of course, you can use this command to put the screencaptures anywhere you want. After doing so, then just add the directory to your Dock as a stack, and it’s even more useful. You need to make sure the directory exists first, and it will take a logout/login for the changes to take.

If you’re still running Panther, then you’re SOL, and you need to upgrade anyway.

Monday December 01, 2008 at 21:33

Permalink ∞ | Tags

The iPhone Keyboard Auto-Correction

If you’re like me, and you’ve been running the BossPref Keyboard hack, then the new keyboard Auto-Correction features in firmware 2.2 don’t work. No matter what you try, enabling and disabling the autocorrect feature under settings seems to do absolutely nothing, even after uninstalling the SBSettings KB autocorrect. After a little bit of digging around in exactly what this “tweak” did, I discovered that the SBSetting KB autocorrect really didn’t “do” anything. It simply renamed the TextInput directory, so there were no dictionary files. When you uninstall the “tweak”, it also didn’t clean up after itself, failing to rename the directory. So, if you’ve been using this “tweak”, and it was auto-installed by AptBackupRestore, when setting your jailbreak iPhone back up, then you just need to rename to directory to start using the new 2.2 firmware keyboard fix. Simply rename:

/System/Library/TextInput-bak

to

/System/Library/TextInput

Reload the Springboard, and you can now use the Auto-Correction under Settings->General->Keyboard. The Apple fix to this annoying feature, offers a lot more options, allowing you to still use other keyboard tricks, without using Auto-Correction.

This is also a great time to point out that AptBackupRestore is one of the best little apts in the Jailbreak toolkit. Since Jailbreak is nothing more then deb packages, this little apt creates a text file of installed Jailbreak programs, and then with a single click of “Restore”, all your apps show back up after a firmware install.

Saturday November 22, 2008 at 14:26

Permalink ∞ | Tags

Zooming in iPhone Webclips

The ability to make Webclips (or url links on the iPhone springboard) is yet another one of the nice features of the iPhone. However, the lack of control over the icon, and the positioning of the web page upon re-launch of the page has always frustrated me. Back in August, I explained how to make custom icons for your Webclips with a Jailbreak iPhone, and how to zoom in on a image to make better icons for non-jailbreak users. The only thing I really didn’t like about the zoom option, was that whenever you re-launched the site, the webclip was zoomed into the image location. As it turns out, this is controlled in the plist file for the webclip. Jailbreak users can simply open up the plist file, with the Property List Editor, and change the scale back to 1, and the position back to 0,0. This will scale the page back to its normal size, and re-position the page back to the top left corner. It’s amazing what you can discover with the plist editor, and 10 minutes to waste on a Saturday afternoon.

Thursday November 20, 2008 at 9:45

Permalink ∞ | Tags

How to disable the AppleTV auto update - XBMC Community Forum

Now that AppleTV 2.3 is available, it’s time for me to prevent Auto Update. This is a really easy way to keep Boxee and XBMC on your AppleTV, and avoid those nasty little removal scripts the Apple updates run.