So I tried to unlock the account and went through that cycle. It notified me that I couldn’t reset my password to what it is right now. So, if my account is locked, and I’m trying to reset my password to my current password and presuming my internet banking password is correct surely we can just unlock the account. Apparently not. At that point I figure it’s easier to handle this while I’m in Australia instead of trying to get it sorted in the less than two hours of time I had before I needed to head to the airport. There are more pressing matters to attend to handling.

I travel to Australia on a reasonably pleasant QANTAS flight and land then as I’m heading home I start working on getting access again. I give NAB a call and get to a human, start explaining my issue and then BAM! Hung up upon. Ok. That wasn’t quite what I was after. I ring back and have fun with the phone system asking me what I’m calling about. It asks me if I’ve forgotten my password, I say no. It seems to confuse it. I know what my password is, I’d just like you to reset it. The first person this time is nice enough but can’t really help me and transfers me to internet banking who tell me they can’t just unlock my account and only reset my password. I give up on humans at this point and then decide that instead I’ll give the computers another shot from my phone. While ringing in it asks me for my phone banking password which I think I enter but was probably incorrect.

At this point I discover something important. In attempting to reset my password, it tells me I can’t have my password the same. It then tells me that the password I’m entering is invalid because password can only contain numbers and letters – no symbols. The password I was entering in San Jose had symbols in it. The NAB didn’t deign to inform me that the password I was entering was invalid not only because the password is WRONG but because it contains characters that can NEVER be in a password. You’re locking me out of my account and not informing me that my password is incorrectly formed for your system. Don’t even get me started on how insecure and unsafe it is that you limit me to various characters. So I type in a new password however this time it tells me that my telephone banking password has been locked out.

This frightens me even more. I can brute force GUESS someones password through the NAB’s password reset system and it doesn’t appear to validate the phone banking password until AFTER it’s validated the new internet banking password is valid. Alternatively, it’s secretly in the background trying the telephone banking password and failing but not displaying that notification. At this point I give up and figure I’ll visit a branch to get the situation resolved on Monday (this happening on a Sunday). Fortuitously I ventured into a shopping center that had a NAB outpost in it, got an internet banking password reset code and was then able to reset my account.

This highlights another annoyance of mine with internet banking that I’ve complained about for a while but NAB seem indifferent to fixing. If you type your NAB ID and start typing your password quick enough, the UI will helpfully reset your cursor from the password box to the NAB ID box. This means anyone standing behind you stands a chance of seeing some portion of your password as well your NAB ID. This has happened to me many times where the first two characters I type end up in the password box and I see the rest of my password plain text in front of me on screen – in fact it happened just after this situation I’ve described so I know it’s still there. Convenience is more important than security.

But let’s review things here. They’ve got a confusing process where in they change your password quicker than the UI hides those characters on iOS. This is a usability problem because in this particular case I was confused that I made a typo when I hadn’t. Their password system will lock out an account for entering a password that isn’t valid within their system but doesn’t tell you that the password you entered contains characters that aren’t valid. Their password system won’t let you set arbitrarily complex password which tends to mean they’re probably not hashing it somewhere and likely it’s stored plain text for someone in the bank to be able to read as they will. Their password reset system either tests your telephone banking password, doesn’t tell you it’s wrong and locks you out due to issues with your internet banking password OR much worse it doesn’t test it at all meaning you can use it to verify what someone’s password is without having to try to login as the person. Potentially that isn’t protected against multiple bad attacks either which means there is potentially an entry point for a brute force attack. And finally the situation where you can be typing your password in a password box and NAB Internet Banking will expose your password to anyone potentially looking at your screen.

Seems I hit the jackpot of issues all at once. Lucky me.

But I’d like to take a step back and detail one of the projects I’m working on at the moment. At USQ we’re working on a media repository to store our media files for course materials and lecture recordings. One of the aspects is mediating connecting the raw recordings (done in Camtasia Relay) with the courses which are in Moodle. Camtasia’s support for Moodle is a bit awkward and we’d like to improve it a bit more or build an interface that at least mediated things so that we can choose to put things into Moodle (our learning management system) or the new media repository. So we need a bridge of sorts. Being a PHP person and PHP being one of the most preferred programming languages at USQ (see Moodle) I figured I’d do it in PHP. Then I realised I wanted to do it properly and needed authentication integration plus a few other tricks. I also figured I’d like to have a controller, view and a model for stuff. Then I figured I’m going to need some database drivers, particularly Oracle but for initial testing I’m going to need to do it locally outside of the normal development framework since its essentially a skunkworks project.

The choice I’ve taken is to use the Joomla! Framework and strip out the majority of Joomla! to put in what I need. In this particular case I’ve picked up the authentication plugins, user plugins and user component from Joomla! and left all of the content stuff behind. I’ve started adding my own extensions to the project to handle the aspects required, pulling in some of the DAV support work I did for Joomla! a while ago and including that into the libraries. So the pieces are slowly coming together and eventually I’ll get everything up and running properly. I’ve also ported Joomla! in a small part to an SQLite3 database where I’m putting stuff for the time being. I’ve grabbed a stock joomla.sql file for MySQL, modified it to be SQLite friendly and then I’m using that base database to handle everything. It has more than I need in it table wise but that doesn’t necessarily cause concern but perhaps wastes a bit of space. I’ll hook up everything and get it to work, perhaps a bit heavier than it needs to be but also immediately portable back into a Joomla! instance later if this is the path I want to take.

Perhaps at a JoomlaDay somewhere I’ll demo it.

I’ll start with Safari because that’s where the discussion began with. Many years ago there were two major browsers for the Mac: Netscape Navigator and Microsoft Internet Explorer. Netscape on a Mac at primary school was my first exposure to the internet which dialed into the local University and used their connection. This was back when browsers still costed money to acquire, we’ve come a long way. At one stage Netscape was shipped by default but as we progressed with Mac’s, Internet Explorer became the default browser that shipped on Mac OS (along side Netscape). Microsoft really had no interest in continuing to develop for the platform that they started their life on (yes, Word was originally a Mac application, which is why it has quirks like Mac’s) and their browser stagnated on the platform. In 2003, Apple announced that they were effectively forking KHTML and building their own browser which ended up being included as the default browser in Mac OS X 10.3 (that same year) with Internet Explorer an alternative and then as the only browser in Mac OS X 10.4 (which was where I started my Mac journey).

It was a bumpy road for Safari but they came out the other end with the open source project “WebKit”. This is significant because today WebKit is used more places than Mozilla’s Gecko engine. WebKit forms the basis of Safari on Mac, Windows and iPhone/iPod Touch for Apple developed products but is now a part of Google’s Chrome browser and their Android mobile phone platform and Nokia are using it with their Symbian S60 phones. Apple, Google and Nokia. There are other browsers that are picking it up, like Epiphany on Linux (moved from Gecko to Gecko and WebKit to just WebKit), iCab and Omniweb. There were also those browsers who were built around it,  like Shiira and Google Chrome. Just recently Palm has joined the mix with their new “Pre” handled being heavily powered by WebKit (you know, the iPhone killer). Really quite scary when I think how out of nowhere really this rendering engine has appeared and taken market dominance away from Gecko.

And Gecko, the engine that powers Firefox that came from the Netscape line. Gecko at one stage was the engine of choice for GUI based browsers for Linux. Sure there were other browsers out there that did their own thing but nothing really compared to Gecko. Gecko powered Mozilla’s Navigator line as well as Firefox but it also held a lot of sway amongst the GNOME guys as well. Gecko was the engine that powered Galeon. Galeon was perhaps for the longest time my most favourite web browser for Linux. It was lighter than Firefox and in some respects has some features that Firefox is only just getting. Unfortunately the Galeon people had a falling out and some moved to Epiphany. Epiphany has never been the browser that Galeon was which is disappointing to see.

Next on the list is Opera. Opera has never really been my favourite browser though it does have some nice features, I just never picked up on it. I continue to have a copy of Opera laying around my Mac but the last time I seriously used it was for testing websites when I wandered complete cookie isolation when both Safari and Firefox were busy being useful. The time prior to that was before Firefox 3 was in beta (Minefield!) and I wanted to test some CSS that Safari 3 rendered fine but Firefox 2 refused to display properly. Firefox 3 didn’t render the page perfectly (still) but it did go a long way to getting it right and Opera got a bit further but not quite there. Opera has some really cool features such as tab previews and their ‘quick dial’ page as well as the ability to embed ‘widgets’ into the application as well which seem to be able to work at a higher level than the Firefox extensions appear to work within normally.

Last on my list is Internet Explorer. IE is these days predominantly a Windows only web browser though in its history there were ports to both Mac OS (8, 9, X) and UNIX. IE also makes an appearance for Microsoft’s Windows Mobile operating systems as well. It is most revered perhaps for its lack of ability to follow standards and interesting flaws such as the PNG transparency issue. Interestingly since the Mac version 5 diverged using the Tasman layout engine not the Trident engine (Trident being the engine behind the Windows versions which is still used to this day). Tasman aimed to follow the standards and did so quite well and as such it didn’t feature IE’s Box Model bug and had better XHTML, CSS and PNG support (with full transparency and colour correction). The Tasman layout engine lives on today within Microsoft TV Mediaroom Edition with rumours it’d be used in IE7 which turned out not to happen. IE has been known to introduce a few features that have lived on however. The favourite icon support was first seen in IE an the AJAX revolution was started by Microsoft’s XMLHTTPRequest object. IE is also well known for the things it has introduced that have caused issues, such as ActiveX controls, insecurity with various security flaws and inappropriate designed trust models in addition to the fact that each version introduces new quirks and bugs for rendering inventing the need for browser specific hacks to get a page to render the same. Yes, I’m sure every web designer in the world loathes this browser but with Microsoft’s monopoly it is unfortunately not going to disappear overnight. Shame really.

At the end of the day I use Firefox the most on Windows (gaming PC, others PC if possible), Mac (main desktop) and Linux (work desktop). When I was using Windows for my work machine I had IE, Safari, Firefox and Chrome. Most of my browsing lived in Firefox but I used Chrome for my GMail accounts to keep them in their own little play pen away from where I was working. My gaming machine has a similar set up but since I usually only search to work out why games aren’t working (you’d be surprised by how much old games stop working when you change their preferred DirectX version), that usually just means Firefox. My Mac at the moment is a battle ground between Firefox and Safari. Safari at one stage in the last week was the only browser I had open after I got annoyed with Firefox eating CPU and memory. Safari is a might lighter browser and I do enjoy it over Firefox at times. It has features like the ability to save all of the tabs in a window into a bookmark folder and then to open bookmark folders as new tabs. It allows me to save a window full of ‘research’ easily and close that browser window off until I need to work on it again and then immediately everything is back. Until Firefox 3.5, Safari also had a “reopen  last closed window” option which was unique and similar to the “reopen last closed tab” that has been around in Firefox for a while. Safari doesn’t have the last closed tab yet (annoyingly) however Firefox 3.5 nicely introduces the window option along side the tab option (I’ve already used it once since I switched to the beta). Firefox 3.5 also adds the ability to drag tabs out of a window into another window or their own fully fledged window, something that Safari has had for a while and that Google implemented within Chrome. It isn’t as smooth or slick as the WebKit browser’s implementation but it is a start and is useful for those times when you want to break a window out into its own, or join it to another window, but since it has a form in it that you’ve entered details in or something that you can’t easily get to (YouTube video, shopping cart submission, etc) with a direct link. Safari’s version is very smooth and neat whilst Firefox still has a lot of rough edges to sort out but it is a start that it is at least there. The Safari 4 beta had some interesting features that they took out, the fact that the tab bar was merged into the window title was one I liked personally as it gave me even more screen real estate for my web pages, so I’m sad to see it gone in the final. Firefox has the nicer developer tools and I feel at home with Firebug however Safari also has some quite capable tools available. The latest release of Firebug annoys me that they make it more complicated to enable a panel, instead of landing on a panel and having the option to enable it, it tells you to click on a few places to enable it. Frustrating that I can’t click a big button that just says “make it so” to enable it but that is life – since I have the old Firebug at work I still prefer it over the newer one my home FF3.5 instance has. Opera has a small place on my Mac and is really an incidental browser and comes fourth to Shiira, a WebKit powered browser. Shiira has some interesting concepts such as the ability to put a page into a sidebar (with tabs) that you can then use to power the main page. It turns out especially useful for those long link list pages where you click on them to go down into a content page but they provide no easy option to navigating to the related links unless you hit the back button. Shiira also has some other interesting UI changes which makes it my third place browser on the Mac (especially when I am navigating a complex web page with a link structure as noted before).

All in all it is interesting to sit down and look around to see what the world still looks like with HTML5 around the corner it will be interesting to see how the browsers adapt to the future.

At the moment my dad is planning on moving house having sold his current house. He has a 1.5MBit Netspace connection on a plan that doesn’t exist any more (a grandfathered plan) and I want to change it to his new location. After 31 minutes I had my answer: the other connection will have to be disconnected (have the codes removed from the line, 48 hours) and then the other one transferred. They can do the transfer but it will take 5 to 10 business days for it to be processed by Telstra (they didn’t mention Telstra but being ADSL1 there isn’t another option). I guess now I have to do the hard work and paperwork.