Open Redirect at AOL.com

February 6th, 2008

My fiancée got a phishing attempt today that Gmail didn’t catch, and it relies on an open redirect at AOL.com to make itself appear legitimate. Thankfully, the scammer used a redirect at AOL that pointed to a clone of PayPal, so she recognized it as suspicious. The scam is amateurish in other ways, as well—the grammar, spelling, and logic of the message are all a little off—but I’m sure more than one person has already fallen for it.

The email feeds several large parameters to the redirect, but it appears to work with something as simple as:

   http://www.aol.com/redir.adp?_url=http://www.example.com/

That’s bad. A better scammer could easily URL-encode the parameter and clone an AOL login page. The kinds of people who are still using AOL wouldn’t stand a chance.

Fail.

27 Random Observations on Mac OS 10.5 “Leopard”

October 29th, 2007

Although I’d never dream of writing a complete review of Leopard—that job is taken—I always get a kick out of looking for those tiny changes that don’t show up on feature lists. Since Leopard seems to be all about these little details, much of this topic seems to have been covered elsewhere. That said, here are some of my own (hopefully new) observations.

  • Front Row plays its own music, rather than just controlling iTunes in the background.
  • Fast user switching is much…faster.
  • The format Mail stores To-Dos in on an IMAP server is gross. Not editable outside of Mail, and it says so at the top of every one. I’m not convinced that turning email servers into program-specific data stores is a good idea.
  • Sometimes Mail won’t let you close its main window.
  • Icons on the desktop sometimes become un-selectable. Relaunching Finder fixes this.
  • The Cisco VPN client works (and so does Shimo).
  • Safari now automatically resizes images that are too big for the browser window, but you can barely tell, because it does so beautifully (as opposed to Firefox and IE/Windows).
  • “Create Archive” in Finder is now called “Compress”, and BOMArchiveHelper has been renamed to a much less scary-sounding “Archive Utility”. “BOMArchiveHelper” needed to go, but “Compress” is too vague for my taste. Just call it “Create ZIP”.
  • I hate to say it, but things do feel…snappier.
  • The free space indicator at the bottom of Finder windows updates in real time, rather than waiting for you to activate the window.
  • Clicking an empty stack will open the folder in Finder. This surprises me every time.
  • The default time based searches have funny names: “SEARCH FOR: Today”? Search for today? What?
  • Grammar check is pretty lenient and seems relatively unobtrusive: Grammar Check
  • Tabs in Terminal, and they have the same functionality as those in Safari 3, but they appear to be custom. They look like Safari’s, and work like Safari’s, but they’re not as smooth and there are no fancy transitions. Shame that this code couldn’t be shared between the applications. Hopefully one day Apple will provide this to developers for free.
  • If you build a widget in Safari, and the containing block changes size, the widget resizes itself as necessary in Dashboard.
  • If the Help menu item isn’t the last one, the last one will be selected if you try to mouse directly to the Spotlight box. In other words, this doesn’t work: Help Menu
  • When scrubbing a dragged item over the Dock, the floating labels slide in rather than just appearing.
  • The new “Alex” voice is really, really good. On a related note, when I’m in charge, all computer voices will be female, by law. Tax breaks for hiring Majel Barrett.
  • Some of the dead space in Finder’s toolbar works as a drag handle, some doesn’t. Command-dragging the dead space when the window is in the background brings it to the foreground (which is bad). This works as expected if you click where the title bar used to be.
  • The shift-command-4 screenshot crosshairs now have a position indicator.
  • Preview can take screenshots.
  • It’s easy to get lost in Spaces and accidently woosh yourself somewhere else. The Mac interface doesn’t really work with virtual desktops, if you ask me.
  • It’s always iCal Day.
  • Built-in print previews in many apps when you expand the new print dialog.
  • Because Mail seems to delete and recreate notes every time you edit them, and Gmail never deletes a message, you wind up with several copies of every note on Gmail. Weird.
  • Stickies is at version 6. Does anyone else find this hilarious?
  • From a friend at work: Screen Saver Preferences Pane > Pictures Folder > third display style from the left. Unreal.

Dumb to include the number of observations in the permalink. Here’s a few more:

  • When choosing a desktop picture from your iPhoto library, the image picker now shows a progress bar as it loads your photos.
  • When deleting users, you’re given the option of storing their data in a disk image (as opposed to just a folder in previous versions).

Please add your own in the comments!

Mint Money Management: A Review

September 21st, 2007

I don’t know where I’ve been for the past few months, but apparently a fancy new money management tool called Mint has been tearing up the internets in private beta. It’s gone public as of September 18, and I’ve been playing with it since yesterday. In a nutshell, although it’s a little light on features, and the interface has a tendency to flake out occasionally, Mint is the best money management tool I’ve ever used.

Features can be added, and JavaScript can be tidied, but Mint at its core gets right what every other tool I’ve used gets wrong: transactions should be added, formatted, and categorized without any interaction from the user. Mint, for the most part, handles this with aplomb. Manual, checkbook-style accounting just doesn’t scale beyond, well, a checkbook, and if you’ve ever used Quicken or Microsoft Money, you know how absurd the existing solutions can be. There are exceptions, which I’ll touch on later, but for the most part, Mint just works.

First Impressions

Mint’s branding is nice, if a bit unoriginal at first glance. For one thing, as Gruber pointed out, the name is already taken. In the Web 2.0 space, there’s Shaun Inman’s analytics program. In the financial space, there’s this UK credit and insurance provider and many others. Lots of competition for Google rankings. Still, I suppose it’s better than a name nobody can remember, or worse, one that no one can spell. Picnik, I’m talking about you here. I can never remember where the K goes or whether it’s paired with a C. Drives me nuts when I don’t have a bookmark handy.

Speaking of Picnik, though, it’s the very first thought that popped into my mind when I saw the Mint website. Picnik seems to have staked out the whole transparent-tabs-over-leaves thing way before Mint came along. It’s a nice look, but I think Picnik does a better job at it. The font on Mint’s tabs is gross, and the blue buttons look out of place.

Mint’s Tabs Mint’s Tabs Picnik’s Tabs Picnik’s Tabs

That said, once you’re inside Mint, things look a lot better. It’s vaguely Aqua-inspired—especially the progress indicators when downloading transactions, which look exactly like Aqua’s, but tinted green. It’s generally handsome and consistent, although it’s a bit jarring when they tweak the look of controls that have become more or less standard. Specifically, the Dashboard-style close buttons, which seem to be popping up everywhere nowadays, have an “x” that says something closer to “handwritten multiplication sign” than “close”:

Dashboard vs. Mint Dashboard vs. Mint

Signing up was relatively painless, and went through after a little while without a hitch. They were taking a pounding from Digg and the like, but handled it well. The signup form is nice and interactive, judging your password strength and matching the confirmation field in real-time. Once you’re in, you’re prompted to set up your accounts, and this is where Mint really shines.

Setting Up Accounts and Importing Data

As I understand it, there are a few ways current applications handle imports. The oldest way is with transaction files that you download from your bank’s website every time you want to perform an update. These files come in a variety of formats with a variety of inscrutable extensions and version numbers, have varying degrees of usefulness, and generally suck beyond words. Some work better than others, but the process of logging in, downloading the file, importing the file, and deleting the file gets old quick. Unfortunately, this system has the most widespread support since it’s the oldest.

If you’ve got one of them new-fangled versions of Quicken or Money or GNU SomethingOrOther, you can sometimes have the program connect directly to the bank. This is only sort of better. Banks sometimes have different logins for this connection than for their web banking, so you’ve got to track down another set of usernames and passwords. What’s worse, there are different versions of the protocol, and you’ve got to make sure that your application supports whatever versions your bank supports. Amusingly, last I checked, Quicken for Mac only supports some ancient version that Intuit charges more money for banks to use, so if you’re on a Mac, the situation is even more dismal. Odds are good, of course, that only a subset of your banks support this direct connection at all, so you wind up with some accounts that are updated daily, and some accounts that are only updated when you do it manually.

Mint works a little differently. You search for your financial institution and Mint asks for whatever it needs to get at your data. For all my banks, this was simply whatever credentials I use for web banking. It doesn’t matter if your bank supports Quicken Exchange Direct Connect Version 9.7, Microsoft Money Interchange File Format Version 5.3, or Quicken For Mac Old and Busted Protocol Version 1.0.1. If Mint can import your data, it’s completely transparent to you how it does it. The significance of this can not be overstated.

Perhaps this is spelled out officially somewhere, but the most obvious explanation for how Mint works is that it simply screen-scrapes whatever it can from your bank’s online interface. This has the advantage of bypassing the insanity that Intuit and Microsoft dreamed up, and generally works pretty well. The drawback, of course, is the cat-and-mouse game of screen-scraping: if your bank changes the HTML on its web interface, it’ll likely break Mint’s scraper. Indeed, as of this writing, my Chase accounts aren’t properly showing transactions, though the balances are correct. The Mint team is already on it, and I’m sure that errors from their scraper set off alarms even before customers start submitting bug reports. In any case, it’s a small price to pay for the flexibility this approach allows. Mint even gathers data about your credit limits and due dates.

As it turns out, Mint does screen-scrape banks’ websites, although this isn’t as much of a clever insight on my part as I thought. Mint contracts this out to a company called Yodlee, a company who specializes in corporatespeak and screen-scraping for financial institutions. I think Yodlee may have special deals with some of the larger banks, as well.

Working with Transactions

Working with transactions is pretty straightforward. You’re given a table of all the transactions for a particular account, and can also view a table with all accounts intermingled. Pretty standard features here. Mint automatically rewrites those transaction names that only a 70s-era mainframe could love into something a little more human-friendly, though I wish it would be a little more conservative. In a few cases, Mint’s rewrites were way off, and less helpful than even what the bank provided. Thankfully, you can choose to make a rule that automatically renames similar transactions, so the problem shouldn’t present itself too frequently. I’m curious to see if Mint learns over time from the community’s collaborative efforts, but suspect it may be too much of a security risk to have Mint “learn” from people’s edits.

Transactions are given categories automatically, and Mint’s better at guessing categories than other software I’ve used. You can’t add categories, but the default set is fairly comprehensive. Like with names, you can set up rules to automatically categorize similar transactions.

Mint handles transfers between accounts very well. Rather than keeping track of them itself, money categorized “Transfer” simply disappears from the source account, and it reappears when the receiving account updates its records. This is a distinct departure from say, Quicken, which tries to manage transfers itself. Often, when you transfer money between two synchronized accounts, Quicken gets confused and accounts for the transfer twice.

One important “feature” of Mint is that you can’t add transactions yourself, which is great, because adding transactions yourself usually just makes a mess. The only downside is that you’re at the mercy of your bank’s records if something goes wrong.

The interface for transactions still seems to be a little buggy in both Safari and Gecko-based browsers. Your accounts are arranged in tabs, and often you’ll click a tab and it’ll highlight as if it were selected, but nothing will happen. That puts the page in kind a weird state that only a refresh will fix. Also, the back button is effectively broken while you’re working with transactions. These kinds of problems are par for the course with “beta” web applications, and I’m sure they’ll be fixed soon enough, but it’s a bit frustrating that it’s become acceptable to launch with such fundamental usability problems.

Charts and Reports

Not much to see here, yet. The main page gives you an overview of your account balances, and a separate “Spending Trends” tab gives you a homely, but useful, Flash-based pie graph of your spending. Some line graphs give you an idea of how your spending habits have changed over time, but I’d love to see a simple line graph of my net worth over a user-selectable period of time. Nothing helps reel in spending like a negative slope.

Spending Trends Pie Graph Spending Trends Pie Graph

Ways to Save

Mint tucks its entire business model into a tab called “Ways to Save.” It’s pretty brilliant—companies can buy ads that are triggered off transactions from competitors. Mint tells you how much you can save by switching to the competitor and presents a signup link. It’s unobtrusive and actually even useful. Of course, as you might expect, Mint is very generous with its projections on how much money you save. Still, as more companies sign on, I can see myself visiting this tab pretty often.

Ways to Save Ways to Save

Final Thoughts

All in all, I’m extremely impressed with Mint. It’s the first application of its kind that you can really just set and forget, and that will probably remain its most compelling feature for quite a while. It’s a bit scary to give all of your financial logins to a single third party, but they seem to take security pretty seriously, so I don’t think it’s a terrible concern for most people. Mint looks like a real game-changer in money management software, and I’m excited to see where it goes as it improves over time.