<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Big Red Tin &#187; security</title>
	<atom:link href="http://bigredtin.com/tag/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://bigredtin.com</link>
	<description>Thoughts about the web and business from the large pantry</description>
	<lastBuildDate>Wed, 08 Feb 2012 06:55:38 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
<xhtml:meta xmlns:xhtml="http://www.w3.org/1999/xhtml" name="robots" content="noindex" />
		<item>
		<title>Confirming a caller&#8217;s identity</title>
		<link>http://bigredtin.com/2009/confirming-a-callers-identity/</link>
		<comments>http://bigredtin.com/2009/confirming-a-callers-identity/#comments</comments>
		<pubDate>Mon, 21 Dec 2009 00:23:10 +0000</pubDate>
		<dc:creator>Peter Wilson</dc:creator>
				<category><![CDATA[Business]]></category>
		<category><![CDATA[ATO]]></category>
		<category><![CDATA[phishing]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://soupgiant.com/?p=312</guid>
		<description><![CDATA[The ATO called me last week and asked for my middle name and date of birth to confirm my identity. I told the operator that I wasn't in the habit of giving out my personal details to incoming callers.]]></description>
			<content:encoded><![CDATA[<p>The <a href="http://ato.gov.au/">ATO</a> called me last week and asked for my middle name and date of birth to confirm my identity. I told the operator that I wasn?t in the habit of giving out my personal details to incoming callers.</p>
<p>Rather than try to convince me that anyone could answer my mobile phone, the operator agreed it would be foolish to give out such details. He gave me his extension number, and a phone number where I could verify he was from the tax office.</p>
<p>Being the cynical sort, or paranoid (I&#8217;ll let you decide), I googled the ATO&#8217;s website to confirm the number. It was legitimate. I called back and reconnected to the operator immediately. The entire process took less than 30 seconds.</p>
<p>It got me thinking: Googling &#8216;&lt;number&gt; site:ato.gov.au&#8217; in hope the ATO had slipped up and the non-public number was on their website was an inefficient step.</p>
<p>A more efficient way to confirm the number would be for the operator to give out an ATO URL: <code>ato.gov.au/&lt;number&gt;</code> being the logical choice. At the URL, there could be a short message informing the visitor that the number is an ATO phone number. <a href="http://en.wikipedia.org/wiki/Robots_exclusion_standard">Robots.txt</a> would be used to exclude search engines from indexing that URL.</p>
<p>It&#8217;s a simple fix that costs the ATO very little and protects them and their tax payers.</p>
<p>I was running this idea past fellow giant <a title="Josh Kinal" href="http://bigredtin.com/author/josh">Josh</a>, and he put forward a problem with my solution. Rather than spoil the fun, I&#8217;ll let Josh put forward his side of the story at a later date.</p>
]]></content:encoded>
			<wfw:commentRss>http://bigredtin.com/2009/confirming-a-callers-identity/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Links opening in new windows</title>
		<link>http://bigredtin.com/2008/links-opening-in-new-windows/</link>
		<comments>http://bigredtin.com/2008/links-opening-in-new-windows/#comments</comments>
		<pubDate>Tue, 08 Jul 2008 07:23:57 +0000</pubDate>
		<dc:creator>Josh Kinal</dc:creator>
				<category><![CDATA[Behind the Websites]]></category>
		<category><![CDATA[html]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[usability]]></category>
		<category><![CDATA[xhtml]]></category>

		<guid isPermaLink="false">http://soupgiant.mu.pwcc.cc/?p=158</guid>
		<description><![CDATA[Yes I have firm views. Take that as a given. Since long before I could code, however, I've always been critical of websites that open their links in another window.

Back in the days before browser tabs, a whole new window would open either above or below the window you were currently working on. It was terrible and unstoppable.]]></description>
			<content:encoded><![CDATA[<p>Yes I have firm views. Take that as a given. Since long before I could code, however, I&#8217;ve always been critical of websites that open their links in another window.</p>
<p>Back in the days before browser tabs, a whole new window would open either above or below the window you were currently working on. It was terrible and unstoppable. People kept up this practice because they thought it was a good way to get a user to keep their website open. It was seen as an audience retention device.</p>
<p>The browser belongs to the user. The website belongs to the creator. The website should not perform any actions on the browser that the user cannot control. That should almost always be the situation.</p>
<p>By keeping things uniform we can set expectations with the user that links will always open in the same window and if they want to open the link in another window they have options like middle-clicking or context-menus.</p>
<p>Of course there are exceptions to this. Banks often open up a separate window for logging in and doing actual banking because they can ensure an extra level of security if, when logging out, they can close the whole window.</p>
<p>The best way to keep a user coming back to your site is to have compelling content. They can always come back by pressing the back button if they meant to open in a new window but forgot.</p>
<p>Another problem with opening links in new windows comes with reporting. Reporting and analytics is another post for another time but many people still use the metrics of a visiting time. The time a user stays connected to a site become a dirty statistic if they actually navigate away from the page but it stays open in a seperate browser window. The website owner doesn&#8217;t really have an indication of how useful/entertaining/compelling their site is, all they know is they could fool some script into thinking that people were still there even when they weren&#8217;t.</p>
<p>These are just some thoughts. Many theories abound in any workplace so I&#8217;m sure yours has some too. Feel free to let me know in the comments.</p>
<p><em>UPDATED: This post was inspired by a discussion, in turn inspired by an article in <a href="http://www.smashingmagazine.com/2008/07/01/should-links-open-in-new-windows/">Smashing Magazine</a>.</em></p>
]]></content:encoded>
			<wfw:commentRss>http://bigredtin.com/2008/links-opening-in-new-windows/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

