Access: Is There A Problem Here?: Access

Showing posts with label Access. Show all posts

20110908

Problem ID: 2975892470572104828
Entered by: Ben Simo

Angry unicorn

@nikreiman tweets: Wow, I never saw the angry unicorn error on #GitHub before today

Edit

20110903

Problem ID: 8805208685987402446
Entered by: Ben Simo

But I'm the Administrator!

Why can't an administrator log off a session left open by a non-administrator user on Windows 7?

Edit

20110826

Problem ID: 3344632741764468299
Entered by: Anonymous

Remote performance monitoring of one Windows 2003 server from another that had been working for many months suddenly stopped working. The only thing that had changed was a local administrator account password on the remote system.

In hopes of getting more information as to why remote monitoring was failing to start, I start up Perfmon and try to create a counter for the remote system. It reports "Unable to connect to machine". I was hoping for something more specific.

So, I try from a Windows 2008 system. It gets slightly more specific with "Access is denied."

While it is generally a good idea to not disclose details about failed authentication attempts, a bit more info could be helpful in resolving this problem.

Edit

20110414

Problem ID: 3218160433468091931
Entered by: Ben Simo

You require permission from yourself

So, I need permission to make changes to a folder. Trouble is it says I need permission from the user currently logged into the system -- me, aka myself, aka I.

Edit

20100116

Problem ID: 4163935994383270315
Entered by: Ben Simo

Error on line 142,899,285

patrickhamann: Apparently i have error on line 142,899,285 and character 10,009 of that line. #iefail

Wow, that's a long file with at least one very long line.

Edit

20100113

Problem ID: 6551220649272512055
Entered by: Ben Simo

Passwords in client-side Javascript

Tweeted by MatTipton.

Wow! Don't put your password on a sticky note under the keyboard when you can hide it in client-side Javascript code. This may meet the technical requirements given to the developer but it fails to meet the expectations, and purpose, of access control systems.

Edit

20091231

Problem ID: 7075637522229138243
Entered by: Ben Simo

You do not have enough access privileges

“Syncing my iphone i get this error, and no new DL's from my phone transfer to my mac. Any ideas?” - @zombieskull13

So do I need more permission volume or the correct permissions?

Edit

20091229

Problem ID: 5858217859518321840
Entered by: Ben Simo

English Wikipedia article about Mexico blocked due to Japanese porn?

“Haha! Webfilter blockage fail!” - @alantwentyseven

Edit

20091215

Problem ID: 2464795958386090242
Entered by: Ben Simo

A Useful Tip?

Is this a Useful tip or a request to allow potentially dangerous activity?

What is BTSTAC~1.EXE? Why show the abbreviated 8+3 name instead of the full filename? Where is BTSTAC~1.EXE? What launched it? Is it part of Skype?

What does it mean to Allow access? What are the security risks? If a user clicks Deny access, can they allow it in the future?

Edit

20090604

Problem ID: 7612217920589669178
Entered by: Ben Simo

Useless and Unknown

Got this trying to apply a filter to data in an Access 2003 data table.

If it really is unknown, how does Access know there is something worth reporting to the user? And if there is something worth reporting to the user, why not report it?

Edit

20090228

Problem ID: 8466107561046368346
Entered by: Ben Simo

Access is denied

I have a NAS (Network Attached Storage) device on my home network. This file-server-in-a-box provides a convenient place for family members to store and backup their data to a location that can be accessed from any computer in the house. There are a few file shares on this device that are public -- meaning any computer on the network (belonging to either friends or family) can access them. In addition to these public file shares, each family member has their own password-protected share to which they can save files they don't want available to everyone else.

The NAS device came with software that was advertised to automatically copy files from computers on the network to the file server each time they are modified. When I purchased the NAS device, I planned to use this feature to provide backups in case of data loss and to provide some automated versioning of files. I installed this software on my notebook computer and configured it to monitor a handful of directories to be versioned and backed up to my private file share on the NAS box.

However, there's a problem...

The backup software appears to be properly detecting file changes and attempts to backup data to the file share. However, it fails to write versioned backups to the NAS device. Each time it attempts to save a file, an error is written to a log file stating "Unable to copy file: Access is denied."

It appears that the backup software that came with the NAS device cannot write to password-protected shares on the NAS device. It only backs up data to unprotected public shares. Saving share passwords to the Windows XP Home network password list doesn't seem to help.

Who designed NAS backup software that doesn't support saving data to password-protected file shares? Did no designer, developer, or tester consider that users might want to backup to non-public shares?

Edit

20090226

Problem ID: 2178695720448264769
Entered by: Ben Simo

Problematic Pizza Promotions

Home sick and no food in the house. Not wanting to leave the house, KC goes online to check out the pizza offerings at Shakey's.

KC checks the current promotions.

Today's promotions don't look very tasty. KC reports "I thought to myself 'Bug!' and ordered myself a pizza anyway."

Submitted by KC

Edit

Usability Heuristics

• Visibility of system status Visibility of system status: The system should always keep users informed about what is going on, through appropriate feedback within reasonable time.

• Match between system and the real world Match between system and the real world: The system should speak the users' language, with words, phrases and concepts familiar to the user, rather than system-oriented terms. Follow real-world conventions, making information appear in a natural and logical order.

• User control and freedom User control and freedom: Users often choose system functions by mistake and will need a clearly marked "emergency exit" to leave the unwanted state without having to go through an extended dialogue. Support undo and redo.

• Consistency and standards Consistency and standards: Users should not have to wonder whether different words, situations, or actions mean the same thing. Follow platform conventions.

• Error prevention Error prevention: Even better than good error messages is a careful design which prevents a problem from occurring in the first place. Either eliminate error-prone conditions or check for them and present users with a confirmation option before they commit to the action.

• Recognition rather than recall Recognition rather than recall: Minimize the user's memory load by making objects, actions, and options visible. The user should not have to remember information from one part of the dialogue to another. Instructions for use of the system should be visible or easily retrievable whenever appropriate.

• Flexibility and efficiency of use Flexibility and efficiency of use: Accelerators -- unseen by the novice user -- may often speed up the interaction for the expert user such that the system can cater to both inexperienced and experienced users. Allow users to tailor frequent actions.

• Aesthetic and minimalist design Aesthetic and minimalist design: Dialogues should not contain information which is irrelevant or rarely needed. Every extra unit of information in a dialogue competes with the relevant units of information and diminishes their relative visibility.

• Help users recognize, diagnose, and recover from errors Help users recognize, diagnose, and recover from errors: Error messages should be expressed in plain language (no codes), precisely indicate the problem, and constructively suggest a solution.

• Help and documentation Help and documentation: Even though it is better if the system can be used without documentation, it may be necessary to provide help and documentation. Any such information should be easy to search, focused on the user's task, list concrete steps to be carried out, and not be too large.

Consistency Heuristics

-F amiliar Familiar: The product is not consistent with the pattern of any familiar problem.

E xplainable Explainable: The product is explainable.

W orld World: The product is consistent with the real world.

H istory History: The present version of the product is consistent with past versions of it.

I mage Image: The product is consistent with an image that the organization wants to project.

C omparable Products Comparable Products: The product is consistent with comparable systems.

C laims Claims: The product is consistent with what important people say it’s supposed to be.

U ser Expectations User Expectations: The product is consistent with what users want.

P roduct Product: Each element of the product is consistent with comparable elements in the same system.

P urpose Purpose: The product is consistent with its purposes, both explicit and implicit.

S tatutes Statutes: The product is consistent with applicable laws.

FAILURE Heuristics

F unctional Functional: The error detecting, reporting, and handling functions properly.

A ppropriate Appropriate: Errors are reported at the appropriate time in an appropriate manner.

I mpact Impact: The impact of the failure is communicated to those impacted.

L og Log: The error is appropriately logged; or not logged.

U ser Interface User Interface: The error is reported in the user interface in terms that the user understands.

R ecovery Recovery: The user is informed of what they need to do to recover from the error.

E motions Emotions: The error handling and reporting has a positive influence on user emotions.

Security Vulnerabilities

1. Injection Injection: Injection flaws occur when untrusted data is sent to an interpreter as part of a command. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without authorization.

2. Broken authentication and session management Broken authentication and session management: Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.

3. Cross-Site Scripting Cross-Site Scripting (XSS): XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

4. Insecure Direct Object References Insecure Direct Object References: A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to gain unauthorized access to data.

5. Security Misconfiguration Security Misconfiguration: Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. Secure settings should be defined, implemented, and maintained, as defaults are often insecure. Additionally, software should be kept up to date.

6. Sensitive Data Exposure Sensitive Data Exposure: Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.

7. Missing Function Level Access Control Missing Function Level Access Control: Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization.

8. Cross-Site Request Forgery Cross-Site Request Forgery (CSRF): A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

9. Using Components with Known Vulnerabilities Using Components with Known Vulnerabilities: Running software components with known vulnerabilities can compromise the vulnerable components and anything those components can access -- undermining defenses.

10. Unvalidated Redirects and Forwards Unvalidated Redirects and Forwards: Using untrusted data, without validation, to determine the destination of redirects and forwards can enable attackers to redirect victims to phisihing or malware sites.

Is There A Problem Here?

20110908

Angry unicorn

20110903

But I'm the Administrator!

20110826

Unable to connect to machine

20110414

You require permission from yourself

20100116

Error on line 142,899,285

20100113

Passwords in client-side Javascript

20091231

You do not have enough access privileges

20091229

English Wikipedia article about Mexico blocked due to Japanese porn?

20091215

A Useful Tip?

20090604

Useless and Unknown

20090228

Access is denied

20090226

Problematic Pizza Promotions

Problem or no problem?

Usability Heuristics

Consistency Heuristics

FAILURE Heuristics

Security Vulnerabilities

Popular

Recent Problems

Recent Comments