Insecure Blogging

[Paul Keith]

From: http://www.dscoduc.com/post/2008/03/14/Insecure-blogging.aspx

I use Windows Live Writer to write my blog entries and have been extremely happy with the functionality.  Last week I started thinking about how exactly the connection is made from WLW to my web server to upload my blogs.  After a little research and a few emails back and forth to the Windows Live Product Group I discovered what I feared the most:  WLW sends over your credentials in the clear text.

So what happens when you fire up WLW?  Here is what the communication looks like to the naked eye:

[attachimg=#]

Yikes!  You can clearly see that included in the XML content is a username and password, for all to see.  And what's worse is that you don't even have to post anything as simply starting up WLW will send this information out in the clear!  I cringe when I think about the blogging I may have done on a public wireless network.

[f0dder]

So, really not Microsoft's fault... except that they should warn when not connecting through HTTPS://...

Oh, and somebody beat up the guy who writes that blog until he makes links stand out from the rest of the text.

[app103]

At least this is fixable with a work around.

The other issue I discovered, I can't seem to find a way around it that will allow me to upload images to Blogger in WLW, without a privacy/security risk involved, that sits in my blogs for the entire world to see.

That issue relates to giving out your GMail address/Blogger username to the whole world, as part of the image url. (this one is Google's fault)

When selecting the option to upload your images to Blogger, WLW uploads them to it's own album in PicasaWeb (in your account) and embeds the image with the URL given by Picasa. The issue is that your email address, which is also the username you use to log in to Blogger, is in the URL. (my username is different than the name used to sign my posts, for security/privacy reasons)

The only ways around this is not to upload the images to Blogger with WLW, and either configure WLW to upload them to your own FTP server and hotlink them or using Blogger's web based post editor to insert the images, so they will get a better URL that doesn't give away this kind of info.

Not everybody can use the FTP option, though, and even those that can upload the images to their own server may have hotlinking issues if their hosting company blocks that. Plus if the server goes down, you end up with a blog full of broken images. This happened to me and affected 10 blogs for over a week, while the hosting company sorted out it's issues.