As artificial intelligence continues to rapidly advance, ethical concerns around the development and deployment of these world-changing innovations are coming into sharper focus. In an interview ahead of the AI & Big Data Expo North America, Igor Jablokov, CEO and founder of AI company Pryon, addressed…
Microsoft unveils Phi-3 family of compact language models
Microsoft has announced the Phi-3 family of open small language models (SLMs), touting them as the most capable and cost-effective of their size available. The innovative training approach developed by Microsoft researchers has allowed the Phi-3 models to outperform larger models on language, coding, and math…
Better Web Security Means Less Convenience – For Now
The web makes our lives more convenient. We can order a T-shirt or a pizza with a few clicks. We can conduct global research without leaving our seats. It has changed the way we do just about everything.
As web designers, we seek to add even more convenience. We employ systems to “remember” users. We store customer information in the cloud. These features make it easier for people to get things done.
A seamless user experience is the goal. It’s both well-intentioned and potentially lucrative. There is often a cost when it comes to security, though.
Malicious actors are taking advantage of this convenience. Methods like stealing session cookies are prevalent. Thus, staying logged into your website is a risk.
That’s just the tip of the iceberg. Indeed, making the web more secure means less convenience. Here are a few examples of what that looks like. In addition, we’ll talk about why these measures may be temporary.
Using Two-Factor Authentication Everywhere
It’s becoming harder to avoid two-factor authentication (2FA). This method is in place just about everywhere – including your WordPress site.
The idea makes perfect sense. The extra layer of authentication means a hacker needs more than a username and password. They can’t access your account without a 2FA code.
However, 2FA is far from perfect. The aforementioned stolen session cookies are proof. A hacker with a valid cookie can bypass other login requirements.
Plus, 2FA is a hassle for users. Think about all the extra time it takes to log into each website you use. It makes people want to stay logged in – and run the risk of a stolen session cookie.
Help may be on the horizon. Passkeys are poised to simplify the login process – while maintaining top security.
Passkeys rely on a user’s device to replace a username and password. Users authenticate using the same method they use to unlock their devices. PINs and biometrics are examples.
That may ease the burden. But we’re likely to be stuck with current methods a while longer.
Locked down WordPress Files
The theme and plugin ecosystem are a big part of WordPress. You can add new items or update existing ones. It’s all done within a single dashboard. Once again, it’s a very convenient feature.
The problems start when a user account is compromised. A malicious actor can add all manner of malware. And they don’t have to be an administrator. Some vulnerabilities allow a lesser user to bypass WordPress permissions.
The answer appears to be locking down your WordPress install. For example, a site may allow its staging environment to write to files. That would allow you to add or update software. But it would also be protected by an HTTP login.
The production site would allow for uploading media files – but nothing else. That means any theme or plugin installations must come from staging first. The same goes for updates.
Yes, it’s an extra step. But it’s one worth taking. This method not only increases security. It is also a best practice for testing. It could prevent issues for mission-critical sites.
Not every web host offers staging, though. Or an easy way to lock down an install. But this may be the best option until something better comes along.
Speaking of that, security providers are devising new strategies. That could provide a balance between security and ease of use.
Limiting Code Execution within Site Content
Sometimes, we need to execute code within a site’s content. For example, we might embed JavaScript from an advertising network into a blog post.
WordPress facilitates this via its Custom HTML block. Some plugins enable adding code snippets as well.
It’s a handy feature. You can add all sorts of third-party widgets that engage users. They might also produce revenue.
It’s also an easy way to introduce malicious code. WordPress tries to sanitize input. However, not all themes and plugins follow best practices. Unsanitized code could infect your site – and impact users.
Limiting code execution is one way to prevent security issues. You might disable the Custom HTML block, for instance. You could also create HTTP security headers at the server level.
Artificial intelligence (AI) could soon be a factor. A tool that can detect malicious code in real-time might prevent a successful attack. That would empower users without creating as many security concerns.
A Secure Website Requires Sacrifice
Security puts web designers in a difficult position. We strive to build great user experiences. We want to help our clients to do their jobs with ease.
But we also want our websites to be secure. That requires us to make some difficult decisions. Do we sacrifice convenience for safety?
The answer appears to be “yes” for now. Insecure login methods and writeable folders are risky. So is allowing users to execute code within their content. And it seems that malware continues to thrive in these environments.
As such, closing these avenues of attack makes sense. Even if it creates extra hurdles for users.
We can still hope for a better future, though. The advent of passkeys and AI-driven security might be just what we need. Their time can’t come soon enough.
Related Topics
Top
Meta raises the bar with open source Llama 3 LLM
Meta has introduced Llama 3, the next generation of its state-of-the-art open source large language model (LLM). The tech giant claims Llama 3 establishes new performance benchmarks, surpassing previous industry-leading models like GPT-3.5 in real-world scenarios. “With Llama 3, we set out to build the best…
Mixtral 8x22B sets new benchmark for open models
Mistral AI has released Mixtral 8x22B, which sets a new benchmark for open source models in performance and efficiency. The model boasts robust multilingual capabilities and superior mathematical and coding prowess. Mixtral 8x22B operates as a Sparse Mixture-of-Experts (SMoE) model, utilising just 39 billion of its…
SAS aims to make AI accessible regardless of skill set with packaged AI models – AI News
SAS, a specialist in data and AI solutions, has unveiled what it describes as a “game-changing approach” for organisations to tackle business challenges head-on. Introducing lightweight, industry-specific AI models for individual licence, SAS hopes to equip organisations with readily deployable AI technology to productionise real-world use…
80% of AI decision makers are worried about data privacy and security – AI News
Organisations are enthusiastic about generative AI’s potential for increasing their business and people productivity, but lack of strategic planning and talent shortages are preventing them from realising its true value. This is according to a study conducted in early 2024 by Coleman Parkes Research and sponsored…
Hugging Face launches Idefics2 vision-language model
Hugging Face has announced the release of Idefics2, a versatile model capable of understanding and generating text responses based on both images and texts. The model sets a new benchmark for answering visual questions, describing visual content, story creation from images, document information extraction, and even…
Has Web Design Become Too Complex for Freelancers?
Web designers take pride in being knowledgeable. We help clients navigate challenges and establish their little corner of the internet. We guide them toward success. Doing so requires experience and know-how.
The industry has worked this way for years. However, the situation feels different these days. The job is now akin to untangling a ball of wires. We keep pulling strands while continually finding new knots.
Building websites is no longer straightforward. There is no shortage of moving parts to manage. Not to mention the related technologies we work with. It’s enough to keep freelancers up at night.
So, how did we get here? And what can we do to bring some sanity back to our lives? Let’s try and sort this out together.
More Powerful Websites Equals More Responsibility
Building a high-functioning website was once limited to enterprise organizations. They had the resources to build from the ground up. The rest of us had to settle for less.
That’s no longer the case. For example, there are now eCommerce solutions for all budgets. A freelancer can put an online store together with off-the-shelf parts.
Tools like WordPress and its ecosystem have closed the gap. The benefits are tangible. A highly functional site is now within everyone’s reach. A whole market has opened up for solo entrepreneurs and small agencies.
However, these tools also place a great deal of responsibility on developers. We now have to consider:
- Keeping software up to date;
- Security monitoring and remediation;
- Interoperability with payment gateways, etc;
- Adapting to changes in software;
- Accessibility;
- Privacy regulations;
- Performance;
- Customer support and training;
Large organizations have staff dedicated to these tasks. They should also have the budget and expertise to do the job right.
As for freelancers? Well, we must do all or most of it ourselves. All on a shoestring budget.
Looking after a single website is hard enough. Now, multiply that difficulty by the number of sites you manage. The whole thing seems unsustainable.
Website Issues Are More Complicated than Ever
Odds are, you don’t have time for a broken website. But break they do. And their issues tend to be complicated.
Sometimes, it’s a software incompatibility. Perhaps that plugin update isn’t playing nicely with the rest of your site. You may have to work with support staff to find a resolution. That could take days or weeks.
Security issues are even worse. A hacked website can leave you scrambling for answers. And it can easily monopolize your time. There’s also the possible hit to your (and your client’s) reputation.
Then there are unexpected changes to the software we use. Themes and plugins may undergo major revisions that require developer action. From there, it’s about researching and implementing the necessary changes.
Fixing these issues takes time and money. They also place a burden on freelancers and website owners.
How Do We Simplify This Mess?
Maybe the proverbial cat is already out of the bag. Websites are increasingly complex – and they aren’t going back. Clients aren’t likely to ask us to code like it’s 1999.
Having said that, what are some realistic things we can do to simplify? Here are a few possibilities.
Build Websites According to Need
Yes, modern website platforms are complicated. However, web designers should also share some of the blame.
We often reach for these solutions – even when they’re not necessary. The result is an over-engineered site with a lot of moving parts. Seriously, does a small brochure site need a dozen WordPress plugins?
All of these tools are within our reach. So, we use them time and again. Maybe it’s time to do more with less.
The bottom line is thinking about your current and future needs. Build websites that are as lean as possible – with room to grow.
Take Advantage of Automated Tools
We can’t be everywhere at once. However, keeping track of the websites we manage is a full-time job.
Several automated tools can help. We can employ them to monitor security issues, uptime, and performance. They can also apply software updates.
None of this means we should stop checking these items manually. We still have a responsibility to ensure everything’s working.
The idea is to spot issues and get them fixed more quickly. Automation provides an avenue for busy freelancers to do so.
Shift the Burden Where Appropriate
Web designers tend to take responsibility for tasks outside our expertise. Think email deliverability or information technology (IT) issues. It’s a common problem when working with small organizations.
Advising clients on these subjects is one thing. But maintaining them should be their job. Or they should hire specialists to deal with them.
Too often, we are stuck doing more than we should. Clients naturally come to us for answers. However, each task only adds a layer of complexity to our job. Things can get out of hand in a hurry.
Creating boundaries can help. Define your areas of expertise and stick to them. Inform clients on what you can and can’t do.
They’ll have a better understanding of who to call for specific tasks. And you’ll have more time to focus on the things within your niche.
Web Designers Must Adapt to a New Reality
Being a freelance web designer has never been more complicated. There are so many tools, technologies, and best practices to study. Meanwhile, client expectations are through the roof.
All told, it’s getting harder to do our job. Therefore, we must take advantage of anything that helps us simplify.
Perhaps we also need to take a look in the mirror. How are the choices we make impacting our workload? Where can we make improvements?
The old methods of web design no longer work. Not when there is so much ground to cover. We must adapt to the reality in front of us.
Communication should also be a priority. We need to educate clients about the benefits and drawbacks of a given approach. Together, we can choose what’s right for them with an understanding of the consequences.
The key is to find better ways to assess and manage risk. That will help us transition to the next chapter of our industry.
Related Topics
Top