Jpm Us Value A Discussion Threads

[aliennag] 09/11/2012 09:16

It's a shame that ADVFN haven't clarified exactly what "unrestricted access" means for a Java applet, requiring us to research it for ourselves. My conclusion is that it means access outside the Java sandbox, but subject to the access permissions of the user running the browser. So if you run as an administrator (bad practice obviously), "unrestriced access" includes access to system files etc. and constitutes a severe security risk IMO. If you run as a limited user, "urestricted access" broadly means access to your user files etc.

Having been made aware of the issue, I've decided I don't trust the ADVFN monitor enough to grant it access to the files of my main user. So I've set up a new "Sandbox" user with the minimum access permissions practicable and am running the ADVFN monitor as that user.

(For the uninitiated, you don't have to switch from one user to another to run the browser as the second user. Just use the "Run as" option on the browser right mouse menu. To make life easier, I've set up a link on my desktop which uses the runas command to do the same. I've customised Internet Explorer's title bar via the registry to make clear what user it's running as.)

Paranoia is good!

[melton john] 08/11/2012 19:55

Always good to be questioning, but as a long time computer engineer having worked on many multi-user, multi-programming operating systems, I am happy that modern Windows systems are, subject to some precautions, pretty secure.
I don't claim to be Java expert, but I think that the point is that the certified Java applets are running on a Java virtual machine on YOUR computer. They request that data is down loaded and stored for later use. This isn't the same as an unauthorised external program being able to read and write to your disc drive and neither does it mean that execute privileges from one program can be hi-jacked by another. As was previously mentioned, if you browse from a non privileged (not administrator) account which you really should do, these applets can only access files belonging to the user and can't install trojans, key loggers etc in other accounts. I run my laptop this way and only use the admin account rarely.
As an aside, if you are worried and don't have anti-virus/anti-malware software, you can download a free package from Microsoft which I have found to be highly satisfactory. It's called Security Essentials.
Thanks for the explanation ADVFN.

[pvb] 08/11/2012 16:47

Thanks to ADVFN people for explanations. I seem to remember we have been round this loop before! It's just that when it raises its head periodically it just reminds you how non secure current IT technology is.

[miss anne thrope] 08/11/2012 15:15

Ta John, interesting stuff!

[jgpgw] 08/11/2012 15:13

Hi MAT,

You can get non-java quotes and charts if you'd like. Bear in mind these will not stream though, the data is static and will be delayed by 15 minutes.

We are currently working on non-java streaming versions of Monitor, Quote, Charts and Level 2, which could be ideal for you if you don't want to use java.

I should make it clear though that pretty much any website you visit will access your computer, download data to your hard disk and access it to help pages load the right content quickly and identify you, both during your visit and on your next one.

John

[miss anne thrope] 08/11/2012 14:31

Thank you for the explanation, which I fear has only added to my apprehension.You say you are merely repeating the process of certification after three years, however if I have been allowing you free access to my hard disc for that period I was unaware of it, and I certainly am glad you alerted me to that fact.

I shan`t use Java stuff here anymore, the bb`s don`t need it, and I shall add to your coffers reading the ads there -lol- oh as an AFN shareholder I would be remiss not to,

cheers.

[michn] 08/11/2012 14:19

Hi cat100,

Try to click on the top right corner of Google Chrome on .

Scroll down the page till you find Privacy and click on "Content Settings".

Check you Java Script option: "Allow sites to ask to become default handlers for protocols (recommended)" must be ticked and "Run automatically (recommended)" as well.

Let me know if it works.

Mike
ADVFN

[ray_d] 08/11/2012 13:27

cat100 try clearing the ADVFN fodler too. Go to My Computer > C Drive > USERS > [Folder with your name on it] and delete the folder marked ADVFN. Then try logging back into Chrome.

[cat100] 08/11/2012 13:07

Mike re installed chrome and still not workinf :-(

[michn] 08/11/2012 12:24

Hello cat100,

Please, have a look on your Control Panel > Programs and features to see how many version of Java you have.
If you find an old one, just unistall it and keep the most recent.

It's likely you just need to activate the plugin if you are using Mozilla Firefox.

Please, give me a call on 0207 0700 961 and we can try to get it sorted together easily.

Mike
ADVFN

[cat100] 08/11/2012 12:21

It works with fire fox

[cat100] 08/11/2012 12:14

I'm being asked to download java I have done this several times, I also deleted older versions and advfn is still not finding java. I'm using windows 7. I'm not getting the agree to run message. Any ideas .... I use chrome

[jgpgw] 08/11/2012 11:43

Hopefully they'll get their certificates renewed at some point, the NASA tools are fun to play with, even if they are mostly way over my head.

John

[ukinvestor220] 08/11/2012 11:38

Unfortunately the 4D orbit viewer fails to launch because the certificate has expired!
Anyway i take your point and thank you for the explanation.

[jgpgw] 08/11/2012 10:39

Hi AlienNag,

The first time you used the streaming prices you would have had to do this as well, tick "Always Allow" and then Run. That has always been the case. As our certificates are valid for 3 years and they were coming up for expiry, we have renewed them. The certificate is new (although it is for the exact same software), so requires you to accept it anew.

The certificates are updated, but the monitor does still need access to read and write to your hard drive. This means you don't have to re-download the java applet components (around 2MB) every time you load the monitor, as you can load them directly from your hard drive. It also helps with your load times on charts; historical price data is downloaded to your computer the first time you look at a symbol, but can be loaded from your hard drive after that.

The java applet itself is unchanged, only the certificate has changed. We have renewed it now that the old one has expired.

------------------------------------

Miss Anne Thorpe,

Other sites that use java applets and have them signed by a reputable company like Verisign/Symantec will also throw up a similar message when you first use their applets. The certificate verifies that the code is not harmful. Here is some info on "" from Symantec, who provide the Verisign certificates. It is from a developer's perspective, but might help to put your mind at rest.

What is code signing and why do I need it?
When customers download applications online, install plug-ins and add-ins, or interact with sophisticated web-based applications, they must trust that the code is authentic and has not been infected or altered. In traditional software sales, a buyer can confirm the source of the application and its integrity by examining the packaging. Code signing creates a digital "shrink-wrap" that shows customers the identity of the organization or individual responsible for the code and confirms that it has not been modified since the signature was applied. Symantec Code Signing protects your brand and your intellectual property by making your applications identifiable and harder to falsify or damage with a digital signature.

------------------------------------

New Tech & nkm,

a) The applets access a folder called "advfn", which is found in your user folder. On Windows 7 that would be at C:\Users\[YOUR NAME], in other operating systems it may be elsewhere. The applet accesses the java software installed on your computer. The applet also talks to your browser so that it can be positioned in the right spot on the page etc. As with any piece of software, it needs to access various resources in order to operate.

b) It sends back information on whether or not you have already downloaded the components and/or historical price data. The applet will also let us know the console output in the event of a crash, so we can improve the software and eliminate bugs.

c) It is dormant when you are not using ADVFN, in the same way that for instance MS Word or other code on your hard drive is dormant when not in use.

d) When you have an ADVFN page open that contains an applet it will be streaming data to you, regardless of whether you have a non-ADVFN webpage opened at the same time.

------------------------------------

gwguest,

We need access to the hard drive so we can store the componenets for the applet and historical data for things like charts. This makes pages load faster for you as you can pull the data directly from your hard drive, rather than the internet. It also makes pages load much faster as we don't have to deliver the java applet components and historical data every time someone loads a page, our server load is greatly reduced.

You have to confirm you are happy with the certificate as it is new and the old one you confirmed you were happy with has now expired. The components and software remain unchanged, only the certificate verifying that we are reputable has been renewed. Please bear in mind that the certificate is there to provide re-assurance that there has been a third party stamp of approval.

Other investment sites do use Java, but I do not know of any that get their applets signed by a reputable third party like Verisign/Symantec. Personally, I would be much more inclined to trust software that has been OKed by a third party than software that has not.

I used "should not mean" as AlienNag may well use the site on a different computer at some point, meaning he will have to hit OK again. I said "make sure to tick the box" not as a threat, but because if you don't, you will have see the message every time you come to one of our pages that uses a java applet. If you tick the box you will not have that inconvenience.

------------------------------------

ukinvestor220,

Not all websites get their code signed off, but there are definitely others that do. For instance, the NASA website will show the same message if you try to run its java applets. Here is a 4D orbit viewer that requires it (you'll need to hit "Launch", a better button than "start" for a site about rockets):

------------------------------------

pvb,

As with pretty much any bit of software, Java needs access to lots of bits of code on your computer to function, not just the stuff it has downloaded from ADVFN.

John

[investoree] 08/11/2012 10:32

I to have serious concerns about this issue of allowing unrestricted access to my computer and would be grateful if ADFVFN could respond fully to New Tech's questions.

[new tech] 08/11/2012 09:39

ADVFN, please would you mind responding to my earlier post:


New Tech 7 Nov'12 - 21:14 - 15 of 22 edit

Does this give ADVFN the ability to look inside my computer or access any information on my computer either directly or indirectly?

Please detail:

a) All information it can access on my computer.
b) All information it can send back to ADVFN or elsewhere.
c) What is it doing when I am not logged onto ADVFN.
d) What it is doing when I am logged onto ADVFN but I have another non-ADVFN webpage opened at the same time, such as a share dealing account.

[aliennag] 08/11/2012 09:38

The plain fact is that we're now being asked to grant the ADVFN monitor unrestricted access to our computers, whereas previously we weren't.

The warning doesn't say what unrestricted access means but if access were entirely unrestricted, it would include access to system folders, files and registry entries and constitute a severe security risk. It's not paranoid to be concerned about this!

ADVFN need to explain why we're seeing the new warning message, and precisely what it means. It's not enough to brush it off by saying nothing has changed except the certificate.

[pvb] 08/11/2012 09:08

Is ukinvestor220 being 'paranoid'? And anyway, isn't being 'paranoid' the safest approach to security with a networked PC?

Obviously people are quite reasonably concerned if their file system in general can be read by an external application. Why wouldn't they be?

Is it the case that the Java program could read existing user files, or only files/directories it has created on your PC?

[ukinvestor220] 08/11/2012 09:01

is that not then a security flaw in java .... what is to stop some rogue application hijacking my unrestricted access applet and causing limitless damage?
I think your suggestion of paranoia is patronising - i would trust my banking software but not ADVFN, based on the proliferation of random live and untested changes on here.

[g0mer] 08/11/2012 06:46

They renewed a certificate so your computer doesn't recognize it - you had to accept the old certificate or you wouldn't have been running the applets up until now. Accept it an move on with your lives, nothing changed except the old cert expired.

Get a computer education and learn what you're supposed to be worrying about so you don't look stupid - must be tough for the tech-help guys not to tell people to take their computers back to the store because they don't deserve to own one.

[gwguest] 08/11/2012 04:47

John
You play down the access ADVFN makes to our computers. So why do they need 'unrestricted access'?
Why does the updating/renewal of ADVFN's certificates require us to declare our trust in ADVFN and put our computers at risk?
Which other financial sites make this requirement?
Then there's your subtle use of language; 'make sure' is not just a caution, it is a threat; 'should just mean' implies that it just might not mean.
GWG

[nkm] 07/11/2012 21:23

You really need to directly answer the question posed by New Tech if you want
us to trust you.