5 ms·
How utterly boorish. If I could delete the submission I would because I see zero productive value in it, and I'm a bit shocked at the stunning narrow mindedness
by ergo98 16y ago
How utterly boorish. If I could delete the submission I would because I see zero productive value in it, and I'm a bit shocked at the stunning narrow mindedness of so many.
My motive was simply to have a discussion about web security as it's a recurring topic and element fraught with peril on a rapidly changing web platform.
It's telling enough that you keep pounding on the SHA1 thing (despite the fact that I repeated, time and time again, that the computational complexity of the algorithm is of course open because the implementation doesn't exist. 128 rounds of blowfish if you prefer), that you keep misrepresenting the Gawker attack, that you pretend that it's a proposal to replace SSL (no), and so on. "Argument" to you is disagreement with Thomas Ptacek, who time and time again bizarrely gets upvoted without merit or regard for accuracy.
It's a counterproductive discussion.
- tptacek 16y ago128 rounds of Blowfish would still be a password-equivalent hash. You should read up on SRP. Smart people who have spent much more time thinking about this problem than we did have been studying it for over a decade. It's very elegant, it addresses exactly the problem you're talking about, and it's a standards-track technology. It's true, by the way. "Argument" to me is "disagreement with Thomas Ptacek". It would be pretty weird if argument meant something else to me. A long time ago, I was on a comp.security.unix thread when Daniel J. Bernstein said something that has been stuck in my head ever since. Responding to "You appear to be absolutely incapable of realising that there are people in this world who can see more than one side to a question...", he wrote: On the contrary. I see both sides, and I have evaluated both sides, and I have found that one side is vastly superior to the other. This may seem ruthless, but that's how engineering works.
- alnayyir 16y ago>"You appear to be absolutely incapable of realising that there are people in this world who can see more than one side to a question...", Cf. my PayPal discussion. I was fully aware before he decided to come barging in what kind of pressure and legal strictures payment companies and banks must endure in order to do business. I am even a libertarian. That doesn't mean PayPal's conduct is excusable or required by said law, hence my stance in that particular matter. I can be argumentative, but he takes it to a level that leaves me with the impression that he has disregarded the tone we try to maintain here. He's even seen fit to effectively deface the comment thread by deleting his comments without leaving behind a retraction or explanation as to why. (I have in the past deleted or edited comments according to feedback, and a left note of retraction so that people didn't get lost.)
- ergo98 16y agoI was fully aware before he decided to come barging in Do you mean the thread having nothing to do with you where you responded to my post with- "Stop pretending there isn't something horribly wrong with the company just because it suits your rhetoric." I think your perception of reality is a little skewed, and your unmerited, hostile, trollish response has no place on HN. Also your business savvy is, well, non-existent, which was why it was time for that discussion to end. It was another thread where in the end my feelings of PayPal just improved because I saw the class of individual loudly airing their paypal gripes.
- tptacek 16y agoWouldn't it be great if somehow we could not end up arguing about PayPal policies on a thread about password security?
- jacobolus 16y agoGoogle Groups link to the usenet discussion in question, in case anyone is interested: http://groups.google.com/group/comp.security.unix/browse_thread/thread/d9f5a55bd2b5181f/2c109f52f04eecdd?q=%22have+evaluated+both+sides%22 http://groups.google.com/group/comp.security.unix/browse_thr...
- tptacek 16y agoAhhhhh, Nick McClaren. Those were the days. Incidentally, that's a thread that includes Tim Newsham, Wietse Venema, Daniel Bernstein, and Theo de Raadt. Read it! I do not acquit myself well on it. I miss Usenet, but I have gotten much less obnoxious in the intervening decade.
- JoachimSchipper 16y agoI'm not sure that following djb in all things is the greatest idea ever, though.
- tptacek 16y agoIt tends to help in matters of systems programming and security.
- StavrosK 16y agoHaving made a comparable post a few days ago (which, thankfully, didn't receive as much attention), I can understand where you're coming from. Many people view this as "I'm proposing the panacea of web security" rather than "Can't we design something better? Here's my proposal". There are many things you can do to make authentication more secure, and all of them are public. A good way is HTTP digest access authentication, but that won't work for a web app because you have to pass the state yourself, and it can be faked. Therefore, the best way I've found so far is to use SSL, although that SRP RFC might be interesting (I'm reading it right now).
- axod 16y ago> " "Argument" to you is disagreement with Thomas Ptacek, who time and time again bizarrely gets upvoted without merit or regard for accuracy." Found in the code of most HNers brains: if (poster=="tptacek" && subject=="security") upvote(); There are other nicknames who get an auto-upvote on hacker news in their 'realm'. It's just one of those things.
- tptacek 16y agoThat definitely does happen. I also get an automatic 30%>N>5% boost for name recognition; you get one too. It helps to be right, though.
- Groxx 16y agoJust decided to calculate it... Right now, you're up 116 points from this page alone, with an average of 6.4. It also helps when you're active (which debates/battles tend to encourage).