3 ms·
"because security by obscurity has such an awesome track record." Please elaborate on how you feel that security for linkedin would be better if they talked ab
by larrys 14y ago
"because security by obscurity has such an awesome track record."
Please elaborate on how you feel that security for linkedin would be better if they talked about the new specific security measures they've implemented.
- IvoDankolov 14y agoGood security is safe in spite of knowing exactly how it works. While revealing the exact details does not make an algorithm less vulnerable, it should not make it more so. And if it turns out that you are using a flawed solution, talking about it early will, at the very least, get people to yell at you as to what you should do instead. In this age, the best security algorithms are usually the one most talked about. The more you test it and the more people you get to look at it and write theorems and papers about size of the search space, results from various attacks and so forth, the better.
- deleted 14y ago[deleted]
- mcantelon 14y agoPeer review.
- jlarocco 14y agoIf they had talked about storing unsalted passwords in the first place, this whole thing may not have happened because somebody would have told them, "Hey, that's dumb" before the leak.
- larrys 14y agoWe're talking about a major corporation here. They can pay for and hire the appropriate security experts (even more than one firm) and find something like that out.
- jlarocco 14y agoIf they weren't competent enough to do that before, what makes you think they're competent enough to do it now? For all we know, they've "fixed" the issue by switching to unsalted MD5 password hashes.
- andrewcooke 14y agoand how would you know, if they don't explain what they did?