8 ms·
The habits of practically unhackable people
- danans 12y ago#2:Use HTTPS where it matters. In Chrome "https" is red and struck out: digitalsecurity.intel.com Identity not verified
- gear54rus 12y agoSo does it matter here?:)
- Theodores 12y agoYes. It is about setting an example and practicing what you preach. There is no point in lecturing people about one aspect of security whilst getting the security wrong. You would not buy from an ecommerce site if the https:// https:// wasn't done properly.
- toomuchtodo 12y agoI probably would if I wanted the product enough, knowing I wasn't shouldering the liability using my credit card.
- Buge 12y agoFor me Chrome 41.0.2272.101 m (64-bit) on windows there is no cross out.
- yk 12y agoFirefox nigthly just refuses to connect. The reason is, that the site only accepts a RC4 cypher. $sslscan digitalsecurity.intel.com|grep -i acc Accepted TLSv1 128 bits RC4-SHA
- krylon 12y agoIf irony were made of strawberries, we'd be drinking a whole lot of smoothies right about now...
- AlyssaRowan 12y agoMake that cheesecake and I'm in. No-one who runs a server which only accepts RC4 (!!) with no forward security, and SHA1 signatures, in 2015, should be giving security advice. My daily driver browser has RC4 entirely disabled. This is one of the more amusing won't-connect sites I've found.
- deleted 12y ago[deleted]
- java-man 12y agoUnable to Connect Securely Firefox cannot guarantee the safety of your data on digitalsecurity.intel.com because it uses SSLv3, a broken security protocol. Advanced info: ssl_error_no_cypher_overlap For some reason, many sites, including amazon recommendations, fail to support 256 bit ciphers. I don't understand why.
- freehunter 12y agoNot to mention that the site is so broken that here is what I see on the Hacker News Window 8 app: http://i.imgur.com/tZ3IcwJ.png http://i.imgur.com/tZ3IcwJ.png The left side is what the app picks up as the text of the article. The right side is the page itself loaded in a browser, after it has finished loading all of the scripts and automatically scrolled itself past some contest thing. I'm on a dual-core Atom with 2GB of RAM and the site lags the entire thing. I mean, it's not as impressive as if it were the latest MacBook like some sites lag on, but still. Pretty shitty.
- JshWright 12y ago> For some reason, many sites, including amazon recommendations, fail to support 256 bit ciphers. I don't understand why. I assume you mean AES-256 vs AES-128. If a site is preferring AES-128 ciphers (particularly in combination with other modern cipher suite choices (ECHDE, SHA2, etc)) that's actually a pretty good indication they know what they are doing. AES-256 offers no practical advantage over AES-128. There are no known practical attacks against AES-128, and stretching the key to 256 bits just wastes CPU cycles. In fact, most of the attacks out there that weaken AES to any meaningful degree are those that attack the key schedule used in the 192 and 256 bit versions. tl;dr; Save the planet. Use AES-128.
- deleted 12y ago[deleted]
- tetrep 12y ago>Unable to Connect Securely Very odd. I'm using Chrome with chrome://flags/#ssl-version-min set to TLS 1.2, and I can connect just fine, although the certificate is signed with SHA-1.
- teamhappy 12y agoAnybody else clicked the "think before you click" thing right away?
- krylon 12y agoI did, expecting something along of the lines of "Damn! What did we just tell you?". That was kind of a disappointment.
- TTPrograms 12y agoI sort of thought that https was sufficient for most things on unsecured connections, so a VPN wouldn't be necessary to prevent things like password sniffing. Or is that wrong?
- teamhappy 12y agoAt home TLS is fine. If you're connected to a public wifi using a VPN on top of that is a good idea because you only have to trust one VPN provider (or your own server) instead of every hotel chain, coffeeshop, etc. > sufficient for most things on unsecured connections WPA2 + good TLS encryption (i.e., good cyphers) should be.
- mkinitcpio 12y agoAre you worried about parts of the TLS handshake being intercepted, or something? Because even then that's non-sensitive information like public keys and cipher lists and stuff, no? Or are we worried about side-channel attacks, or weak ciphers being chosen? Just curious about your reasoning for why TLS alone isn't sufficient.
- marcosdumay 12y agoHe's probably worried about those places looking at the sites he connects to, data sizes and other kinds of metadata. But also, there are plenty of sites around with broken TLS that can be intercepted by a man in the middle.
- stu_k 12y agoSpeaking of which, can anyone recommend a good VPN provider?
- TheOtherHobbes 12y agoTorrentFreak has a regular round-up of VPNs: http://torrentfreak.com/which-vpn-services-take-your-anonymity-seriously-2014-edition-140315/ http://torrentfreak.com/which-vpn-services-take-your-anonymi... The comments are probably as useful as the main content. Personally I use AirVPN. They're not expensive, the client is open source, and performance seems good enough for casual use. I'm not sure I'd trust any of the usual VPNs if I needed Snowden-level security. But I don't, so casual use is fine.
- benihana 12y agoA pragmatic one I like to say to non technical people like my mom and sister: - Have a dedicated email password that is different from every other password you use. Let's be honest: You should have different passwords for every site, and you should use strong passwords and a manager, but you don't because you're a normal person. At the very least, be pragmatic and have an email password that's separate from every other service password. The idea being, if your random-service-you-signed-up-for-once.com password gets hacked, and your username was your email address, the first thing an attacker will try to do is use that password on your email. So have a strong email password and trust that your gmail account is less likely to be hacked than your random-service account password.
- mey 12y agoKeePass plus multiple supported clients have allowed me (and my wife) to manage a unique password per account without too much effort. My eyes really opened when my linkedin leak happened and I realised how many accounts shared that same password.
- arjie 12y agoI use LastPass and I can't recommend it enough. It's fantastic and I have different passwords for everything simply because I never bother making passwords. I just hit the random function on it. I still have my email passwords memorized, though. This is honestly the best service I've ever paid for. It has never failed me, and it substantially improves my life.
- seanwilson 12y agoI use LastPass and think it's great as well. I've tried to recommend it to others though and the common reply is "that doesn't sound secure enough for company policy". They don't seem to realise though that their usual approach of sharing passwords over email, using the same password for several logins so it's easy to remember and using easy to remember passwords in general is much more insecure. Services like LastPass make it practical for you to use impossible to guess passwords, different passwords for every site and let you share passwords securely.
- deleted 12y ago[deleted]
- kelvinn 12y ago#6 Disables JavaScript by default
- Zikes 12y agoIt doesn't seem to matter much what I do when every company I interact with gets hacked. I had to replace my debit card this week because somebody halfway across the country tried to use it to buy $400 in gas. They probably bought it from one of the usual black markets, who acquired it from Lowe's, or Jimmy John's, or Sony, or god knows who else got hacked this week.
- groby_b 12y agoWow. Looks trustworthy. "SHARE TO WIN", uses RC4 certificates, AddTrust CA, JS links, tracking cookies galore, no CSP... Yeah, definitely the people I want to talk to about security.
- ArtDev 12y agoIntel does security really well. They set an example how all large companies should do it.
- chatmasta 12y agoIs this part of an Intel content marketing campaign to promote awareness of how difficult operational security is for the layman? Perhaps in anticipation of their new security suite and attempt to "eliminate the password?" Very nice if so!
- sthreet 12y agotwo factor authentication: Things like this are probably the best argument for why I should get a phone, thought I still wouldn't have much use for it. Also, it seems safer to write down your passwords. I mean, someone might physically take it, but that seems less likely than someone digitally taking it.
- sanqui 12y agoI honestly thought all those "Share for a chance to win*" buttons were going to scold you for clicking on them, but they're actually serious...
- gglitch 12y agoHow is using a VPN different/better than tunneling through your home ssh server? Honest q.
- late2part 12y agoUsing either is good. VPN offers misdirective pseudo-anonymization which might help.
- djfm 12y agoIs there any advantage in using a password manager over authenticating with e.g. your google account through OpenID? I usually use my google account to login to websites I care about (most sensitive websites I know provide this facility) and moderately strong but easy to remember passwords for non-critical websites that don't provide OpenID (e.g. a forum I never consult). Of course I have 2FA on the google account and I feel rather safe. Should I be worried?
- mikekchar 12y agoI'm very sleepy today, so I'm going to try not to say anything stupid. If I do, I hope someone will correct me ;-) The basic overview of how OpenID works is here: http://openid.net/pres/protocolflow-1.1.png http://openid.net/pres/protocolflow-1.1.png So if I understand this diagram correctly, you connect to the server that you want to log into. It determines whether or not you are authenticated (probably through cookies). If so, it redirects you to the OpenID server. The OpenID server checks your credentials and returns back to the original server. The diagram does not specify, but I'm guessing the OpenID server has a session cookie for your credentials so that you don't have to log in over and over again. So what are the downsides? 1) The server you want to log in to knows about your OpenID. In other words they can potentially identify you and track you (possibly with the help of Google). 2) The OpenID server knows which sites you are going to and when you are logging into them. It can track all of your movements. I think it would be naive in the extreme to assume that Google does not do this ;-) 3) Without knowing more details I couldn't say, but I suppose it might open you up to Cross Site Request Forgery style attacks. My experience with Google code in this respect is that they are usually extremely thorough about this sort of thing, so I think this is unlikely on the OpenID side. In my sleepy state, I can't really think clearly enough to imagine whether or not there are ways to screw up the code in the server that uses OpenID, though. My employer loves Google and we use a ton of Google services. I am lucky enough to have incredibly technically competent management and they understand the tradeoffs of having Google track everything we do. Because of that, I use OpenID for any other external service that my employer mandates/approves of. I'm pretty careful not to go to OpenID authenticated sites by clicking on links and open them directly, so I feel confident that I can avoid CSRF attacks even if they could be done. I do not use OpenID for personal use. My employer may be happy to have me daily work activities tracked by Google, but as a private individual, I don't really want that. I use an offline password manager: http://www.passwordstore.org/ http://www.passwordstore.org/
- dheera 12y agoI'm not trusting any closed-source password management programs. I generate most of my passwords (different for each service) with from passlib.utils.pbkdf2 import pbkdf2 def gen_password(master_password, domain, n = 0): thehash = pbkdf2((master_password + "/" + domain).encode('utf-8'), b'', 100000 + n, keylen = 16) return base64.b64encode(thehash)[0:12].decode('utf-8') + "$1Aa" I welcome any comments on the security of this scheme.
- dikaiosune 12y agoI applaud you for being crypto-conscious (and confident) enough to write your own pw generator, but I think it's important for there to be commodity options available to those of us who aren't. Also, as far as closed vs open source: http://keepass.info/ http://keepass.info/
- bostik 12y agoThat may look sane, but you're deriving all your passwords from a single master "key". Leak it once, for any reason, and all your passwords just became known. (Unless you provide unique value of 'n' for each site, which I doubt you do.) If you use a common login or email address as your user name across the sites you use, they all pop open at the same time. My take on password generation is even more straightforward: % head -c 9 /dev/urandom | base64 Then whatever comes out, I store on an encrypted volume - so effectively I do have a master passphrase but none of the login credentials are derived from it. For sites that I think require even more entropy, I'll just bump up the number of bytes read. (98 = 72 bits of entropy, 128 = 96 bits) I haven't yet found a password manager I truly liked. EDIT: you do realise you are capping the entropy of your per-site passwords at 72 bits? It's more than enough against all practical brute force attacks, but it also means that any entropy in your master key above 72 bits is effectively lost.
- deleted 12y ago[deleted]
- dheera 12y agoI don't store my master password anywhere or execute this generator on a device that I don't own. The main problem with fully random passwords is that I need to carry my encrypted volume around with me everywhere, and also worry about backing it up. Yeah I realize it is being capped at 72 bits -- the main reason is that I've seen a bunch of websites that don't allow passwords longer than 18-20 characters or so. :-/
- nullc 12y agoFirefox nightly / built from development source refuses to connect to this site because it fails the (experimental) stronger SSL/cert requirements. (The site forces RC4) On the habits of practically unhackable people indeed.
- vacri 12y agoSpeaking of password managers, what are some suggestions for password managers for sharing passwords around groups of staff in small businesses? We're currently using passpack, but the UI is a little janky - as a result, it's hard to get colleagues to practice good password hygiene. It's not terrible, but it is a bit annoying to use.
- frik 12y agoTriva: Intel Security Group, (previously McAfee, Inc. named after its founder named John McAfee, recently renamed because of the tainted brand): http://en.wikipedia.org/wiki/McAfee http://en.wikipedia.org/wiki/McAfee , http://money.cnn.com/2014/01/07/technology/security/intel-mcafee/ http://money.cnn.com/2014/01/07/technology/security/intel-mc...
- iamfeek 12y agoPhew.. Great to know that I have those traits!
- kate4567 12y agoHACK ATM AND BECOME RICH TODAY How to hack an ATM MACHINE or BANK ACCOUNT You can hack and break into a bank's security ATM Machine without carrying guns or any weapon. How is this possible? First of all we have to learn about the manual hacking of ATM MACHINES and BANKING ACCOUNTS HOW THE ATM MACHINE WORKS. If you have been to the bank you find out that the money in the ATM MACHINE is being filled right inside the house where the machine is built with enough security.to hack this machine We have develop the special blank ATM Card which you can use in any ATM Machine around the world. this card is been programmed and can withdraw 2000 USD within 24 hours in any currency your country make use of. The card will make the security camera malfunction at that particular time until you are done with the transaction you can never be trace. getting the card you will forward the company your address details so we can proceed to send the card to you once you agree to the terms and conditions. you can contact us on email now atmmachinehackes@gmail.com