ZoFreX

15 ms·

91.
by ZoFreX 10y ago
My key criteria for any password method is "what if everyone uses it?". If a major PWM fails, and lots of people did something like this, you can bet your boots that password crackers would give it a go and retrieve your real pass
92.
by ZoFreX 10y ago
Obviously there's a trade-off between security and convenience here, and that's a very personal choice to everyone, so I'm not going to argue that part of things with you. I do have to point out a couple of things though. Pas
93.
by ZoFreX 10y ago
Doesn't that mean Apple has access to all your passwords, though?
94.
by ZoFreX 10y ago
> I'm so worried about sharing my passwords with ANY third party. Eventually they all get owned... 1) Many password managers are designed specifically to survive the website being owned. I use LastPass and I'm not sharing my pa
95.
by ZoFreX 10y ago
That's a big claim. Can you share some of the actual wording of the questions?
96.
by ZoFreX 10y ago
> I wasn't extremely supportive of the interviewee once he turned slightly sarcastic and rattled off hexadecimal bytes instead of just saying "SYN" and "ACK," though. His response: > in hexadecimal: 0x02, 0x12
97.
by ZoFreX 10y ago
I was deliberately careful with the wording - yes, in distributed systems, we may be unable to determine which event came first. But one of them did happen first in reality, we just can't tell which. However, in some cases (see the Wik
98.
by ZoFreX 10y ago
I have two suggestions, one useful and one less useful: 1) Given two events that happened in two different locations, one happened before the other or they happened at the same time [1] 2) All the devices comprising your system will agree o
99.
by ZoFreX 10y ago
I love this advice. I think it would apply to talks and presentations too, there's often an awkward and unnecessary pre-amble.
100.
by ZoFreX 10y ago
This is about Macbooks, not phones, but it's interesting background on your question nonetheless: https://media.blackhat.com/bh-us-11/Miller/BH_US_11_Miller_B...
101.
by ZoFreX 10y ago
Can you disclose what the limits of that experiment are, and highlight on the website when they are exceeded? For example, I assume if you tested apps sized 0mb-200mb, the data does not extrapolate as far as Hearthstone, which clocks in at
102.
by ZoFreX 10y ago
No - salts mean that the same password hashed twice will give different results, which prevents the use of lookup tables, and trivially discovering users with the same passwords. Given a hash and a salt, you can still verify what the passwo
103.
by ZoFreX 10y ago
An additional thought: Even if you can't crack a bcrypt hash (say they picked a sufficiently complex password), you can still verify it given a particular plaintext password. So you could go through a database and discover users that a
104.
by ZoFreX 10y ago
> Not just the theory, but go download the software and actually do it. And now that hashcat and oclhashcat have merged[1] and are open-source[2] it's never been easier to install hashcat and start cracking passwords! [1] https:&#x
105.
by ZoFreX 10y ago
One of the EasyAcc 5 port chargers looks literally identical to the Anker one. I suspect at least one of them is re-badging?
106.
by ZoFreX 10y ago
Really? I will claim you will not meet many engineers who know more about Tcl than I do, and I can't remember whether it's TCL or Tcl. The absence of that knowledge has not impeded me from editing the Tcl interpreter itself. I am
107.
by ZoFreX 10y ago
No, it is not safer to not use 2FA. That SMS is easy to hijack does not mean that password+SMS 2FA is weaker than just a password. It's important to separate out two separate things that we've seen happening - and the media has
108.
by ZoFreX 10y ago
I've seen this happen over and over again in American culture. One of my most common pieces of feedback to managers centers on this, in fact. Time and time again I see managers who _think_ they are able to give feedback as "one of
109.
by ZoFreX 10y ago
The article draws an explicit line between giving feedback as a coworker and as a manager. If you didn't get that, rather than reproducing the arguments here I humbly suggest you re-read it.
110.
by ZoFreX 10y ago
The article is not saying that teams should avoid comments and criticism, nor is it saying that there is no middle ground between perfection and needing scrapping. The article is pointing out that it is _particularly dangerous_ to give crit
111.
by ZoFreX 10y ago
> "I like to do it like this..." They will then be encouraged to try your method and they might like it The danger here is that this will often be interpreted as "my boss wants me to do it like this", and they will do
112.
by ZoFreX 10y ago
To be fair they were talking about pentesters, for whom port scanning is usually on the table, and breaking the law is not.
113.
by ZoFreX 10y ago
The timing attack described here is really interesting to me but I'm not totally convinced it's feasible. That said, that's what a lot of people thought about other timing attacks over networks and they turned out to be total
114.
by ZoFreX 10y ago
Where has the code for the nuts and bolts of the crypto come from (e.g. everything in the "crypto" folder)?
115.
by ZoFreX 10y ago
Others here have explained the benefit - instrumenting. I will add: you do have the option of not instrumenting when using AFL, but instrumenting is a _lot_ faster - so much so that it is completely worth the extra effort. (It's actual
116.
by ZoFreX 10y ago
Say an account gets hijacked, I want to invalidate all the sessions. How do I do it? I have no list of all the sessions that are currently out there for them. Also: I am thoroughly unconvinced that keeping a short list of data synced across
117.
by ZoFreX 10y ago
Your architecture being microservices doesn't change the problems with using JWTs (or any "session" system based on signing things): you can't revoke them. I am pretty confident being unable to revoke tokens will start t
118.
by ZoFreX 10y ago
This is a useful discovery though, as it points you towards the fact that as well as running as super user (the default) sudo can run a command as any target user (e.g. `sudo -u zofrex dosomethingevil`).
119.
by ZoFreX 10y ago
"Software security suffers" [citation needed] This article is a mix of facts and opinions and it plays pretty fast and loose with which are which.
120.
by ZoFreX 10y ago
> it has the distinctive keffiyeh chequered pattern No, it has the equally distinctive and extremely popular and well-known "Houndstooth" pattern.

More ›