latitude

22 ms·

181.
by latitude 14y ago
It was a joke.
182.
by latitude 14y ago
It just occurred to me that a free service of notable popularity can be capitalized on, and without resorting to ads. You use the service - you follow me on Twitter/Facebook/elsewhere. You get the service, and I get an ear to promote my o
183.
Followware(dribbble.com)
18 points by latitude 14y ago|16 comments
184.
by latitude 15y ago
I rebuilt my own site - http://swapped.cc - not exactly "in March" though... it took closer to 9 months :)
185.
by latitude 15y ago
No, it does not :) http://news.ycombinator.com/item?id=3689024 And I didn't downvote you (not that I even can ).
186.
by latitude 15y ago
> you might as well check if it matches the full hash It is possible to look at the sun in a telescope, but only twice in a lifetime :) What you say is possible, but I don't know how to coalesce the need for near real-time respons
187.
by latitude 15y ago
Author's here. Reading the comments I feel like clarifying a couple of things :) --- Clarification 1 --- The goal of "hashing/reduction" step is to sort all possible passwords into M buckets. Then when a hint request comes in, we check if
188.
by latitude 15y ago
What's amusing is that you are trolling. There is no "password nearness". The entered password is either in the same bucket (identified by an N-bit ID) as the stored password, or it is not. That's it. In former case the hint indicator is bl
189.
by latitude 15y ago
Yep, it's probably the server creaking under the load indeed.
190.
by latitude 15y ago
Well, for this part - it's better to see confirmation before submitting rather than submit and wait for confirmation doesn't seem to make sense. Personally I feel less comfortable with an outright rejection ('Username/password is wrong' i
191.
by latitude 15y ago
It's not meant to be an argument, it's meant to establish the context. Especially considering how way off the mark the original comment was.
192.
by latitude 15y ago
Thanks for the blue outline report. Should be fixed now. The idea is that the purpose of the indicator becomes obvious after some repeated use, and that it is not too intrusive or distracting on its own to be confusing to the new users.
193.
by latitude 15y ago
> If the password doesn't match, why not just show a big red cross.. It wouldn't look as cool :) I was actually considering changing the text color on the password field on a match. Starting with gray and turning it black if there's a m
194.
by latitude 15y ago
> you seem to be treating it like a breakthrough of some sort Hahahahaha... seriously, where? What does make it seem that way? This is few hours worth of effort. That damn indicator took the longest to draw. Here, have a look at runne
195.
by latitude 15y ago
False positives are needed to mitigate the risk of brute-forcing abuse.
196.
by latitude 15y ago
http://news.ycombinator.com/item?id=3689024 ?
197.
by latitude 15y ago
> The first step from your "How It Works" section is this Surely you must realize that there's more than one way to sort random strings into 2^N buckets. If you feel like criticizing, go for the general idea. Nitpicking on the impleme
198.
by latitude 15y ago
> How do you stop this from being used to brute force passwords? There's the whole section that talks about that.
199.
by latitude 15y ago
> it's all quite silly Which part exactly?
200.
by latitude 15y ago
> displaying a random symbol along the side until the password matches completely This is exactly what it does. See this comment for details - http://news.ycombinator.com/item?id=3689051
201.
by latitude 15y ago
Glad you asked :) Indicator has two states - gray and black. Gray is further animated as a visual gimmick, the actual arrangement of it has no meaning. The idea is that the animation gives you visual feedback on typing and the change of col
202.
by latitude 15y ago
> But these "classes" have no meaning. What do you mean? They work for my purpose, which is being able to tell "password" and "passwrod" apart. There will be false positives, of course, but an (educated) assumption is that they are no
203.
by latitude 15y ago
> Which hash function did you use? There's nothing on the backend, just one hardcoded username and password. All it does is takes an sha1 of statically salted password, adds up all bytes and masks with 0xff. This yields 1-byte hash re
204.
by latitude 15y ago
I don't understand what you don't understand, sorry. Think of it this way - for every new password that you put into the database, run it through some function that spits out N bits. Remember these bits. Then, when you have a password candi
205.
by latitude 15y ago
> This approach requires granting access to read the raw password hash to the password-tester application No, it doesn't.
206.
by latitude 15y ago
There's no need to derive hinting (reduced) hash from the bcrypt hash of the password. Since all that's needed is even distribution of password space into 2^N classes, it can easily be done by looking at N bits of any password hash. Since N
207.
by latitude 15y ago
Jeez, samdk. It seems like you Ctrl-F'd for bcrypt and didn't read anything else on that page. The part you quoted explains why moving hash checks to the browser is not a practical option. It has nothing to do with storing passwords. Mo
208.
Show HN: Password validity hinting(swapped.cc)
58 points by latitude 15y ago|78 comments
209.
by latitude 15y ago
Apparently heck of a lot. Over 30%. But that's a lot of HN/reddit traffic, and I might still be missing some bots masquerading as humans, but it's certainly not negligible. [1] http://www.reddit.com/r/programming/comments/qev5u/native_an..
210.
by latitude 15y ago
I'd like to get an idea on how important an openness of a data archive format is. Not in FSF sense, but practically speaking. Has anyone had any luck/problems with transferring a history of backups from one software to another?

More ›