ryan-c

72 ms·

781.
by ryan-c 11y ago
It's more that most humans are predictable most of the time. There's no reason a password cracking dictionary can't contain phrases as well, and most of the sorts of rules based permutations used against normal passwords can
782.
by ryan-c 11y ago
That sure isn't what he said to John Oliver. https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s He mentioned "margrattethatcheris110%SEXY" - I would be totally unsuprised if someone managed to crack that. Di
783.
by ryan-c 11y ago
Snowden's passphrase[0] advice is pretty bad - perhaps they came up with a list of phrases based on what they know of him and successfully cracked it. > “The best advice here is to shift your thinking from passWORDs to passPHRASES,”
784.
by ryan-c 11y ago
Looks like it made it to California (San Jose and Palo Alto) with what appears to be a reasonable round trip time. Weird. Edit: It seems like that must have come through the Southern Cross Cable[0] which is nowhere near Malaysia. 0. https:
785.
by ryan-c 11y ago
If anyone in the bay area wants some Club Mate, I've got at least a dozen cases left from a pallet I had imported last year and would be happy to sell some. Contact email in my profile.
786.
by ryan-c 11y ago
Yes, that was what the article says, but the person I was responding to misunderstood.
787.
by ryan-c 11y ago
What you describe there would be a preimage attack[0], not a collision attack. There is no publicly known practical[1] preimage attack on MD5 at this time. 0. http://en.wikipedia.org/wiki/Preimage_attack 1. 2^123.4 com
788.
by ryan-c 11y ago
Most Android users can't update. Their device gets updates for maybe 12-18 months, then nothing. They have to replace the device to update it after that.
789.
by ryan-c 11y ago
Previously: https://news.ycombinator.com/item?id=7547942
790.
by ryan-c 11y ago
Here's my entry. https://github.com/ryancdotorg/dnsstore
791.
by ryan-c 11y ago
The IdentifyFile directives actually work with ssh-agent - it will try the keys listed there first, using them via the agent if they're loaded. I use the same passphrase on all keys and load them into my agent all at once (when loading
792.
by ryan-c 11y ago
Here's what I do: # IdentityFile magic, should be placed at very end of file Host * IdentityFile ~/.ssh/keys/id_ecdsa_%r@%h IdentityFile ~/.ssh/keys/id_rsa_%r@%h IdentityFile ~/.
793.
by ryan-c 11y ago
I'd also suggest looking at the rsa public exponents. PuTTY and OpenSSH (at least used to) use their own values when generating keys, so you can somewhat reliably identify which keys were generated by these tools
794.
by ryan-c 11y ago
I am assuming you're morally opposed to paying $10/yr for a certificate, but why not use StartSSL and avoid what is probably a very high bounce rate?
795.
by ryan-c 11y ago
Mandos[0] does this, and allows you to configure a policy for how long the server is allowed to be offline without requiring an administrator to authorize boot. You could also cook up something for debian/ubuntu's support for embe
796.
by ryan-c 11y ago
https://faq.ssa.gov/link/portal/34011/34019/Article/3789/Can... "We can assign a different number only if: * Sequential numbers assigned to members of the same family are causing problems;
797.
by ryan-c 11y ago
Unless Apple's rules have changed, iOS Firefox will be little more than a re-skinned Safari, just like iOS Chrome. I would be very surprised if it has add-on support.
798.
by ryan-c 11y ago
There's a lot less people in security than in software engineering, and paranoia comes with the field, so the data really isn't very good. I'm also not entry level. I don't want to do compliance stuff because none of the
799.
by ryan-c 11y ago
He's crying because his response rate trying to contact women to date is probably way lower than that.
800.
by ryan-c 11y ago
I've gotten requests on linkedin from accounts for fake women with stolen photos. I recall one in particular where I did a reverse image search on the profile photo and found that it was of a woman who'd been murdered a few years
801.
by ryan-c 11y ago
No, they were not a recruiter, and I am pretty sure that recruiting was not the motivation for contacting me.
802.
by ryan-c 11y ago
Re asking recruiters about salary - it's about not wasting everyone's time. If someone's happy with their current job and would need a substantial pay increase to consider leaving it, then it is a waste of both their time and
803.
by ryan-c 11y ago
Maybe the post was edited, but I see "Although this incident is unfortunate, its scale is small and will be fully absorbed by the company." there currently. Hopefully it's true.
804.
by ryan-c 11y ago
OkCupid needs a lot more than 10 minutes to fill out a profile. Spending a couple hours answering questions is generally recommended for their matching algorithms to work well.
805.
by ryan-c 11y ago
I actually ended up in my last job because of OkCupid. Someone sent me a message, we ended up talking for a bit, and they invited me to a board game party at their house. Ended up going, then later got nagged into providing a resume. OkCupi
806.
by ryan-c 11y ago
I do some work on Namecoin[0], though lately I've been pretty busy with other things. Please be aware that these accounts are not controlled or endorsed by Namecoin developers. The twitter account actually has me blocked. On a personal
807.
by ryan-c 11y ago
nginx takes OpenSSL cipher specs, as does apache and a lot of other programs. The `openssl ciphers -v CIPHERSPEC` command will list out what's enabled with a given setting.
808.
by ryan-c 11y ago
I'm planning on going through some of my old projects and writing blog posts about them over the next couple of months, and I will add that one to the list. It was indeed, a massive pain in the ass.
809.
by ryan-c 11y ago
I run transport mode IPSec on my LAN at home under Linux with racoon to encrypt NFS with certificate based auth. It was a huge pain in the ass.
810.
by ryan-c 11y ago
It's very difficult to render decoded punycode domains in a way that does not facilitate spoofing.

More ›