ryan-c

98 ms·

931.
by ryan-c 12y ago
This has been known for quite a while. I managed to find a case where HSTS allowed information leakage between private/non-private frames within the same browser in Firefox, but I think that's been fixed. In general, the browser v
932.
by ryan-c 12y ago
Would be nice if Active Directory/Windows supported something other than NTLM (which is basically MD4) hashes. Even an old GPU can make billions of guesses a second against it.
933.
by ryan-c 12y ago
LZ77 is usually more efficient when combined with Huffman coding (this is what DEFLATE does).
934.
by ryan-c 12y ago
I thought you could possibly be exploiting the bug unintentionally - a hacked together client that just attempts to connect with null auth would do it. Not sure how common that vuln is.
935.
by ryan-c 12y ago
Are you using the old RealVNC bug that allows the password to be bypassed by ignoring what authentication methods the server advertises and using "none", or only hitting stuff that actually says it supports connecting without a pa
936.
by ryan-c 12y ago
A SSL certificate that doesn't help people get used to ignoring certificate errors can be had for free from StartSSL or for less than ten euros from a company that has a UI that won't make you want to cry.
937.
by ryan-c 12y ago
> Could they break even single 16384-bit RSA key pair? Probably yes There is no known algorithm that can break a properly generated RSA key of that size - the work required with GNFS is equivalent to brute forcing a symmetric key of some
938.
by ryan-c 12y ago
One of the less obvious things is that the fact you're using a VPN may be leaked on a TCP session by the MTU/MSS values.
939.
by ryan-c 12y ago
It's possible to differentiate the major browsers and operating systems without javascript, and even the versions can be narrowed down without javascript even with user agent spoofing. p0f, for example, can do this. http://l
940.
by ryan-c 12y ago
As I said in my other comment, changing your user agent string affords you no privacy protection against those who care about knowing, and makes you more trackable.
941.
by ryan-c 12y ago
Can you elaborate? That cookie thing seems to have only resulted in web pages having annoying popovers about cookies.
942.
by ryan-c 12y ago
Your browser (including the exact version) can be determined without looking at the user agent string (which is mostly a series of lies anyway). Changing it "for privacy" makes you easier to track. As to the plugin list, you cou
943.
by ryan-c 12y ago
A similar project, NameID[1] has been around for a while. The fact that names on Namecoin expire may make it unsuitable for some applications, though. 1. https://nameid.org/
944.
by ryan-c 12y ago
I think you mean DES based crypt and not DES encryption.
945.
by ryan-c 12y ago
The modern government standard for classified systems is 15 characters minimum.
946.
by ryan-c 12y ago
There are a very limited number of frequencies used for RC aircraft and I've never heard of the signal being encrypted (authenticated would be more important than encrypted anyway). I also think the control protocols are fairly standar
947.
by ryan-c 12y ago
I do not expect "someone else" to pay for it. As best as I can figure at least 20% of my gross income is going towards social programs already via compulsory contributions (income taxes). Required contributions to these programs b
948.
by ryan-c 12y ago
> Left or right, white collar workers that aren't giving a significant portion of their income to charity (as in, measured by percentage points) are not living ethically and sustainably. By this logic I don't see how anyone not
949.
by ryan-c 12y ago
I agree with you, but many people are doing something wrong. I've known plenty of people in tech who do not seem to be able to live below their means. I've had coworkers/managers/friends look at me like I had an extra he
950.
by ryan-c 12y ago
The Sacramento Fry's also used to be an Incredible Universe. It's the only Fry's I've been to that doesn't seem to be decorated in any theme.
951.
by ryan-c 12y ago
https://github.com/macton/hterm I use the chrome extension version on my chromebook quite heavily, no real complaints.
952.
by ryan-c 12y ago
Oh, you are correct. It's chosen by the client here: https://github.com/covertcodes/multitun/blob/master/multitun...
953.
by ryan-c 12y ago
The use of SHA-2-224 is kinda weird. Based on a quick skim: * no kdf on the password, just SHA-2-224(password) * uses the same key and iv (which always starts as 0) in both directions * uses CFB mode without a MAC, which has malleability is
954.
by ryan-c 12y ago
I think Firefox 24 is still supported for a few more weeks, as it is a "long term" release.
955.
by ryan-c 12y ago
Secret sharing systems are a good solution to this. I wrote a basic command line only one[1] a few years ago, but command line UI doesn't really make for "usable by everyone". It would be nice if there were something like thi
956.
by ryan-c 12y ago
Abine's DeleteMe[1] service will take care of removing you from these sites, though it's not cheap. They will keep re-checking and re-removing. I've been using it for a few years, and it seems to work pretty well. IIRC there
957.
by ryan-c 12y ago
I like pam_shield, personally. https://github.com/jtniehof/pam_shield Back in the day, disabling password auth but leaving keyboard_interactive on would stop a lot of these things, but I don't think that's tr
958.
by ryan-c 12y ago
Sorry about the formatting there sucking. :-(
959.
by ryan-c 12y ago
So, some stats: There's 350,032 unique passwords in there. * 122,094 (~35%) are in the rockyou dump (which has 14,344,391 unique entries) * 2898 passwords in my list of cracked linkedin passwords, excluding those in the rockyou dump (2
960.
by ryan-c 12y ago
I wonder what's up with all the super long entries in there. Bugs in the bots?

More ›