thirsteh

78 ms·

721.
by thirsteh 15y ago
People who feel they have to talk about themselves in the third person tend to be rather untrustworthy.
722.
by thirsteh 15y ago
He wasn't a co-founder. Steve Huffman and Alexis Ohanian founded Reddit. They acquired Aaron's company half a year later.
723.
by thirsteh 15y ago
Maybe, but GitHub's pricing model encourages sharing, and that's a good thing. Think of how many repositories might've been private and not benefited thousands of people. Granted, the prices might be steep/strange, but I see no problem in c
724.
by thirsteh 15y ago
Yeah, well, arrogantly complaining about people calling you out on unfounded speculation doesn't really work when you were originally quite arrogant in that speculation.
725.
by thirsteh 15y ago
Of course, in a perfect world, developers would be paid to think about security.
726.
by thirsteh 15y ago
Fair point. Clarifying...
727.
by thirsteh 15y ago
"Ephemeral Diffie Hellman" It sounds magical too.
728.
by thirsteh 15y ago
So Nginx got unwarranted hate for having the most secure defaults. That sucks. I hope the user nginxorg -- whom I assume is Igor Sysoev -- who dropped by the previous thread ( http://news.ycombinator.com/item?id=2752136 ), sees this post to
729.
by thirsteh 15y ago
It's just one guy's hobby project, or at least Simon ( http://www.chiark.greenend.org.uk/~sgtatham/ ) does 99% of the work.
730.
by thirsteh 15y ago
Facebook, now that Google+ is here :P
731.
by thirsteh 15y ago
What is your definition of small? You don't think there were MANY accounts that logged in from new locations in that time frame? Think wireless networks... I simply refuse to believe that with such a gigantic service they could determine th
732.
by thirsteh 15y ago
I don't believe they can pinpoint "the affected users" (supposedly below 100) with such accuracy. It's not responsible to assume nobody else logged in from another location just because only one person logged into 100+ accounts. It would ha
733.
by thirsteh 15y ago
Original article from PhysicsWorld: http://physicsworld.com/cws/article/news/46362
734.
by thirsteh 15y ago
I'm sorry, but good. When you respond to such a serious issue with anything less than an immediate email announcement to your entire userbase, and especially if your eventual announcement is an unapologetic, obscure blog post stating someth
735.
by thirsteh 15y ago
3 lines is usually better than 60 lines. See Python.
736.
Have a bit of...(haveabit.com)
3 points by thirsteh 15y ago|0 comments
737.
by thirsteh 15y ago
Even so, you're essentially arguing that equivalent access should be embedded in every email the user receives from the service. Is that worth the small, one-time (session is generated, or password manager remembers the password) improvem
738.
by thirsteh 15y ago
This is the best approach to the problem, though it doesn't satisfy the implied(?) requirement that new devices should auto-authenticate seamlessly. You have to keep track of all of the cookies, of course, but there is comparatively little
739.
by thirsteh 15y ago
Yes, but the scope of access would have to be severely limited, to the point where's there's no real sense in doing it, e.g. you'd have to prompt for settings change, but also probably read/write access to private messages, wall, etc... It'
740.
by thirsteh 15y ago
And any access logs (from edge proxies, etc.), yes.
741.
by thirsteh 15y ago
Please don't act as an authority on security when you do not understand how something like a POST request works. What you're encouraging is forfeiting the site's accounts in standard communication, of which you send many, many more than "Re
742.
by thirsteh 15y ago
There's no safe way. As soon as you start sending tokens that grant complete control over the account in normal/regular emails, you've reduced the account's security.
743.
by thirsteh 15y ago
You can use such tokens to disable email notifications, and still not provide complete access to the account, though.
744.
by thirsteh 15y ago
> No they don't. They usually just have some sort of password reset token as part of the query string for a standard GET. AFAIK there isn't any good way to POST from the body of an email - do mail readers even do JavaScript? I think you
745.
by thirsteh 15y ago
"Forgot your password" requests usually POST to the web server, not GET (what's usually used in emails). Sending links that give you complete control over the account by default seems like an extraordinarily bad idea--as does allowing users
746.
by thirsteh 15y ago
You can just change Priority Inbox to display some label, e.g. "Confidential" above the usual tabs.
747.
by thirsteh 15y ago
Yep. Don't store passwords using (non-password) fast hashes like MD5 or SHA-256. Use bcrypt: http://codahale.com/how-to-safely-store-a-password/
748.
by thirsteh 15y ago
I agree that by acting smarter they could have limited their exposure, and by limiting their exposure, avoided being hacked so many times (i.e. http://throwingfire.com/security-through-obscurity/ ), but a company as large as Sony really sh
749.
by thirsteh 15y ago
Agreed, but their problems are memes AND security. They could have had the bastard image and still established a secure infrastructure (like, for example, the TSA).
750.
Security Through Obscurity(throwingfire.com)
43 points by thirsteh 15y ago|60 comments

More ›