Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:You'd think... (Score 1) 448

You'd think that they could detect the activity required to build a tunnel.

I'd think it'd be easier to detect the use of tunnel based on it's endpoints. 200 feet isn't far and both ends would need a lot of traffic. With satellites, it wouldn't be a hard algorithm to identify twin hot spots of activity. Also being so short, they could just run a pneumatic tube and have a very tiny tunnel.

Comment Re:PCI standards (Score 1) 434

If you have the salt you can use a rainbow table to figure out the hash.

No you can't. 1-8character alphanumeric SHA1 rainbow table takes up 160GB. Add even 12bit salt and that becomes 640TB. You know what used a 12bit salt, legacy unix systems. Modern salts are effectively immune to rainbow tables. I'd wager the salt has more entropy then most peoples passwords.

I design software that stores password hashes. It uses the same cryptographic hash functions to store passwords (SHA1 probably).

SHA1 is unsuitable for storing passwords, use bcrypt. SHA1 is designed to be a fast algorithm and is vulnerable to moore's law. Fast hashing algorithms are a weakness for password databases because it makes bruteforce cracking faster. A modern laptop can churn out more then 100k sha1 hashes per a second. Bcrypt is designed with a cost parameter that you can tweak how difficult the hash operation is. As computers get faster, you raise the cost and then the next time person logs in you store the more secure hash.

Just because you're writing security software doesn't mean you're doing it right. I refer you to Schneier's Law:
Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break.

Comment Re:cyber command (Score 2) 161

If this is the best the most elite hackers our military can muster, then I think my wife should try and apply. She knows how to use Excel pretty well.

In fact that is exactly how military works. They hire mostly people with high school education and train them into career fields. Cyber command started just over a year ago. Apparently you think the military should be able to train up people in 1 year for what takes colleges 4 years to do.

I prefer to think of them as CS college sophomores... they're still thinking about switching majors because "math is hard."

Comment Re:What market does this target? (Score 1) 212

One use would be to store media libraries. It could eliminate the need to decide which dvd's to bring because it could bring them all. Could bundle with a media player and even put an autorun frontend to select show. The kids go to grandmothers and have every movie/tv show they want.

How often do you end up somewhere and decide to watch a movie where it turns into find something on netflix.

Comment Re:Quit making excuses (Score 1) 361

The value is not related to the price. I feel sorry for you if you can't find value in something that wasn't expensive. Piracy adds value to society by spreading the arts.

The value is not defined by the amount of money it raises (and I fail to see how this is linked to piracy rate) but the value of entertainment given to society. Pirates should pay the artists *and* spread it. Which increases the true value of art.

Locking art in a virtual vault, makes the art worthless to all except those who value it for it's pricetag alone.

Comment Re:No Firewalls (Score 1) 306

Web servers do not need firewalls. If your servers are only providing public facing services there is no need to firewall them.

No no no. Firewalls aren't just used to block insecure services. They're also used to block outbound connections or rogue listeners. A common scenario is a vulnerability that allows a shell command but doesn't return output of that command. A hacker could just start a listener to serve a command shell or connect back to their computer. Yes, you're still vulnerable with the firewall but it mitigates the damage. This is probably the type of "anomalous" behavior that lastpass detected.

But If you're going to believe your public services aren't vulnerable, you might be able to squeeze a slight bit of performance by getting rid of all encryption and storing passwords in plain text.

Comment Re:Please port this to Linux A.S.A.P. (Score 1) 164

The Linux devs simply do not get it. They seem to believe we live in Magic Fairyland

I don't think you get it. Who is "they"? Linux isn't a brand and it's not a company. There is no such thing as "The linux devs" except the linux kernel developers. There's literally thousands of different unrelated teams working on linux packages. Frankly I have no idea who you're talking about. Linux has the support for what you're saying, someone just needs to develop it. There are/were developers for a similar tool, maybe you should talk with them. If they ever got somewhere good, maybe they'd be included in a distro. I have no personal knowledge of them:
Tuxguardian (discontinued)
linux-firewall.org

Slashdot Top Deals

I program, therefore I am.

Working...