Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:Mobile password entry; acting on user's behalf (Score 1) 365

How would the user get the long password into the mobile device's password manager in the first place?

They would sync their encrypted password database to the mobile device. Alternatively, the password manager could generate the long password itself on the device if that is where the account is being created.

Provided the user has an own PC. Good luck logging in at a public library or Internet cafe.

The fundamental problem with this scenario is that you're proposing to place your trust in a public PC you can't control. At a minimum, that particular login session must be consider potentially compromised no matter what authentication scheme you use. Having said that, there are some options if you're forced into this scenario. An OTP hardware token would be preferred; at least that way an attacker can only hijack the current session, rather than having the means to sign in as you in the future. If you do use a traditional password then it must be considered compromised and should be changed from a secure PC as soon as possible.

And store this "own distinct, revocable API key" in what secure manner? Client applications distributed as free software have already run into problems with how to store an OAuth 1.0a or 2.0 client ID and client secret.

The problem you're referring to relates to application-level keys which are meant to identify the developer of the application rather than the user. The only real solution in such cases is to make your app communicate with one of your own servers, which holds the API keys and performs API access on behalf of the app. Any keys distributed with an app (whether open source or proprietary) must be considered compromised.

In this case the API key is user-specific, not app-specific, so there is no distribution issue. The user logs in and generates an API key, which the application then stores for future use. The API key is the application's password, permitting limited access to the user's account. (For example, it should not be possible for an app to change the account password or generate additional API keys using an API key.)

Comment Re: Looking more and more likely all the time... (Score 1) 518

I never got why so many people are so sceptical of this one.

I think some of the skepticism is not as to whether this might be an engine that produces some small amount of thrust. I mean, a little skepticism is a healthy response for any new scientific discovery, and it's not inappropriate to ask for proof. Since the thrust we're talking about is so small, the margin of error is large, and proving that it really works takes a bit of doing. I don't assume that it works, but I also don't really disbelieve it if NASA scientists say it does.

However, when this was reported, it was reported in many places as "OMG! NASA has created a warp drive. We can go faster than light now!" I'm skeptical about those claims.

Comment Re:Maybe I just don't "get it" (Score 1) 259

Now, ostensibly, we have a single browser on which I can do basic wordprocessing and spreadsheet work through google docs, edit websites, play fairly sophisticated games....all through the same browser.

Google Docs is an app whether it's running natively under Android or from inside Chrome. The browser doesn't replace any apps; it's just another platform for apps to run on—one with a lot of historical baggage, overhead, and limitations compared to the native APIs. It's good to provide a mobile-optimized web site rather than requiring visitors to install an app, but a native app will always have the potential for more sophisticated integration, in terms of both functionality and the native look-and-feel of the host operating system.

Comment Re:Mobile password entry; acting on user's behalf (Score 1) 365

Other than that it's far harder to type a 60-character password on a mobile device...

That should be the user's choice, and anyway, that's what password managers are for. If the system is implemented properly, the user won't need to type in that 60-character password on their mobile device. The user can just unlock the password manager and paste in the saved password.

Unless you're storing the user's password in order to log on to a service on the user's behalf. A password manager is an example of such an application.

The password manager should run on the user's own PC, and encrypt the passwords with a master password known only to the user. Plaintext passwords and private keys should never leave the local PC. If an app needs to perform an action on behalf of a user, it should get its own distinct, revocable API key. There is no justifiable reason for anyone but the user to have access to the user's password.

Comment Re:Not downsizing nuclear (Score 1) 484

"It would not ... as most CO2 is produced by cars, house heating and industry."
Since renewables only generate electricity we can ignore all none electrical sources as far as nuclear and renewables. Unless you want to count the tiny number of passive solar heating installations.
If you look at this graphic http://energytransition.de/fil...
You will see that France gets around 10% from hydro. You will also see that France still gets some power from coal which is baseload power is is ideal to replace with nuclear. The natural gas is probably split between base load and peaking load. Replacing the base load with nuclear is again a simple matter the peaking is a more difficult issue which is why I suggested that France should convert their hydro from a base load to a peaking source aka as pumped storage. The power stored would come from a combination of both renewables and nuclear.
As to your comment about where the majority of CO2 comes from do you have any sources?
My research shows that home heating in france is more often than not electrical heating. https://www.justlanded.com/eng...

Do you have any real data or just insults?

Comment Re:That's copyright for you (Score 1) 292

External references were omitted deliberately; the HTML file consists only of the pages included in the T.O.C. at the URL you provided. The notes are considered a separate document. Downloading additional documents and fixing up the URLs would be a bit out of scope for this proof-of-concept, which has taken enough time already. If you merely want to make the links work, without downloading them, just add this tag in the <head> section:

<base href="http://web.lexisnexis.com/">

I could send you my script, if you wish, but the only part you could really use for this directly is the part to set the Cookie: header (wget --no-cookies --header "Cookie: ...").

Comment Re:How much is an AG these days? (Score 1) 256

But corporations are not people.

See my post, above, pointing out that corporations are groups of people, with all the rights guaranteed to people, who don't lose those rights just because they're acting together for a common purpose.

The legal system DOES, in some situations, treat corporations as pseudo-people. But that's just a convenient way to interact with the corporation's members/stockholders/what-have-you when they're acting together to advance the common purpose that the corporation was chartered to handle.

Comment Re:How much is an AG these days? (Score 2) 256

fuck off you right-wing scum.

In the immortal words of Red Skelton and Mel Blank: "He don't know me very well, do he?"

corporations aren't people.

Au contraire: Though they DO exhibit most of the characteristics of independent lifeforms, corporations are GROUPS of people, working together for a defined purpose. This is true whether they're businesses, schools, labor unions, churches, political parties, special-interest group, or whatever.

I assume we're agreed that people working together as a corporation shouldn't have any extra rights beyond the pooled rights of the individual members. But should these people LOSE any of their rights, just because they're working together?

Should spokesmen for a corporation with ten thousand stockholders, when speaking on issues related to the corporation's purpose, interaction with laws, and its stockholders' interests, have any less access to the ear of a legislator than the ten thousand stockholders themselves? A corporate lobbyist is just a representative of those ten thousand people when they're acting on this particular common interest.

The legal system treats corporations as pseudo-people because it's a convenient way to interact with the people making up the corporation when they're acting as a group.

Comment No child gets ahead either (Score 2) 132

I have very limited experience with the local public schools in upstate New York, but I get the distinct impression that teachers mostly operate under the assumption that all kids are as dumb as the dumbest kids. I have a PhD in computer engineering, and my wife has two graduate degrees herself (law, information science). We were also in gifted classes in high school, and she was the valedictorian of her school. We're told we're smart, and it seems likely that our kids are pretty smart too. But it's hard for me to see where the curricula here accomodate any kind of range of intelligence among the students. When I try to ask about this sort of thing, there's this subtle resistance where you can tell they're thinking that all parents think their kids are the smartest, but really they're all just dumb as rocks, so the idea of anyone getting ahead makes no sense.

I hope I'm misinterpreting all of this.

Slashdot Top Deals

This place just isn't big enough for all of us. We've got to find a way off this planet.

Working...