Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Re: There we go again (Score 1) 383

And as I've had to state over and over again (and this isn't meant against you wagnerrp), my statement about rate limiting, etc. was in the context of a post that did not mention an attacker already having compromised the system and having a DB dump with all the password hashes. That is a completely distinct scenario than the one I referred to and obviously would require other mitigations.

B u l l s h i t .

I've never understood why passwords can't be sentences, like "I'm going to take my dog, Spot, to the park today."

They can be, but it would be incredibly stupid to use something like that. A dictionary attack would crack that password in seconds.

What I do is have a single, strong password that I have stored only in my brain and all other passwords are hashed on-the-fly from that and the domain or name of whatever I need the password for. I get unique, strong password for everything, but only have to remember a single one.

Only if you're dumb enough to let authentication program be suspceptible to such an attack. Dictionary attacks can be trivially defeated by rating limiting tries and after, say, 5 tries not allowing any more attempts for some cooldown period. No attacker is going to bother if they can only have 5 tries every 15 to 20 minutes.

The post you replied to only mentioned "dictionary attack". Dictionary attacks are OFFLINE ATTACKS 99.999999% of the time.

Comment Re: There we go again (Score 1) 383

The point he was making is that with proper procedure, a hash could never be attacked offline. As soon as the hash database were compromised, all hashes contained therein would be invalidated. The attacker could brute force that database to their heart's content, and no valid passwords would ever result from it.

This of course assumes the administrators are paying close enough attention to notice in short order when the database has been compromised, and that all users define a secondary means of contact through which to send a reset password. It also ignores the issue that most users use the same username and password across multiple sites, such that a pair compromised on one site and invalidated as described would still be valid on another site.

LOLWHAT
99% of the time, you won't notice your shit has been compromised until well after the fact. You typically learn of it when lots of users report that their shit has been stolen.
The best an administrator can do is expire the passwords and send a notice out to the registered email addresses of the users with a unique reset link. The attacker likely also knows the email addresses. Any user using the same password for your site and email is fucked if the attacker has cracked their password. The users using the same password for a random site and their email are typically the same users with shitty, easy-to-crack passwords.

The bottom line is that password hashes and salts are only as secure as the passwords themselves.

Comment Re: There we go again (Score 1) 383

Hey Desler I really don't get you, you (appear to) know what a salt is yet you don't understand that an attacker would be performing the attack on the hash offline, with their own hardware. Rate limiting their own hardware would be, as you put it, the height of idiocy.

He's furiously reading (but not understanding) wikipedia as he types. It's pretty common on Slashdot, actually.

Comment Re: There we go again (Score 1) 383

And before the grammar nazis come out, yes I accidentally typed you're instead of your. Let me go commit seppuku now.

The first rule of holes: When you're in a hole, stop digging.
Your initial post in this thread exposed the fact that you don't know what the fuck a hash is, and thus don't know what the fuck you're talking about.
You should have simply stopped posting, but here you are, digging deeper and deeper, committing more and more errors. You couldn't even quote a post properly.

Comment Re:Pluto is a Planet (Score 1) 115

Pluto is a planet. The definition of a planet is arbitrary, and always will be.

What makes your arbitrary definition of "planet" - one that allows you to declare without qualification that it is a planet - better than the IAU's?

Trying to forcefully change the definition after it's already in use is fucking retarded and does nothing but cause confusion.

Not when the old definition is itself revealed to be "fucking retarded" (technical term, is that?) and causes more confusion once more data becomes available.

see "non-flammable"

Did you mean "inflammable"?

and the dipshits who insist that a kilobyte is 1000 bytes.

What, like the dipshits at the the International Organization for Standardization? Just because you don't like it, doesn't make everyone else unquestionably wrong.

My definition makes more sense and is better because it's ALREADY IN USE.
You can't fucking change the meaning of a word willy-nilly, because that causes ambiguity. Does the speaker/author mean the new definition or the old one? When was this written? What was the more popular definition at the time?

For inflammable, look up the fucking Latin roots inflammare and flamma.

For kilobytes, again, the issue is about what was in use already and how changing shit adds ambiguity. Computer science has damn good reasons for using binary bases, the SI and other such organizations do not own the letters "kilo" not the letter k, such organizations have ambiguity in their own fucking rules, such organizations are not authorities for the language, and the big kicker, of course, is that the units in question aren't kilo, mega, etc, they're kiloBytes, megabits, etc. - there's never any ambiguity because you always have bits or bytes right there. And before you get started on trying to pull out some "gotcha" example where someone mixes them up: modems are rated in baud, not bits, storage manufacturers are liars who caused the mess in the first place, and I don't give a shit about how we have 1000 mbps ethernet or other such standards - it has no bearing on anything. Try again when we have memory measured in "gibibytes" or bus widths in factors of 10.

Comment Re:Pluto is a Planet (Score 1) 115

"Inflammable" means shit is capable of bursting into flames.
"Non-inflammable" means it isn't (easily).
"Nonflammable" was created by an asshat who wanted to remove confusion (which didn't exist).
"Flammable" was then created to be the opposite of the new fake opposite.

"Inflammable" is derived from the Latin inflammare, which means able to be set on fire. This is the correct usage.
"Nonflammable" is derived from "non" + "flammare", meaning to set on fire, + "able". This is completely fucking incorrect usage.

Comment Re:And yet (Score 1, Interesting) 268

This is essentially why the "natural rate" of unemployment is not zero: There are workers who are not willing to accept the jobs that companies are willing to offer them.

It is also interesting to point out that there is an 'Unemployment Rate' statistic that is computed, but I don't think there is a corresponding 'Empty Job' statistic that is tracked in a similar fashion. In a perfect world, would the only thing preventing X workers from filling the X job openings in society be the negotiated rate of pay? (After all, everybody has their price.)

Comment Not quite accurate (Score 4, Interesting) 268

Unions aren't the same a secret collusion between competitors. A better comparison would be a secret union of all tech workers that required that none of its employees take work with Apple until they raised their entry level salaries for engineers to 500k per year out of desperation. Also, unions are manipulating the invisible hand of the market, but they only exist as a result of the power that currently lies in the hands of capitol. If capitol hadn't collectively acted in a selfish and greedy fashion for the previous thousand years or so, unions would have never been formed. You could say that they are consequence of the invisible hand, but that is sort of a cop out, since any behavior related to the market (up to and including regulation) is a consequence of the market. Gotta love feedback loops.

Comment Pluto is a Planet (Score 1, Insightful) 115

Pluto is a planet. The definition of a planet is arbitrary, and always will be.
Trying to forcefully change the definition after it's already in use is fucking retarded and does nothing but cause confusion.

For other instances of dipshits trying to hijack language and make it worse, see "non-flammable" and the dipshits who insist that a kilobyte is 1000 bytes.

Comment Re:For gamers? (Score 1) 110

Your post is completely false, yet in typical Slashdot fashion idiots modded you up.
There are different styles of razors for women - your standard razor is identical to a men's razor in basic design. It is used for arms, armpits, legs, crotch, neck, and face.
Then there are the larger razors, often with a large block of lubricant surrounding the blades. These have a different handle design and are made for legs.

Comment No Thanks (Score -1, Flamebait) 97

I'm fucking sick of the Source engine. I was sick of it on day 1. It's the pinnacle of camera-on-a-stick and unnatural movement.
Source 2 will be more of the same, just updated for new shit. The engine itself will still feel like the turd it feels like today, and it'll still be terrible easy to hack, and VAC will still be terribly ineffective. No, I don't have a crystal ball, I've just been paying attention.

Slashdot Top Deals

Diplomacy is the art of saying "nice doggy" until you can find a rock.

Working...