Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:One simple question I wish were answered... (Score 2) 75

How would a cloud provider assure customers that their data will remain secure if they go bankrupt or just quit the business?

As of now, if a provider tanks, the servers go to the auction house, and in theory, are blanked. However, in reality, there is no assurance of that, and the buyer will get all data stored free and clear. If they wanted to do a multi-terabyte torrent of a failed bank's account and transaction data, they can, and nothing legally could stop them.

Like, a contract to escrow the cost of the wiping and/or returning of all relevant hardware to the original owner? There are plenty of precedents in contract law to mitigate risk in the case of bankruptcy. Just because you can't think of them doesn't mean they aren't there.

Comment Re:NSA leaks Tor's bugs (Score 2) 142

Recently there was this story about NSA guys leaking Tor bugs to devs and suggesting changes to "improve" Tor's design:
http://yro.slashdot.org/story/...

I vividly remember that Snowden's documents said that NSA tries to influence Tor's design, being unable to actually break it. This might be a way of doing it: they pretend to be "good guys" and suggest changes that, while removing purely theoretical vulnerabilities, actually open the doors to more serious ones.

I hope Tor developers aren't so foolish to follow those "suggestions".

Of course they aren't documenting their ability to subvert anonymity on Tor. It is probably the most powerful weapon an intelligence agency can wield right now. The rather simple (but un-falsifiable) fact is that with enough relay and exit nodes owned by one entity (and ownership is deliberately un-attributable) you can pretty effectively de-anonymize it by attrition (there are a few protocol weaknesses too, that allow you to leverage a lot of hosts). The only clue an outside observer might have that it is happening is inorganic changes in the network layout (i.e. a lot of nodes going online or offline) signalling a large single controller is at work. Luckily, at least this avenue is covered and you can see via the Tor Metrics portal what is going on across the network, and infer occasional events (like the de-anonymizing attack this past spring).

Comment Re:Pet Peeve (Score 2) 147

There's practically no limit to how many places you could build an artificial mountain to force rainfall, and an artificial valley on an artificial plateau for the upper reservoir. And you can get more energy from the same amount of rainfall just by making the plateau taller.

Taking your infrastructure planning cues from SimCity2000 isn't the best way to arrive at practical solutions.

Comment Re: TI calculators are not outdated, just overpric (Score 1) 359

It's called free market: demand sets the price. Suck it up.

Free market requires competition. If you're required to use this specific model there is not competition. That is not the free market. Suck it yourself.

Ahem, free market requires lack of collusion. No one is stopping Casio, et.al from making a competitive product that does the same thing but costs 1/10th as much, except apparently they don't want to bother or are choosing to do it just differently enough that the learning curve is unattractive to prospective buyers. Maybe $150 for an educational product that is well thought out and well supported isn't over the top after all? What's amazing is that there isn't a 1:1 TI-84 clone from AliExpress that sells for $9 shipped (from Hong Kong.) The usually on-the-ball knockoff kings in China who can clone a new model of iPhone in 60 days for 30% of the cost aren't even bothering to go after what is allegedly a hugely profitable product? Something is fishy with the premise here.

Comment Re:TI calculators are not outdated, just overprice (Score 1) 359

Because school districts taxing property owners and buying calculators is so much more efficient than students obtaining their own calculators with that same money.

Who said the students would keep the calculators? The only situation where you MUST HAVE THIS SPECIFIC CALCULATOR is in the classroom. Keep the calculator there! The special calculator stays where people find it worthwhile, everywhere else the rest of us can use a computer like a normal person.

If you're actually going in to a field where having a fancy calculator is useful versus a smartphone you can buy it yourself then. Most of us have absolutely no need for these things beyond the few tests for which they're required.

You are so right. And to any parents who find the problem with this (what problem? wait for it...) I will sell you a TI-84 Simulator for your iPad that perfectly recreates the UI of the calculator that your little snowflake will need to master in order to get into college, and it won't even be that expensive! $49.95 should do the trick. Paypal or bitcoin, thx.

Comment Re:1..2..3.. until massive security breaches (Score 0) 137

The OBD-II dongles are not a threat until Metasploit module exploiting this overflow or that out of bound write comes out and cars start crashing. OBD of modern cars have been successfully exploited, considering that cars can easily stay on the road 15+ years and automotive industry only now started taking rudimentary first steps to secure it, it will be 20+ years until such dongles will be safe to use for general public.

The AT&T telematics system (that the Progressive Snapshot system runs on) is internal to AT&T and there have been no credible threats to its integrity. Does that mean it's totally secure? Of course not. But your hand-waving of "oh someone will just start pwning them with metasploit! and then you will see!!!!11" is completely uncalled for and uninformed. You might as well suggest that drivers' cellphones that get "hacked" can then "hack into" the Bluetooth interface on late model cars and totally "hack the brakes!!!" and make them refuse to operate.

Comment Re:Why? Simple bullshit is why. (Score 1) 107

I meant log2(5000^4), of course.

Well, not to waste this comment, gonna plug for Diceware as a nice freely available ~7k word dictionary organised for passphrase generation. Oh yeah, and it doesn't contain "refined", still.

The Diceware method is a good process it makes me uncomfortable to use a nice preformatted set of words to make a passphrase out of. Attackers could build a rainbow table pretty easily (and we know not enough people salt their database hashes) with a few PB of disk space. Why not make new Diceware lists from less common words, and change it every so often? It would require the same process but offer a lot more entropy.

Also w.r.t. your earlier claims about the top 5000 words, check that list again (you no doubt used the one from http://www.wordfrequency.info/...) there are only actually 4352 words in that list, it contains duplicates due to homographs.

Comment Re:Quick (Score 1) 253

All that ranting just because he could not get new phone *immediately*. What is wrong with this guy?

It's even a phone he admittedly hates. For fucks sake, he should have listened to the sign from God and just bought an iPhone (which they no doubt have in stock) so he can complain about *real* phone problems.

Comment Re:Around or on top of millitary bases? (Score 1) 237

(the authors of the article, who make about $3500 a pop selling reflashed phones to paranoid rich guys who do business in Asia, didn't seem to have a hard time finding such towers and making the hasty connection to China),

FTFY. And yes, these are US DoD towers used to prevent leaks of classified info and do other counterespionage monitoring.

Comment Re:Around or on top of millitary bases? (Score 1) 237

The article says ...

What we find suspicious is that a lot of these interceptors are right on top of U.S. military bases.

The summary says ...

Many of them are built around U.S. military bases.

Way to slant the summary to make it look like Chinese towers rather than our towers.

Considering that data exfiltration via 4G networks can be fast and run from nearly anywhere, it's not surprising at all that military installations (probably ones with secrets to keep) use these towers as a way to know exactly what's going in/out of their territory. It sure beats something as on-the-nose as simply using RF interference to block all calls/texts/data. They can catch would-be espionage spies in the act and probably even ID who sent them.

Comment Re:Why? Simple bullshit is why. (Score 1) 107

"refineddisplayparcelsuited" is not a common phrase, and this isn't Master Mind where the attacker gets hints when he correctly selects part of the password.

I love how we spend so much time picking passwords that are hard for people to guess-- or remember-- when computer programs can only be written in a practical matter to try the most common dictionary words or "hunter2"-type passwords. Past that, it's all brute force whether you used "j$b01[BaP*@" or "refineddisplayparcelsuited" because the program has no idea how much of the character set your password used until it's been cracked.

Except guessing at strings of words is trivial if they are in the dictionary.

refined display parcel suited are 4 common words. I could write a tool to attack that very quickly, starting with the most common words arranged in 2,3,4 sets.

Comment Re:Larger Implications? (Score 1) 107

It's simple, get control of a domain and you can redirect all email. Redirect all email and you can reset passwords without needing to ever worry about the actual mailbox password (which is probably stronger than the registrar password but obviously is just as important).

Exhibit A, in which this exact scenario happened:
https://medium.com/p/24eb09e02...

Comment Re: Too late (Score 1) 107

Really? You are going with the "blaming the victim" route?

How about this one. There are probably over 100 websites that have store my credit card information in their own proprietary system because every company seems to have "not developed here" syndrome, and making each uname/password combo is very difficult without some easy to guess alto, or even remembering where accounts might have been created already. And on top of that, nobody has any clue who was affected or how they were affected because the only group claiming to have any idea what happened has refused to divulge that information, giving the hackers free reign to continue to exploit vulnerabilities no matter how users respond.

So any attempt at blaming users seems awfully idiotic in the face of everything else.

How many companies actually mandate saving a credit card within the account though? Almost all of them that I use (although not most of them by default) allow payment via a nonsaved credit card, so an attacker can't do anything nefarious after gaining access to the account. It does require more effort though. But yes, to your point it is silly to blame the user when clearly the actual mistake was made by the site that lost the credentials through bad security management. I will however raise you one more. JP Morgan Chase spends $200 million dollars a year *just on computer security*. And they still lost data. We need to move beyond a blame the victim (be they the user or the site manager) to a point where we account for the inevitability of data loss.

Comment Re:What privacy concern? (Score 1) 261

but privacy, as you note, is pretty close to the bottom since your car location is most certainly other people's business as soon as you take it on a public road.

This is absolutely false. People can look at your car, yes, but that doesn't mean everything that happens in and outside your car isn't private. I'd rather have freedom and privacy than safety, and you'd think everyone in a country that's supposed to be "the land of the free and the home of the brave" would agree with me. I don't want the government having control over my vehicle, and all software on the vehicle should be 100% open source, and all hardware should be open as well. No black boxes, and no proprietary garbage. There's just too much room for abuse, and in a free country, that's all it should take to oppose it.

First, it's pretty obvious that jeffmeden was talking about privacy in terms of the car's location, not "everything that happens in and outside your car". Your comment doesn't show that his point is "absolutely false" unless you completely misread what he said.

Second, everything you do involves a tradeoff of privacy, safety, freedom and a dozen other things. If you go outside you lose some privacy; if you get in a car and drive in public you lose some privacy and some safety. The idea that you can be some sort of privacy and freedom absolutist who never trades either of them for anything is just nonsense.

He's obviously just trolling. People (red blooded Americans, no less) are gobbling up cars with OnStar and similar systems that have clearly advertised features of vehicle tracking AND remote control, with no clear precedent that government meddling isn't taking place, and yet the world continues to spin on its axis and bald eagles even continue to soar above the trees. If the only meaningful way someone can think to express freedom is having an untrackable car, then I take pity on them.

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Working...