Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Using a published hash - FAIL (Score 1) 192

well, you just described a way to tweak an algorithm.
wouldn't even have to go to a 256 bit key. Doing that into MD5 would probably foil anything less than a concerted financial attack.
No media outlet could afford the computing power to attack that.
I used the same approach, with some further tweaks to secure financial communications a decade ago.

Lack of understanding security doesn't surprise me. I'm an engineer who does. I designed and wrote a suite that passed a 3d party, hostile, security audit.

Comment Re:Prediction: de-anonymization considered "hackin (Score 1) 192

You've elegantly described why stiff federal penalties are needed.

Interesting that when a direct line to someone's pocketbook is defined everyone gets on board, but when it's just a chance someone's drinking water would be tainted with cancer causing chemicals most can't find the connection.
Corporate malfeasance comes in all forms.

Comment Re:Data Security Officer (Score 1) 192

Small problem.
Taxi Hack numbers are available in a publicly accessible data base.
A determined individual probably could find license numbers, they may be publicly accessible.
Failure to understand the vulnerability is the design failure.
A simple solution would have been to order the hashes numerically and re-number them cardinally. ie. 1,2,3 ...
Would take less than a minute, for someone than knew how.
Perhaps a few hours if the right person had to be tracked down.
Never release source data.

Comment Using a published hash - FAIL (Score 1) 192

Using any public hash exposes you to dictionary attacks. Especially when you publish which one you've used.
The quality of the encryption is irrelevant.
Security through obscurity, using a custom algorithm, is the only way.
Taking MD5, it's published, and tweaking a few points (though who ever did this needs to be very competent) would have been sufficient.

Some manager probably said any work for addition security wasn't worth the cost. Ooops!

Submission + - Thunderbird upgrade utter fail!

chromaexcursion writes: It will list all my mail boxes, but will only access one.
NOT the one I care about. multiple mailbox access is totally broken.
I had to delete the mailbox it wanted to use fortunately one that is backed up elsewhere.
Still can't access my other email accounts
Utter failure! (was so tempted to milk this story and say udder)
way to go guys

Comment Re:We HAVE to have a la carte! (Score 2) 340

You don't quite understand the problem.
ESPN and CNN are forcing cable to bundle, not the other way around.
Did you know ESPN is owned by Disney? They force sports fans to get Disney kids ....
Works both ways.
Putting pressure on the cable companies does nothing. Write congress, not much likely to happen there.
Drop to basic service if you don't want bundles.

Submission + - Facebook Releases Controversial 'Friend Tracker' App (infopackets.com)

WubbaDucki writes: Facebook has officially released a new and somewhat controversial feature that allows users to track the location of their friends. But if used maliciously, the app raises major privacy concerns.

The application is called "Nearby Friends" and it uses location information collected by smartphones. Facebook says its goal is to make it simple for people to find their friends and meet up in real life. When it's enabled, Nearby Friends shows users a list of Facebook friends who have agreed to share their location.

Submission + - Risk and the Android Heartbleed vulnerability (networkworld.com)

Steve Patterson writes: Less than 10% of Android devices were affected by the Heartbleed vulnerability.

I haven’t written about the Heartbleed vulnerability. Anything I had to say would have just added to the atmosphere of fear, uncertainty, and doubt, or might have caused a 15-year-old who has been coding since he was five to track me down through stackoverflow to reprimand me for some inexcusable oversight. Don’t laugh, it happens. But now that the dust has settled, here are a few thoughts about the OpenSSL vulnerability, aka Heartbleed, in Android 4.1.1

Slashdot Top Deals

"And remember: Evil will always prevail, because Good is dumb." -- Spaceballs

Working...