Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security

Submission + - Are Your "Secret Questions" Too Easily Ans (technologyreview.com)

Submitted by wjousts
wjousts writes: We've all seen the "secret" questions that are used to reset your password on various sites and several high-profile break-ins have resulted from hackers guessing the answers to secret question. This week, research from Microsoft and Carnegie Mellon University, presented at the IEEE Symposium on Security and Privacy will show how woefully insecure these functions are.

As reported in Technology Review:



In a study involving 130 people, the researchers found that 28 percent of the people who knew and were trusted by the study's participants could guess the correct answers to the participant's secret questions. Even people not trusted by the participant still had a 17 percent chance of guessing the correct answer to a secret question.

The least-secure questions are simple ones whose answers can be guessed with no existing knowledge of the subject, the researchers say. For example, the answers to the questions "What is your favorite town?" and "What is your favorite sports team?" were relatively easy for participants to guess. All told, 30 percent and 57 percent of the correct answers, respectively, appeared in the top-five list of guesses.
Unix

Why Do We Name Servers the Way We Do? 1397

Posted by ScuttleMonkey from the just-no-more-muppets-please dept.
jfruhlinger writes "If you use a Unix machine, it probably has a funny name. And if you work in an environment where there are multiple Unix machines, they probably have funny names that are variations on a theme. No, you're not the only one! This article explores the phenomenon, showing that even the CIA uses a whimsical server naming scheme." What are some of your best (worst?) naming schemes?
Programming

Submission + - NSA list top 25 programming errors. (bbc.co.uk)

Submitted by line-bundle
line-bundle writes: The NSA, via BBC has helped put together the list of the world's most dangerous coding mistakes. Over thirty companies including Microsoft, Department of Homeland Security got together to publish the document. The SANS Institute has more information. Just two errors listed in the document account for more than 1.5m website security breaches.
Businesses

Submission + - Is a 9/80 work schedule a good thing? 4

Submitted by
cellocgw
cellocgw writes: "My company is in the process of implementing a version of "9/80," a work schedule which squeezes 80 hours' labor time into 9 business days and provides every other Friday off. I was wondering how this has been implemented in other companies, and how it's worked out for other Slashdot readers. Is your system flexible? Do you find time to get personal stuff done during the week? Is Friday good for anything other than catching up on lost sleep? And perhaps most important, do your managers respect the off-Fridays or pull people in on a regular basis to handle "crises"?"
Bug

Journal Journal: 15 Moderator Points? 1

Journal by nherc

Now, I must admit, I've twice before gotten 10 moderator points at a time. At which time, I had gone looking to find out if this was indeed a /. bug or some new moderation code. I did come across another slashdot user journal at that point (which I can't seem to find again now unfortunately) that mentioned that they too received 10 points as well as a few comments to the same effect. However, no one seemed to know where the additional points that we were seeing came from.
Quickies

Submission + - Too Much Pay For Non-Profit CEO? 3

Submitted by TubHarsh
TubHarsh writes: Not your typical slashdot posting, but want to get the opinion of the community:

I'm stuck in a bit of dilemma here. there is a charitable organization that I really like (they do great work) and have been supporting a lot financially. I recently read through their 1099 form and found that their CEO was paid $200,000 last year, but their program expense was only $800,000. is that too much pay for a small charity? The charity gets income through donations and through earned income (it runs an apple farm for women's empowerment to provide them access to stable employment and income generating assets)
IBM

Submission + - Hot Air from Servers used to heat swimming pool 3

Submitted by
SK
SK writes: "IBM and GIB-Services today announced a new energy efficient "green" data center at a former military bunker outside of Zurich. The new data center is a highly secure data storage facility and will offer a first-of-its-kind energy model where a direct heat exchange will take place between the data center and a public swimming pool in the town."
Privacy

Using Tire Pressure Sensors To Spy On Cars 203

Posted by kdawson from the privacy-under-pressure dept.
AngryDad writes "Beginning last September, all vehicles sold in the US have been required to have Tire Pressure Monitoring System (TPMS) installed. An article up at HexView enumerates privacy issues introduced by TPMS, and some of them look pretty scary. Did you know that traffic sensors on highways can be adopted to read TPMS data and track individual vehicles? How about an explosive device that sets itself off when the right vehicle passes nearby? TPMS has been discussed in the past, but I haven't seen its privacy implications analyzed before. Fortunately the problem is easy to fix: encrypt TPMS data the way keyless entry systems do."
Microsoft

OOXML Rumored to be Approved, Announcement Wednesday 223

Posted by Zonk from the long-hard-slog dept.
dominux writes "Rumors are already circulating that Microsoft's OOXML has been voted in by the standards board. The Open Sourcerer claims to have results of the ballot on dis29500. According to the site Microsoft managed to flip enough countries to make it stick. 75% of the P members who didn't abstain voted for Microsoft (That is 58% of all the P members). 14% of all the P and O members voted to disapprove it, this includes all the new O members that joined just in time to cast their vote. Norway has asked that their vote be suspended due to voting irregularities, but it would take more than that to make a difference to the result. ZDNet is still playing it cautious, noting that an announcement either way is set to be made on Wednesday."
Slashback

Submission + - No Slashdot April Fools Jokes in 2008 8

Submitted by
An anonymous reader writes: Slashdot will not be participating in the April Fools jokes this year due to a lawsuit that was settled out of court with undisclosed terms stemming from the 2007 April 1st stunts. The false stories were determined to be too egregious by a yet to be named individual. Slashdot's parent company SourceForge, Inc. found it wiser to settle out of court then a lengthy battle that was obviously going to span several months.

The ponies will be missed.
Social Networks

Submission + - Internet Division by Zero, Fark/Digg/Reddit

Submitted by
Constantine XVI
Constantine XVI writes: "Digg links to Fark (http://digg.com/odd_stuff/Fark_the_not_news_news). Valleywag covers it (http://valleywag.com/365291/farkcom-gets-dugg-threatening-collapse-of-space+time-continuum), also Digging their coverage (http://digg.com/tech_news/Fark_com_gets_Dugg_threatening_collapse_of_space_time. Fark links to the Digg of the Valleywag story (http://forums.fark.com/cgi/fark/comments.pl?IDLink=3452481. Digg diggs the Fark page (http://digg.com/tech_news/Fark_links_to_Valleywag_linking_to_Digg_linking_to_Fark). And it all ends up on Reddit (URL:http://reddit.com/info/6baan/comments/>). And (assuming this is accepted), it's now on Slashdot, causing the Internet to suck itself into a black hole."

Slashdot Top Deals

This file will self-destruct in five minutes.

Close