Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Comment Re:lost password process as an attack vector (Score 1) 549

" your password recovery phrase will be the street you lived on in high school or the name of your first dog. This is not secure" if the email account it sends the password to has already been compromised.

So you use a secure random string for your email (I do) and they also have a password recovery system that's easy to social engineer. And if you're lucky that only goes to another email (rinse, repeat) or to a text on your cell phone... See today's /. article on cell phones being hacked.

Comment Re:Oh great (Score 4, Interesting) 549

In theory it is, but in practice "Love is beautiful, like birds that sing." is more likely to show up in a dictionary attack than a random string of gibberish. Just because it's nearly impossible to brute force doesn't mean it's necessarily a good password. Popular pharses, lyrics, Bible verses, etc can be substituted in a guessing algorithm just like using "$" instead of "S". Here's an interesting article about some of that:
http://arstechnica.com/securit...

Perhaps, but I think that's why the xkcd comic stipulated four random words. It's the human mind's ability to see patterns or visualizations in words ("It's a battery staple!" "Correct!") that makes such phrases easy to remember.

I agree that common phrases may not be good choices. But I'm pretty sure that "gopher banana rim plunger" would be fairly immune to attack, although perhaps unpleasant to visualize.

Comment Re: Oh great (Score 2) 549

Yes please force increased security requirements. I love having upper, lower, minimum length, numbers, punctuation, and a fecal sample all in a password for one of the billion websites that require accounts.

...and passwords will be written on sticky notes pasted to the underside of keyboards. Also fecal samples, I guess, when they start to be required. That should make the office experience so much more pleasant...

Comment lost password process as an attack vector (Score 5, Interesting) 549

Even with the best password, memorized or securely stored doesn't protect you against a password recovery process that's improperly engineered. Often an institution, even a BANK, will give you as a recovery password a choice from perhaps six possibilities, any of which can be divined from publicly available information or a little social engineering. Your password may be q4ot38yhewa;okl, but your password recovery phrase will be the street you lived on in high school or the name of your first dog. This is not secure.

And don't even get me STARTED about pin code security. When I set up my AmEx corporate card, the phone menu suggested strongly that I use digits that are easy to remember, like my mother's birthday. Ignoring the directions and entering a random code, I got rejected because my pin WASN'T A VALID DATE. I called tech support, told the tech monkey the error I was getting and he immediately said that I was to set it to my mother's birthday. I said I didn't want to use something that would so easily be discovered, and he seemed nonplussed. He had to consult with a supervisor. They eventually decided that I could use a random number, but I had to tell him the number over the phone so he could override the menu's requirements to use a valid date. This was AMEX!

Back to the lost password process, I give random strings as answers to the challenge questions, but I figure eventually banks won't let me use strings that aren't a valid dog's name or a listed street name in my home town.

I know why they do this -- it cuts down on service calls to require shlubs to use passwords that are easy for them to remember. But geeze... I foresee a time when we'll all be required to use the common name for an eating implement. Everyone will choose "spoon". The institution will be able to cut customer support back to one person in north-eastern Poland. Or perhaps they already have.

(I use Poland not to denigrate the Poles, but because a company I do business with was quite proud of the low low DL price they got for customer support hotline personnel in eastern Poland. To cover North American accounts. Because that makes sense. Really.)

Comment logical error (Score 2) 622

> and of course the only way to stop nude selfies from leaking, is not to take them.

Um, no. That's one way, but not the only way.

As to the benefit vs risk argument, I guess it depends how much it means to you to have your selfies made public. If you're a kardashian, it's a *feature*. If you're Jennifer Lawrence, perhaps it's an embarrassment, (until she does her first full frontal in a film, and then those frames will be all over the internet) but if she really feels that strongly about it (a "sex crime"? Seriously?) then she should think about (a) take your nudies, but NOT WITH A PHONE, you dope! It's not like you've NEVER HEARD of a celeb's phone getting hacked. Look we know you're smart enough to read a script. You should be able to figure out that phones are not secure. (b) The security of "the cloud" is inversely proportional to the value of the data. That your nudies (which were fairly tame, by the way. And a little grainy. Consider moving out to the patio.) would be a prime target for hackers pretty much goes without saying.

What it comes down to, is this: You don't secure the crown jewels with a $3 novelty lock. Depending on cell phone security to keep nekkid photos of Jennifer Lawrence private is exactly the electronic equivalent of a $3 novelty lock securing the pr0n equivalent of the crown jewels. You don't blame the victim for the crime, but you can point out that the victim did not use security appropriate for the value of the object.

Compared to most of us, Lawrence is loaded. She could afford to have a pr0n assistant (I can already see people lining up for that job) who's sole purpose is to distribute her nudies to whomever she's dating, with appropriate NDAs signed, in a secure fashion.

To wit: Take the photos with a real digital camera, not a phone. Put the physical media in a patched-up, antivirus-protected PC, encrypt the photo, send it via a secure, non-well-known email provider, then destroy the original. Educate the recipient on the value of security and the pain he will experience if he lets it get out.

If that's too much to do, then either don't take nude selfies, or lower your privacy expectations. Don't run around with your pants down and complain that everyone is screwing you.

Comment depends (Score 1) 279

Depends on how many people are living there and what they're doing. The way to think of it is that the 1 GB connection is a great big ol' pipe that'll never be a choke point, no matter how many people are streaming Netflix or torrenting Fedora 20.

That said, my main workstation goes to a 1 GB switch attached to Cat 6 I had punched through the upstairs into the attic, threaded down the folding ladder frame, tacked across the garage ceiling to where the fiber modem is located in the far corner of the garage. So I have a direct full speed connection should I ever need it for anything. But for wifi, it's the cumulative throughput that's important.

Comment Re:metric you insensitive clod! (Score 1) 403

You manage to siphon 4 liters of gasoline from the tank of a broken down truck before fleeing from a pack of motorcycle vandals. How far can you go?

I thought it was two hubcaps full. Given the diameter of the hubcap and the deepest part of the curve (assume the curve is circular) compute the volume. How far can your supercharged Ford Falcon go on the fuel?

Slashdot Top Deals

So you think that money is the root of all evil. Have you ever asked what is the root of money? -- Ayn Rand

Working...