Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror

Comment Re: Scripts that interact with passwords fields aw (Score 1) 357 357

By default, everything you save in RF is encrypted into discrete files before being synchronized to the server.

I have encryption turned off for bookmarks so that I can have a roaming set of bookmarks across all my devices without having to enter a password to decrypt them. Same goes for contacts.

Comment Re:Unenforceable (Score 1) 195 195

I have seen systems that prevent screen capture as well.

We have some standards documents which must be purchased. In order to prevent copyright theft, the distributor of the PDF files requires software on your computer which will actively disable the native clipboard and screenshot capabilities while the PDF is open. In addition, the software will look for common screenshot software like snagit and greenshot and force them to close before you can launch the PDF.

Despite all of that, a user could still abuse the spirit of the rules in this case by using the 1 allowed hard copy to print out the entire standards doc and then scan it back into the system...

So, I guess my point is, you could lock down the screenshot bit... perhaps you could also lock down the picture capability too by interfering with interlacing and/or refresh rates somehow.... but I guess it just depends on how far you are willing to go...

Comment Re: Scripts that interact with passwords fields aw (Score 1) 357 357

I have been using RoboForm for many years and have always loved it. It is about as cross-platform as you could want (it's Windows Mobile support is a little lackluster, but its iPhone and Android support are the best I have seen).

Before they switched to the cloud sync platform, I had 5 registered copies I was maintaining, it was worth that much to me. Then they switched to the Everywhere product which gives you as many devices as you want for around $25/year.

I have never had a problem with it other than the usual issues one gets when synching from many different devices. The occasional password will slip through the cracks because your device wasn't online to sync properly and then propagate to your other devices. I would guess this is the same issue you would find with LastPass or any other cloud synching PM.

Comment Anyone else (Score 4, Insightful) 100 100

Just getting by with Netflix and Amazon Prime?

I haven't had a full cable TV package for at least 6 years and I really can't say that I miss it.

I suppose there are some shows that I might be missing out on... but they eventually make it to Prime or Netflix and then I can just binge them. And if they don't, I never saw them in the first place so I can't miss what I never had...

Recently when CenturyLink offered me a bundle deal with my gigabit Internet it almost doubled the price... I opted to just pay the full price for the Internet. I don't understand why people would pay $100 extra a month for hundreds of channels they will never watch...

When will channels just be offered a-la-cart?

Comment tip of the iceburg (Score 4, Insightful) 157 157

It is becoming increasingly obvious to me that we have no idea how to secure information systems.

It's this kind of stuff that scares the crap out of people and there is no end in sight. As a matter of fact, this is only going to get worse as we migrate to an IoT.

I sometimes wonder if the technology bubble will someday be crushed under the weight of exploitation. A victim of its own complexity and insecurity.

Comment Never understood (Score 4, Insightful) 428 428

It has been so taboo at many of the places that I have worked to talk about salary.

The place I work now is very guarded about this as well. We recently had someone canned because they opened someone else's offer letter (which was sitting on a shared workstation).

I have always just assumed it was conspiracy cooked up in a board room full of men long ago as a way to enable pay inequality.

Comment Re: actually had this on my list today (Score 1) 157 157

I simply disable all SSH access to all hosts except one.

I call that a jump box.

I then disabled all authentication except public key (I already had ChallengeResponseAuthentication and KbdInteractiveAuthentication set to no).

I enabled key, TCP and X11 forwarding.

I just use the jump box to get to all my internal hosts using public key authentication with password authentication as a fall-back.

In a pinch it can even act as a "poor man's VPN" by forwarding TCP to internal hosts.

Mostly, I use it in conjunction with Xming (on the Windows client) and cssh to launch XTerm SSH windows to groups of Linux hosts.

Comment A for effort (Score 1) 58 58

We conduct internal phishing tests from time-to-time. We find them to be a valuable part of our overall security framework.

I think that their biggest mistake here was not notifying their employees that random phishing tests will be conducted and to stay vigilant.

It probably would have also been better to start small on their first round.... "click here to take a survey and receive a free x" instead of, you know, instilling the fear of financial ruin...

"It might help if we ran the MBA's out of Washington." -- Admiral Grace Hopper

Working...