Forgot your password?

typodupeerror

Comment: Sensationalist report (Score 1) 121

This report actually tells that with a few exceptions, the grid is protected in the way that federal regulations require. It then goes on to say that federal regulations are not strict enough. It comes up with "tens of thousands of attacks" where everyone that knows what this is about will know that these are a few standard port scans. If you count every package as a single attack, you'll get into big numbers easily. It claims destruction of tens of thousands of hard drives at an Arab oil company, while in truth, these drives weren't damaged, but the contents of them was wiped or changed due to a large scale virus infection. The company had good backups in place and as far as is publicly known, no significant amount of relevant data was lost. The entire attack did cost a lot of money, but nothing vitally critical was damaged and the company is still in business today. I'm not sure, but I doubt the attack even hindered them pumping or selling a single gallon of oil.

The biggest actual threat the report can come up with is physical damage to large distribution station transformers. To damage these, physical action, not cyber, will have to be taken. This is out of scope of the research and should have been kept out of the report.

There are many good recommendations in the report that will improve resilience and resistance against cyber attacks on the US national power grid. However, the tone and exaggeration of the report will make it hard for professionals to take it seriously and for politicians to "do the right thing" and get the things in place to make the recommendations become true.

Comment: I don't care about taxes (Score 1) 91

If companies have trouble advertising because they don't want to sell stuff for a different price in each town, they should uniform the end price and deal with the taxes themselves. They have to pay a different rent on the building they have in each town, they have different wages for their staff, heating costs differ, lots of things differ. I don't see them putting those in the price of each item in every single store individually. Why make an exemption for local taxes for that? This way, people are being lead to believe something is cheap and they will spend more than they can afford. It's human nature to do so, however predictable and preventable. This is a sales trick and it will be in the consumers benefit if they have to stop doing that. Since everyone in the USA is a consumer and only a few percent are a company, there's a clear majority here that will profit from such a law. Companies can't vote, consumers can. The fact that companies still get to do this, shows how much democracy is effective in the USA.

Comment: But not what you just said (Score 1) 251

Whether or not the information is encrypted is not important in this case. It may be to you, but it's not to the party you are dealing with. The big deal is that you can be reasonably assured that you are in fact dealing with that party and not someone imposing as them, or someone intercepting the communications between you and them. HTTPS will always sign each data transmission, making it virtually impossible to alter the data under way or to have someone else impose you.

HTTPS is seldom about privacy, especially with all the monitoring, tracking and statistics going on. Try visiting the web without google or facebook getting cookies and tracking data on you, regardless of you visiting a site that uses HTTPS or HTTP. You can, but you'll have to go through great length to do so.

The data being sent back to you, goes to an e-mail provider you trust. If you don't trust them, you wouldn't be using them. The information you gave to the website is something that isn't that sensitive that you wouldn't want "strangers" to have. If it was, you wouldn't be handing it over to some web site. Yes, your address is in there. Very annoying that over a thousand companies and government departments (on average) have you on file. However, it's trivial to find out where people live, usually, so it's not a very big secret. The most annoying thing to me is the spam they keep mailing you even though you clearly indicated you were not interested in that. Sure, it could be handled a bit more secure than this, but in the end, you are responsible for the amount of personal data you are putting online and you know in advance that once you put it there, certain things are probably going to happen with it. If you only want to deal with companies that will default to sending you GPG encrypted e-mail, you'll not be shopping online a lot for the foreseeable future.

Comment: Still reusing passwords that way (Score 1) 129

by dutchwhizzman (#43760043) Attached to: Password Strength Testers Work For Important Accounts
So I make my password 912345 instead of 12345. Big deal. I use the same password as my matching luggage everywhere. I just put the mandatory characters in front of it. That way, I still have to remember a single password and I can read what to put in front of it on the site itself. Highly convenient and extremely secure.... not.

Comment: Yes (Score 3, Interesting) 129

by dutchwhizzman (#43760027) Attached to: Password Strength Testers Work For Important Accounts
Yes, they have. However, it requires client side applications and it is depending on the keyboard you are using. If you have to type your password on a different keyboard, your timing will differ because of the different placement and mechanics of the keyboard. It is only a reliable extra factor if you use a single type of hardware in very similar locations.

Comment: Believe this (Score 2) 129

by dutchwhizzman (#43760013) Attached to: Password Strength Testers Work For Important Accounts
Attackers are not trying just one account, but many. They don't try a single account from a single IP sequentially. If you have 1 million accounts and a four digit pin to get in, you get 100 accounts unlocked on average with every sweep of a single pin on those 1 million accounts. Get your botnet to do the sweep, give it a little time so people will log in and reset the counters and in a few months you'd have all the accounts unlocked with almost no lock-outs. You might need a little intelligence put in so you'll delay attempts on accounts that got locked out, not use botnet IPs that got locked out for a week or so if you really want to keep a low profile, but other than that, a 4 digit pin is trivial.

Comment: That's not even due to guessing (Score 1) 129

by dutchwhizzman (#43759985) Attached to: Password Strength Testers Work For Important Accounts
Most of "lost password" break-ins are due to the companies demanding you use passwords not storing them properly, giving a hacker a nice database of non or trivially encrypted passwords to use. Password reuse wouldn't be a problem if the password wouldn't be stolen from compromised websites.

I would like to urinate in an OVULAR, porcelain pool --

Working...