Forgot your password?

typodupeerror
Security

Mitigating Password Re-Use From the Other End 211

Posted by Soulskill
from the 12345-goaway-letmein dept.
An anonymous reader writes "Jen Andre, software engineer and co-founder of Threat Stack, writes about the problem of password breaches in the wake of the LivingSocial hack. She notes that the problem here is longstanding — it's easy for LivingSocial to force password resets, but impossible to get users to create different passwords for each site they visit. We've tried education, and it's failed. Andre suggests a different approach: building out better auditing infrastructure. 'We, as an industry, need a standard for auditing that allows us to reliably track and record authentication events. Since authentication events are relatively similar across any application, I think this could be accomplished easily with a simple JSON-based common protocol and webhooks. ... [It] could even be a hosted service that learns based on my login behaviors and only alerts me when it thinks a login entry is suspicious— kind of how Gmail will alert if I am logging in from a strange location. Because these audit entries are stored on a third-party box, if a certain web application is compromised, it won't have access to alter its audit log history since it lives somewhere else.'"

Comment: Re:Hydrogen fuel cells are a dead end (Score 1) 191

by spage (#43322693) Attached to: New Catalyst Allows Cheaper Hydrogen Production

Batteries are the way you get a decent boost to the efficiency of burning anything in an inefficient combusion engine, viz hybrid powertrains. Keep dreaming that ethanol from anything will become so cheap that you don't care about efficiency. Meanwhile plugging in is the cheapest, most efficient, and least-polluting way to make a car go the first XX miles right now.

I'm not against ethanol from biomass, though it's a far less efficient way to get energy from an area than covering it with solar panels, and the processes all require substantial energy inputs. If and when ethanol from anything is cost-effective it'll serve as a fine fuel for the range-extender engines of plug-in cars that mostly run off their batteries.

Comment: hydrogen ICE is dead, FCV dream persists (Score 1) 191

by spage (#43322639) Attached to: New Catalyst Allows Cheaper Hydrogen Production

Nobody is making a hydrogen-powered internal combustion engine. BMW only made 100 7-series hydrogen models in 2006, and the Mazda hydrogen Wankel (2008) was never produced in quantity. It's tough to store a lot of it hydrogen a car, so you need a more efficient powerplant than blowing up a fuel to make heat and a little forward motion. That powerplant is a fuel cell, essentially reversing electrolysis to drive an electric motor. Fuel cell vehicles are out there, Honda has leased a few dozen FCX Claritys in Southern California, the only place in the USA with a handful of public H2 refueling stations.

The latest optimistic date for hydrogen fuel cell vehicles to be finally really genuinely truly here is 2015, and Hyundai and Mercedes-Benz and maybe Toyota are most serious about offering models. But the relative success of the Volt and the Ford and Toyota plug-in vehicles shows far more people are happy to plug in at home for their regular commute and use a conventional gas engine as an occasional range extender. "Early adopters ready to spend big money" will mostly buy Teslas with huge battery packs that can recharge (slowly) anywhere. The market of rich environmentalists who don't have access to a plug and live near the handful of H2 refueling stations and who regularly drive long distances is TINY, and will remain so until fossil fuel becomes vastly more expensive.

Comment: Re:WHY?!? (Score 3, Informative) 124

by spage (#43309529) Attached to: Emscripten and New Javascript Engine Bring Unreal Engine To Firefox

Why? Because you're in a browser right now and it's the most popular software platform ever.

Where's the controller/joystick API for the web browser?

https://wiki.mozilla.org/GamepadAPI

WebGL is just VRML version 2.

No it isn't.

We have too many layers of cruft/abstraction layers/API's to deal with.

WebGL sends shader programs to the GPU which executes them. There isn't a layer underneath it.

A properly designed "world browser" that actually starts in the 3D environment and perhaps renders flat 2D web pages as such would make a lot more sense instead of trying to shoehorn 3D into a 2D "web page"

People had no interest in such world browsers, several companies including Microsoft offered them in the 90s and they all died. Microsoft's 1997 technology was called Chrome (yes, really), and they promised "Chromeffects would turn a web browser into a rippling, 3D space with audio and video playback".

Meanwhile people do like 3D games, they do love running things in their browser, and the fullscreen API lets the game canvas go fullscreen. Enjoy your lawn.

Comment: the common platform is Linux (Android/Mer) or web (Score 1) 152

by spage (#43056039) Attached to: Ubuntu Touch Beats Firefox OS For 'Best of MWC' From CNET

With luck there will eventually be a push for a standardized tablet platform that is open enough to permit users to select their own OS.

That standard platform is the Android kernel.

porting Ubuntu touch:
To rapidly support a wide range of devices, our architecture reuses some of the drivers and hardware enablement available for Android.
porting Firefox OS:
Boot to Gecko (Firefox OS) uses a kernel derived from Android, with a Gecko-based user interface on top of it.

Meanwhile Plasma Active, Salifish, and Tizen are based on a traditional Linux platform, and the Mer project hopes to be the common core distribution for them.

For the tiny fraction of users who "select their own OS", device popularity and an unlocked bootloader matter far more than standardization. If you buy an unsuccessful phone, it won't have a community providing images for it and jailbreaking its bootloader if necessary.

The standardized platform is vital for all these also-ran OSes to get lots of apps. Aaron Seigo's post about standardizing the QML compontents across KDE Plasma, Jolla Sailfish, BlackBerry 10 and Ubuntu is a good sign, but they still suffer from inconsistent device APIs and different packaging requirements. That's where Firefox OS has a theoretical edge: apps for it are just web pages with a manifest. The number of web developers (incuding "app" developers who just put a wrapper around an HTML app) is orders of magnitude more than QML developers.

The Mozilla Open Web Apps project proposes some small additions to existing sites to turn them into apps that run in a rich, fun, and powerful computing environment. These apps run on desktop browsers and mobile devices, and are easier for a user to discover and launch than Web sites. They have access to a growing set of novel features, such as synchronizing across all of a user's devices.

Most likely this will come from the second tier Chinese manufacturers who would benefit most from a common reference standard.

They don't push for anything. They ship Android.

Comment: Re:HTML is orthogonal to offline (Score 1) 242

by spage (#43032313) Attached to: Ask Slashdot: Can Quickoffice On Chromebooks Topple Microsoft's Office?

There's a big difference between going to a web site and being able to run it offline, vs. downloading then running a setup.exe (and re-installing the Java or .NET runtime you got rid of in 2011). HTML5 delivers a universal zero-install runtime that eliminates any "installation" step, and when the user is connected there is no "upgrade" step either. It ought to be the future. I may never get a Firefox OS phone, but I'm looking forward to its app stores and Mozilla's advocacy to make any web page an app.

Comment: What about Google Docs in browser toppling Office? (Score 3, Interesting) 242

by spage (#43031295) Attached to: Ask Slashdot: Can Quickoffice On Chromebooks Topple Microsoft's Office?

Forget the clickbait question posed. As the one (!) commenter on the Slashdot Business Intelligence post asked,

What advantage does QuickOffice have over the existing Google Docs?

Google Docs already runs in the browser that's the central focus of Chromebooks/ChromeOS. Offline Google Drive/Google Docs editing has been available on any computer running Chrome since version 20 last year and works well,

So why is Google screwing around with Native Client (which will never run in other browsers), developing a separate codebase and another UI? There's a part of Google that believes in the open web, and then there are all the groups doing Android and Native Client and Dart and whatever. Either upper management is too weak to corral all the divisions, or they're happy to develop proprietary ecosystems just in case one succeeds the way Android did.

Comment: HTML is orthogonal to offline (Score 1) 242

by spage (#43031219) Attached to: Ask Slashdot: Can Quickoffice On Chromebooks Topple Microsoft's Office?

Offline use of a notebook stops you from using web-based applications.

An HTML app can run fine locally. Use an HTML5 app manifest to cache the app code, and LocalStorage to cache the content.

And yet apart from the venerable TiddlyWiki and some Firefox extensions, neither of which uses HTML5, none of the browser-based apps I use do this. The problem is no longer technical, rather it's that every bloody company with a web application (including Google) wants you to connect and sign in, so they can abuse your privacy, monetize your personal information, and sell ads.

Replyer cusco said "[people] need a real computer with a standalone operating system." That describes Chromium OS and Firefox OS. They don't somehow fail to boot when you have no network access, any more than a phone does.

Comment: no, kids and more are fine with Google Apps/Docs (Score 1) 242

by spage (#43031137) Attached to: Ask Slashdot: Can Quickoffice On Chromebooks Topple Microsoft's Office?

I work in an educational setting and we use Google stuff. Everyone hates it. Teachers have MacBook Pros and kids have MacBook Airs with Google Apps. No one likes Google Apps. No one. People want traditional installed MS Office or Office 365.

I really doubt that "Everyone" part. Kids don't give a damn. My nieces and nephews are happy using Google Apps/Google Docs to submit homework, and as they acquire tablets they love just having the documents available on all their devices.

In fact everyone I know I've shown Google Docs to is happy with the features. But if they're over 25 they've got File > New / File > Save As... and saving to an overstuffed disorganized mess of a Documents folder (or worse, the Desktop folder) ingrained in their hind-brains, and struggle to evolve past it.

Companies can evolve. I was in a meeting yesterday that was getting off-track and several managers began editing a Google spreadsheet replacement for the chicken scratches on the whiteboard.

Comment: no, insanity-laded pages (Score 1) 369

by spage (#42997971) Attached to: Firefox Will Soon Block Third-Party Cookies

Those DNS queries are tangential to cookies. The requests to advertising and market intelligence companies for images and scripts pass info about the current page and your IP address, and the JavaScript code they load sends additional information. Even if you block cookies those companies get enough information to fingerprint you and figure out you're the same person who visited all the other pages on which they loaded their crap.

So run AdBlock and Ghostery, but the latter will break some functionality.

Comment: Ghostery is great but breaks web sites (Score 1) 369

by spage (#42997603) Attached to: Firefox Will Soon Block Third-Party Cookies

Ghostery is fantastic, but
* Disqus comments don't show up (a third party tracks your activity across web sites)
* Google Play cheap deal links stop working ("Ghostery prevented a redirect from clickserve.dartsearch.net to ad.doubleclick.net")
* some sites including aol.com properties completely break (the morons coding those sites rely on blocked JS code pulling in vital functionality like showing images and expanding comments, maybe intentionally)
Sadly there's no way I can recommend Ghostery to the average web user. And the last problem suggests any site that wants to screw Ghostery users can simply rely on an ad network's copy of jQuery, so that when Ghostery blocks it the site falls over.

Even blocking third-party cookies is troublesome. It again breaks many Disqus comment implementations, and several companies that present bills online seems to rely on my bill-pay site setting third-party cookies on the corporate site. Firefox's implementation will work in these cases, as I've been to both Disqus and those companies' web sites.

Comment: VC money does none of those things (Score 1) 369

by spage (#42997439) Attached to: Firefox Will Soon Block Third-Party Cookies

VC money is a cancer on the tech industry, because it creates unsustainable business models, suppresses competition, and turns the customer into a product.

VC money did none of those things. The hundreds of thousands of non-VC-funded businesses hoping to make money off ads demonstrates the two are unrelated. In fact the gold rush mentality of VCs increased competition, and funded various alternatives to ad-supported web sites (microtransactions, CyberCash, subscriptions, link trading, etc.) which all failed to gain traction. How would things have been any better if corporate portals like go.com and msn.com had dominated the web due to an absence of thousands of VC-funded competitors?

As you say, the public chose ad-supported, and that predictable outcome is nothing to do with "VC money". Meanwhile the low barriers to entry make it possible for non-ad supported web models to exist; I don't run ads on my blog, and projects like DIASPORA* and Freedom Box are providing an alternative to "customer as product."

Comment: YAHASWW (yet another HTML5 apps story without Web) (Score 3, Interesting) 37

by spage (#42953035) Attached to: Tizen 2.0 Magnolia SDK and Source Code Released

Tizen joins Blackberry 10, Firefox OS, webOS, and Windows 8 in saying "Write HTML5 apps for our platform". Unfortunately these are all also-ran platforms, but it does make it easier for PhoneGap to target them along with turning HTML5 into Android and iOS native apps.

So where are these HTML5 apps? I don't want to have to connect to a a web site and hand over my personal details to maintain a list or edit a photo in my browser. I should be able to try out any application in my browser, and if I like it "pin it" to run locally. I hoped FLOSS developers would step up and develop these, but they seem stuck in the 90s arguing irrelevancies like GTK vs. Qt and Python vs. C++.

Instead there are hundreds of thousands of "apps" that are nothing more than HTML5 packaged a certain way, all dumped into a few needlessly platform-specific App stores.. It's a travesty of the principles of the web, and for no good reason. At least Mozilla has the right vision:

The Mozilla Open Web Apps project proposes some small additions to existing sites to turn them into apps that run in a rich, fun, and powerful computing environment. These apps run on desktop browsers and mobile devices, and are easier for a user to discover and launch than Web sites. They have access to a growing set of novel features, such as synchronizing across all of a user's devices.
...The only thing you have to do to create a Web app from a Web site is to add an app manifest. This is a JSON file that describes your app, including its name, its icons, and a human-readable description.

+ - CNN/Money Reporter Drives Tesla - Confirms Company's Claims->

Submitted by
karlnyberg
karlnyberg writes "Putting to rest the conflict between Tesla's Elon Musk and New York Times Reporter John Broder, CNN/Money's Peter Valdes-Dapena drives DC to Boston (primarily to test the SuperCharger network):

As he says in the money quote and byline of the article:

In the end, I made it — and it wasn't that hard.

As for the Supercharger network? Turns out that works, too."

Link to Original Source

VMS must die!

Working...