Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment Leo is not right on some details (Score 1) 62

1. When you log into most webmail servers (hotmail, google in the early days, facebook, etc) the password is not transmitted "over the air, unencrypted". Most of the time the password page (and the password submission) is encrypted with ssl, but after that they drop back to regular non-encrypted http for reading of the email. So the password is encrypted, but reading the emails are not. Also the cookie (which could be seen as a temporary password) is sent not encrypted during the reading of the email. This means that someone could take that cookie and get onto the email account while that cookie lasts. So he is almost right but they do not get the actual password. 2. Secondly there is this program called SSLStrip which could allow the attacker to get her all her actual passwords including bank passwords and information. Now with a few exceptions she could detect that the encryption was stripped off, but if she is as clueless as she sounds she would probably not notice. As I mentioned there are some exceptions that would make it so she would not notice at all (browser bugs not dealing with null characters in the cert domain name, and others). I have a write up about this at my blog: http://clarkehackworth.com/content/intoduction-ssl-strip-and-building-better-browser

Comment dirty game, security risk, liability? (Score 2, Interesting) 408

This seems like a dirty game that noscript is playing. They are intentionally subverting the intention of the AdBlock plugin. Blocking ads is the intention of the user because the user installed the plugin. Therefore the noscript authors are subverting the intention of the user. Users (some) will put up with this for a while, however if it gets to bad a new "noscript" will be created. It will be a fork noscript is open source or it will be a complete rewrite. There only way this can end well for no script is to not "go too far with it" that it really pisses off users/developers. What "too far" is, is what is under debate. Since what is being blocked is mostly ads from ad servers, can it be claimed it is "part of the content of the page" as some here have described. With snail mail some companies place ads in with your bill. IMHO that does not make the ads part of the bill. However I think this can be a security risk, as ads servers can be a vector for attack. I was listening to a respectable internet radio station that required that I run IE (I know, I have to live in the dark side once in a while). I came back later and found avg saying it found a virus. After some investigation I noticed an ad on the internet radio page had the url, file://c:/windows/system32/. And when I visited that "url" exactly avg popped up again. Now I always block ads when I can (and try not to use IE) because the author of the page has not authorized each ad to be "part of the content". I would hate to live in a world where it was "part of the content" and sites where responsible for the ads that got served. Then again, maybe there would be less ads that way. Anyway, just my 0.02 cents

Slashdot Top Deals

On a paper submitted by a physicist colleague: "This isn't right. This isn't even wrong." -- Wolfgang Pauli

Working...