chickopozo - Hackdot

Re:Git tips to stop you getting fired on Tuesday April 09, 2013 @01:26AM (#5516588)

People use a GUI for git?

Re:American Universities Infected by Foreign Spies Detected by FBI on Tuesday April 09, 2013 @01:25AM (#5516582)

/facepalm Whilst the article is written like a movie plot you on the other hand are looking for things that are not there mate.

Re:Show HN: MailRubber, a condom for your email address on Monday April 08, 2013 @06:47PM (#5515195)

http://www.google.com/recaptcha/mailhide/d?k=01eHy-6e8CKpz-d...

k is your id and c is the ciphertext the key is stored on their server.

Re:Show HN: MailRubber, a condom for your email address on Monday April 08, 2013 @06:45PM (#5515185)

This has existed for years: http://www.google.com/recaptcha/mailhide/

And your email isn't stored but rather encrypted and the ciphertext passed via the url.

Re:Meet the nice-guy lawyers who want $1,000 per worker for using scan... on Monday April 08, 2013 @09:11AM (#5511428)

I think the software was called canoscan.

Re:Meet the nice-guy lawyers who want $1,000 per worker for using scan... on Monday April 08, 2013 @09:10AM (#5511425)

I bought a Canon scanner in 1996. It had a one click email button on it. I hooked my computer to the net so... does this mean I should really hold the patent?

Re:Don't Copy-Paste from Website to Terminal on Sunday April 07, 2013 @08:37PM (#5509387)

How is this news? Its been done so many times I've lost count.

Re:Google Spell goes down and no one notices on Friday April 05, 2013 @11:45PM (#5502552)

They used a hacky method from the old IE Toolbar. That's like me scraping a website and blaming them when they change it.

Re:HTML5 Sandbox - a bad idea on Friday April 05, 2013 @11:41PM (#5502542)

TL;DR Author is wrong about clickjacking and sandboxing is a good thing.

Re:HTML5 Sandbox - a bad idea on Friday April 05, 2013 @11:40PM (#5502540)

I commented on the page why the author should not give security advice.

You should use a different domain as there are tricks to leverage arbitrary js on a subdomain.

Sandboxing is to help protect the client from arbitrary crap. It was never intended to protect the server.

And as for UI Redressing (aka ClickJacking) browsers that support the sandbox attribute must support X-Frame-Options.

Re:Bitmessage - a P2P communications protocol to send encrypted messages on Tuesday March 26, 2013 @03:38AM (#5441808)

Great another unproven tool tech "journalists" will be dangerously touting as secure.

See: cryptocat.

Re:Bitmessage - a P2P communications protocol to send encrypted messages on Tuesday March 26, 2013 @03:35AM (#5441797)

He's saying it should not be considered secure until proven.

Re:Digg says it’s serious about building a replacement for Google Reader on Monday March 25, 2013 @07:38PM (#5440413)

Dear Digg,

If you use the work social whilst creating a RSS reader you have already failed.

Sincerely, People who actually used Google Reader

P.S. A point-and-click html scraper to rss would be nice too.

Re:How I became a password cracker on Monday March 25, 2013 @05:45AM (#5436225)

But if you read up I have explained, fast is better in hash functions.

Re:How I became a password cracker on Monday March 25, 2013 @05:44AM (#5436223)

Encryption does not provide Integrity (hash) or authentication (mac)

crypt(1) should be an example of how not to do hashing.

Re:How I became a password cracker on Monday March 25, 2013 @05:36AM (#5436206)

>Outside of this, no one should be using MD5 in this day and age, I would even recommend against Sha256 and other variants in that family, though I have a lot of respect for Blowfish, etc.

@shanelija SHA-256 is a secure cryptographically secure hash function. It is not and was never intended nor should be used as a key derivation function.

Given time and email are not unique, they should not be used as a salt. Concatenation of a salt is not the correct method either, not for KDF and not for message authentication.

One of the aims of a hash functions is to be fast, really fast, super fast while making it computational infeasible to: make a message that will hash to a given value alter a message that when hashed will produce the same or a give value. Find two different messages with the same hash value.

bcrypt, scrypt, PBKDF2 are perfect for password storage.

YOU are not off the hook yet until you repeat these 2 sentences 10 times: A secure crypto algorithm/system/function/whatever MUST continue to be secure even if the algorithm/system/function/whatever is public.

It is perfectly fine to homebrew crypto given one key condition, you never ever ever ever use it for things that matter.

Re:How I became a password cracker on Monday March 25, 2013 @05:21AM (#5436170)

Blog: https://www.cloudcracker.com/blog/

Re:How I became a password cracker on Monday March 25, 2013 @05:20AM (#5436166)

I want my time back, three pages on basically nothing. I broke into my house last year because I lost my keys -> brb writing an article titled "How I became a burglar and locksmith"*

*I took my keys from in the house so... by ars standard that's serious theft.

Rather than reading that article might I suggest having a gander at moxie's https://www.cloudcracker.com and read his blog too for all the goodies.

Re:Lessons Learned Developing Software for Space Vehicles on Sunday March 24, 2013 @07:59AM (#5431813)

The same hardware, in the same location, running the same software, same power source, next to each other.

It's quite likely actually.

Do you do your backups to an identical* computer right next to your main one? (* factor in wear)