Viewing profile — royce

The rest of the snark/ bitterness aside ... NTP takes latency as a constraint, and accommodates for it. And far from a disgrace, NTP was a brilliant design for its time, and has pr…

Someone seems to have dropped the "EXCEPT EUROPA" part. ;)

I work in telco, too - by my read, they're not disagreeing: Although Diameter was intended to replace RADIUS, the protocol itself offers no security when used over TCP. As a result…

The paper https://www.blastradius.fail/pdf/radius.pdf ) explicitly states DIAMETER "never replaced RADIUS for many common use cases" and "the protocol itself offers no security whe…

CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3596 Nothing on oss-security list yet, but it'll appear here: https://www.openwall.com/lists/oss-security/2024/07/09/ E…

Naively, would there be any value in providing an RSS feed of new adds, date changes, etc. ?

"[PATCH] socks: return error if hostname too long for remote resolve Prior to this change the state machine attempted to change the remote resolve to a local resolve if the hostnam…

That's an entirely different threat model. hotpotamus is right - the article, and the threat model, are about offline attack of back-end password hashes , after they've been stolen…

Being able to firmly reject all unauthenticated messages is still the target end state. The risk of a threat actor sending an email that looks completely legit, and simply asking t…

Site author here. Thanks for helping to get the word out - every bit may help someone. While I consider my page to provide useful color, and I validate and summarize and cache info…

Am I the only one who thinks this sounds a lot like how pyramid schemes work?

It's now been cracked - and now we know why it took so long: https://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.h...

It depends on the organization. Some larger financial institutions are sometimes more likely - or even bound by internal policy - to simply trigger their standard card-cancellation…

Or Alaska or Hawaii - same problem (shipping restrictions invisible until checkout). It's insane. They know exactly where I live.

The superset of all of the original CSRG-shipped cracking-eligible descrypt hashes is actually about 1400 hashes, drawn from a slightly smaller number of overlapping accounts among…

I'm startled that there's no mention of app whitelisting yet. Code signing reduces ops overhead and latency in environments that are using app whitelisting. If the code is signed, …

Yep, that was exactly why (or at least, very strong circumstantial evidence): https://productforums.google.com/d/msg/websearch/H4XbbwWmtAY... I don't think it was ever officially a…

Now that Google+ is going away, can we have the +string operator back in Google Search, to force inclusion of a single string (instead of having to use double quotes)?

For us (early regional ISP, mid-'90s), a lack of separate per-service hostnames caused significant scaling fragility. In the initial rollout, all services were served from a single…

If someone is developing web applications in such a way that they need support from their browser vendor to make them work properly ... they're doing it wrong.

What about the other case - when they're not random, but also not reused ... such that the psychology of the user's password-selection methodology might be exposed?

Just because the horse is out of the barn doesn't mean that the owner of the barn knows about it yet.

> What does that buy you, if they are in plain text? Nothing. That's why I was agreeing with you for that subset. But N may be smaller than you might think, when frequency data is …

> Shadowed password files may as well store passwords in cleartext; if those passwords are not reused anywhere, the situation is safe Wait, what? If they were randomly generated an…

Random passphrases are indeed a good idea. XKCD #936 advocates for 4 words randomly selected from a 6000-word dictionary, which is 6000^4, or ~1.296 × 10^15, which isn't actually t…