171–180 of 220 posts
Earlier quoted context omitted.
cs91PvMVtET37V%eKEMut0LI^kQYp3e&jSuCGl!9Lp Lastpass.
All I see are asterisks, weird.
I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information." That last part was in reference to one of my proposed mitigations…
Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.
Software bugs should be no less than product defects, with possible fines in place.
Earlier quoted context omitted.
Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.
> changing my passwords every 30 days is looking less and less important. Using some non-English Unicode text as password will make the password really strong. I sometimes include Malayalam text for passwords as it's my native language.
Earlier quoted context omitted.
cs91PvMVtET37V%eKEMut0LI^kQYp3e&jSuCGl!9Lp Lastpass.
All I see are asterisks, weird.
(For those who may have missed it in this HN crowd, let me momentarily invoke a veil of joke-explainer and offer this http://knowyourmeme.com/memes/hunter2 of the joke.)
Earlier quoted context omitted.
Absolutely! My favorite is usually referred to as passwordless authentication, and generally means that when a user gives you their email address/SMS/etc, you send a login link to their device. Here's an article: https://medium.com/@ninjudd/passwords-are-obsolete-9ed56d483...
Most people today authenticate their email account by typing their password into the DOM and sending it over the wire. It puts a ton of pressure on email providers to be secure. I consider my email password the absolute most important piece of information I have. So although I do agree with you (and have created sites in the past that do passwordless login), the general password problem doesn't really get solved with…
Probably not anymore secure--and a nightmare to manage. But look to consensus algorithms for authentication ideas.
The bad thing about centralized internet is it makes some mail servers much juicer targets than the decentralized mail servers of old. I decided gmail wasn't for me when I read they harvested your emails for ads. 1GB in 2004 sounded so enticing too! If you are technically savvy and have access to a static IP, I highly recommend setting up postfix/dovecot and registering a domain. It's fairly straight forward for tech…
Earlier quoted context omitted.
This was particularly effective because the app was registered as "Google Docs" - to not even filter names of your own products out seems ripe picking for imposter apps.
I've seen this point and agree with it, but I really have to wonder: if the app was just called "Documents" or "My Docs" and had a professional-looking icon, would a significant number of people really have given it a second look anyway?
The bad thing about centralized internet is it makes some mail servers much juicer targets than the decentralized mail servers of old. I decided gmail wasn't for me when I read they harvested your emails for ads. 1GB in 2004 sounded so enticing too! If you are technically savvy and have access to a static IP, I highly recommend setting up postfix/dovecot and registering a domain. It's fairly straight forward for tech…
And then nobody ever receives your mail because the big mail servers don't trust you.
Earlier quoted context omitted.
Unicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.
The problem, it seems, is that we are increasing the complexity of the "Secure Software" in an attempt to thwart the most sophisticated attacks. However, as many people are already thinking, Complexity reduces Security and Stability. Therefore, it seems that the more we try to fight the "hackers", the more likely we will add some insecurity which they can exploit.
Complexity can both improve and reduce security depending on specifics, and thus generalizes to "no correlation" demonstrating that generalizations are often misleading.