181–190 of 220 posts
don't click on unknown links which take you to Google login page and never approve access to your data in any dialog?
Earlier quoted context omitted.
Sadly, PCI compliance requirements believe otherwise :(
The PCI requirement is to change passwords every 90 days.
The requirement should depend on password and hash strength, not some arbitrary decision.
PCI does not recommend employing password entropy checkers either.
90 day password can be weak while passing all the requirements.
Earlier quoted context omitted.
> changing my passwords every 30 days is looking less and less important. Using some non-English Unicode text as password will make the password really strong. I sometimes include Malayalam text for passwords as it's my native language.
Then oauth based attacks like this come along and your password (however strong it may be) and two-factor auth are bypassed completely... It's interesting Apple can scale personally vetting apps for the app store but Google apparently can't be bothered to do the same for apps that could actually ruin businesses and lives with the data they could scoop up
In 10s, why would Google docs ask for an oAuth prompt with big permissions?
People click through security dialogs, it is a known fact.
Earlier quoted context omitted.
Most people today authenticate their email account by typing their password into the DOM and sending it over the wire. It puts a ton of pressure on email providers to be secure. I consider my email password the absolute most important piece of information I have. So although I do agree with you (and have created sites in the past that do passwordless login), the general password problem doesn't really get solved with…
How about two-provider authentication? (2PA?) Send codes/links to two confirmed but independent accounts (email + Twitter, or Facebook + SMS) and require those to be entered. Probably not anymore secure--and a nightmare to manage. But look to consensus algorithms for authentication ideas.
Earlier quoted context omitted.
It's my guess that Mailinator is extremely irrelevant to their plan. They planned to propagate via BCC but they needed a "To:" address - preferably one that didn't bounce. So they hit the "h" key awhile, then added @mailinator.com
Would it have made a difference if they made the "To:" a non-existent address? Would a bounce also prevent delivery to BCC recipients?
Earlier quoted context omitted.
The PCI requirement is to change passwords every 90 days.
And is patently silly, forcing the requirement to decrypt rarely used private keys every 90 days. The requirement should depend on password and hash strength, not some arbitrary decision. PCI does not recommend employing password entropy checkers either. 90 day password can be weak while passing all the requirements.
Making people reset their password every 90 days probably causes more problems than it solves and incentivizes more easily guessable passwords.
Earlier quoted context omitted.
All I see are asterisks, weird.
Bravo. Masterclass username for this comment. I'm dying. (For those who may have missed it in this HN crowd, let me momentarily invoke a veil of joke-explainer and offer this http://knowyourmeme.com/memes/hunter2 of the joke.)
Earlier quoted context omitted.
I like how the code has Javadoc comments, in case other developers need to maintain the worm or use its public API.
That's gotta be a copy-paste job. If someone was actually cheeky enough to comment their malware they would've left jokes, puns, etc.