111–120 of 125 posts
Earlier quoted context omitted.
Why didn't they just hash all the words they type if you must(maybe bloom filter?)
You would have to hash every possible substring in a sentence.
Earlier quoted context omitted.
Just forbid spaces?
That significantly reduces entropy in the password. Also, the premise is faulty, because as soon as users figure out they can't type their password in the chat, they'll just describe it in words or split it into two pieces etc.
Earlier quoted context omitted.
Why didn't they just hash all the words they type if you must(maybe bloom filter?)
But if you use different hash keys, then you would have to hash each word multiple times.
Earlier quoted context omitted.
It's a matter of storing it in plaintext or not, which any sane developer knows not to. The codebase will always have access to your plaintext password at one point or another, whether it's on signup before they hash and store it, or when you login before comparing hashes. If someone has access to your codebase you've got bigger problems than plaintext passwords anyway.
The codebase will always have access to your plaintext password at one point or another. Not necessarily. The simple solution is client-side hashing. You could combine that with challenge-response to only reveal the password hash to the server once.
Earlier quoted context omitted.
Maybe, but there's much more work that needs doing to secure PII than just not having plaintext passwords. So, they can seemingly avoid doing all that work too, and maintaining those systems (with staffing costs). And you get a leg-up over the competition who can't use the cash that they put in to security. That means those with poor security regimes may "win" because the costs of poor PII hygiene are externalised. I…
> Maybe, but there's much more work that needs doing to secure PII than just not having plaintext passwords. So, they can seemingly avoid doing all that work too, and maintaining those systems (with staffing costs). If the regulators catch someone breaking a rule like this, the consequence should obviously involve an audit that looks for other violations and requires them to fix those too. But even if it didn't, your…
The analysis is similar to a parking fine, if the fine is €1 but parking is €2 per hour then people will chance it.
If the fine is having your car towed and €200 then people will be damned sure not to go even a minute over their paid time.
Earlier quoted context omitted.
There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. Some examples of economic crime would be: not implementing security, tax fraud, overweight freight trucks; speeding to make a delivery on time (whilst on the clock). The first kind of crime is generally made by people who 'know they are wrong, but they feel like they don't…
> There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. The relationship is the opposite of the one you're describing. The problem with personal crimes is that everyone has a different utility function. If you could steal a million dollars at risk of a month in jail, many people would take the risk. Fewer at six months in jai…
It really isn't. The cost of a $2000 for a poor person is huge, the cost for a richer person - whilst significant - is not debilitating. If you've 10% chance of getting caught then a rich person can afford it, getting caught really doesn't hurt so much.
That's why progressive justice systems use means tested fines for things like speeding.
I'm going to guess you're relatively wealthy, your analysis seems entirely wrong to me.
What you get with small fines is people will pay, even if they didn't deserve the fine, because of the cost of time/effort to challenge it.
If a company can save €100k for multiple years, the only downside being that if they're the 1:10000 that are caught they'll have a €20k fine, the financial analysis - morals aside - says don't pay, unless the €20k would sink you.
Earlier quoted context omitted.
> Maybe, but there's much more work that needs doing to secure PII than just not having plaintext passwords. So, they can seemingly avoid doing all that work too, and maintaining those systems (with staffing costs). If the regulators catch someone breaking a rule like this, the consequence should obviously involve an audit that looks for other violations and requires them to fix those too. But even if it didn't, your…
Thanks for expounding your position, I still disagree however. The analysis is similar to a parking fine, if the fine is €1 but parking is €2 per hour then people will chance it. If the fine is having your car towed and €200 then people will be damned sure not to go even a minute over their paid time.
But if you make it a $200 fine with a one in a thousand chance of getting caught, then it's profitable, because then many people rationally take the risk and become a source of citation revenue. But the violation rate is higher, so if that was your goal, it fails -- unless you're still doing vigorous enforcement, in which case high fines are once again unnecessary.
Earlier quoted context omitted.
> There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'. The relationship is the opposite of the one you're describing. The problem with personal crimes is that everyone has a different utility function. If you could steal a million dollars at risk of a month in jail, many people would take the risk. Fewer at six months in jai…
>everyone's utility function is the same // It really isn't. The cost of a $2000 for a poor person is huge, the cost for a richer person - whilst significant - is not debilitating. If you've 10% chance of getting caught then a rich person can afford it, getting caught really doesn't hurt so much. That's why progressive justice systems use means tested fines for things like speeding. I'm going to guess you're relative…
Which is irrelevant for economic issues because both values are in the same units. An hour may be worth more than $500 for a rich person and not a poor person, but $3500 is more than $2000 for everybody.
> That's why progressive justice systems use means tested fines for things like speeding.
Then the super rich will hire a chauffeur to do their speeding for them, or fly in a helicopter, so all you're doing is creating a differential between the low and middle income people. But then either the fine is oppressively high for middle income people or is an inadequate deterrent for lower income people.
Because dollars have a declining marginal utility when you get more, but the relationship isn't linear. Someone who makes $60,000 may have effectively the same disposable income as someone who makes $30,000 (i.e. both near zero) because the first person has higher costs (housing/transportation/other cost of living) needed to live in the area where the higher paying job exists. You also end up penalizing the person who has "double the income" because they have three kids to support and have to work two jobs. Means tested fines are a populist farce.
> What you get with small fines is people will pay, even if they didn't deserve the fine, because of the cost of time/effort to challenge it.
This is not a deterrence issue, and can be solved by returning to the person the true entire cost of the resources and time taken to successfully challenge a false claim against them.
> If a company can save €100k for multiple years, the only downside being that if they're the 1:10000 that are caught they'll have a €20k fine, the financial analysis - morals aside - says don't pay, unless the €20k would sink you.
If the €20k would sink you then surely the €100k/year would, so the amount of the fine in that case is irrelevant. The real problem in your scenario is the 1:10000 chance of getting caught. If you could clear €100k/year for ten years with a 1:10000 chance of getting caught, the fine would have to be ~€10B, which would obviously annihilate any entity for which €100k/year was a meaningful amount of money to be worth skimping to begin with. Which means that no amount exists that could act as an adequate deterrent for a small organization and that probability of getting caught. Any amount over their total enterprise value couldn't actually be paid and therefore doesn't act as a deterrent.
What you need is to improve the chances that they'll be caught. In which case you don't need such a large fine.