161–170 of 194 posts
Earlier quoted context omitted.
"All States shall be entitled to lay submarine cables and pipelines on the bed of the high seas." oh dear.
That's the Geneva convention. It's right after a chapter of Frankenstein.
Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
If you don't particularly trust the included click.js script, you can generate your password's SHA-1 via python fairly easily python -c 'import hashlib; print hashlib.sha1("PaSSw0rd").hexdigest()'
Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
http://www.inutile.ens.fr/estatis/password-security-checker/ (BTW, be sure to type some gibberish into the provided box and hit submit, so you can see why I think this is a very relevant link.)
Amahi (my startup) started experiencing lots of spamming accounts a little while ago. We started using blacklists and some heuristics to detect the spammers. Then we logged the attempts.
Some interesting things emerge.
* The vast majority of them have "super123" as the password * The vast majority use emails from china (163.com, qq.com, etc.) * They try twice in a row if the first attempt fails * They try regularly
The suspicion is that they then sell these accounts in bulk for later action. We have seen them have these accounts sitting idle, with occasional logins to check if they still work. Then later they pounce, posting spam links, etc.
The level of sophistication of all this is rather troublesome ...
Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
I saw a spam once that said "Is your husband's password compromised? Check it on this site ..." clearly trying to social engineer a spouse into 'doing a favor.' These people can be very very very evil.
No seriously, how in the world can we trust this website with our password? They don't even claim to keep your password a secret. For all we know this is a follow-up scam to extend the 6.5mil hacked hashes.
Having a very quick glance at the HTML source, it seems they hash it before it's sent to the site to check, but it easily might have been a scam. Or turn into one with a probability of 1 in 10, that still gets them many passwords while remaining to be trusted.