381–390 of 526 posts
Can we go back to IRC now, please! Slack is not only distracting, proprietary, but it is also pretty expensive. Let the mere mortals use it, but we should stay away!
That cow left the barn a while ago.
[0] http://sdelements.github.io/lets-chat/
P.S. To clarify, Let's Chat is not IRC-based, but it's slackish and supports XMPP.
Looks like they require Google Authenticator or Duo Mobile app to do two-factor auth. I'm not interested. Why can't they be like Github and just send me a text message? I don't want a dependency on some other company's product to make Slack more secure.
Earlier quoted context omitted.
> what's the risk that someone gains access to your DB but not your app server, vs. the risk that in implementing the pepper, you somehow screw up and store something easily crackable? The question is irrelevant anyway, because if someone gets access to your app server, they get the secret in both cases (pepper and encryption). So the first risk there is present in both cases, which just makes this a static "what's t…
The question is not irrelevant. It's blindingly obvious that salt+pepper protects against DB-only attacks. Injection that does a DB dump, or vulnerabilities in the DB server that don't exist in the app. So yes, S+P protection won't save you if the app server is completely compromised, but it does protect you in case DB only is. And the ability to S+P seems pretty simple to implement and document. Why is everyone pani…
How does one discover that they were hacked? The post states that the breach occurred during February, and this is the end of March... did it just take them a long time to react and write a post about it, or did they likely discover after the fact? If so, how?
True story: Log into server. Why is server slow? Run `top`. Hmm, `./exploit` is consuming 99% CPU...
Slack has now sent me 6 e-mails about this, to the same address :( They have different names associated in each one (i.e. some have my last name, some have an alias, etc), but all to the same target e-mail address.
See my other comment on the same point in this thread.
Earlier quoted context omitted.
Is this actually the sort of people that get attracted to HN? Thinking of others as "mere mortals" and yourselves as gods? Sad picture.
Probably not in that condescending way, but it is useful to keep in mind that people are fundamentally different from you. The trouble is when you think they are inferior beings (their tech skills on the other hand are inferior, no reason to not state that plainly). For what it is worth I have coded Erlang at work and am quite partial to cat pictures, myself.
I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…
hashed_password = scrypt(password, salt + pepper)
store(hashed_password, salt)
Earlier quoted context omitted.
Recommendations related to Security, should start from words "I'm {name}, known expert in IT Security, my works can be found here: {url}". Otherwise such advices should be ignored.
Could not disagree more. Perhaps one should use their own reasoning and the ability to peer-review in conjunction with 'appeal to experience' rather than shut out discussion.