Earlier quoted context omitted.
A FAANG wouldn't, but a corporate building e.g. a second-tier system holding customer data might.
Off-topic, but why is there no M in FAANG?
The term was originally coined in order to talk about stock price behavior.
Security Update
171–180 of 207 posts
Re: Security Update
#172Earlier quoted context omitted.
Emails can be sensitive if they are corporate and patent trolls are the buyers.
They can also be sensitive for people who ask rather personal questions on the site...
Or even worse - someone could steal my identity and start answering to JavaScript questions just to frame me.
Re: Security Update
#173Earlier quoted context omitted.
They can also be sensitive for people who ask rather personal questions on the site...
Or even worse - someone could steal my identity and start answering to JavaScript questions just to frame me.
I assume this is a joke? I was being serious in my comment -- and I was referring to other StackExchange sites, not StackOverflow.
Re: Security Update
#174Earlier quoted context omitted.
How do you update password storage if you don't store the passwords only hashes? You could upgrade it for new users, but for old ones? (e.g. I don't change passwords often)
Onion hash: hash the existing hash with the new algorithm.
That throws away entropy, but I suppose so long as very few hash collisions of a password are likely to be real passwords themselves it would be harmless.
Re: Security Update
#175Probably a really stupid question... but how do people detect an intrusion like this?
Re: Security Update
#176Earlier quoted context omitted.
"X bcrypts per second" is completely meaningless. What was the bcrypt setting? With the right setting, it would not be more than 1 bcrypt per century, or with the wrong setting, an almost equivalent rate to md5. It depends. More meaningful would be the speedup compared to a single CPU core, which is what the developers (should) benchmark against. They should make it as slow as possible, so if their system can do bcry…
> With the right setting, it would not be more than 1 bcrypt per century You can't really call that a "right" setting when it takes at least as long to log in...
Right was meant as necessary to achieve that effect (sorry, English is not my native language). Obviously this is not a recommendation but just to point out that its configuration ranges from negligible to (on today's computers) forever.
Re: Security Update
#177Earlier quoted context omitted.
Plus, both are great software. KeePass2Android is the best Android password manager, bar none.
I used to be a fan of keepass as well, but I moved to bitwarden maybe 18 months or so ago. For $10 a year for the paid version I get MFA and some other features. I find it a much more seamless experience than keepass/etc, as it works as a browser extension or a discrete app (the Android app uses accessibility features so it detects other Android apps asking for authentication as well as Android browsers such as Firef…
I moved to BitWarden too, but mainly because the browser extension for KeePass (Kee) didn't work well. BitWarden is good, but the Android app is nowhere near KeePass2Android, which I sorely miss.
Re: Security Update
#178Earlier quoted context omitted.
> But if you use an alias (and only reveal your real name after the company agrees to interview you), then it's not a problem either! Do you do that? Do you know anyone that does? If so, how do people react to it?
i use an alias on stackoverflow, and i use an alias here on HN! My google profile is also an alias. My facebook profile is also an alias. My twitter, same. And if i had a linked-in profile, it would be an alias too. Some of those alias may be the same, but some i deliberately make different, so that i can choose whether others can associate different aliases together as the same person. Why anyone puts their real nam…
Do you use different email addresses too?
Re: Security Update
#179Earlier quoted context omitted.
> But if you use an alias (and only reveal your real name after the company agrees to interview you), then it's not a problem either! Do you do that? Do you know anyone that does? If so, how do people react to it?
i use an alias on stackoverflow, and i use an alias here on HN! My google profile is also an alias. My facebook profile is also an alias. My twitter, same. And if i had a linked-in profile, it would be an alias too. Some of those alias may be the same, but some i deliberately make different, so that i can choose whether others can associate different aliases together as the same person. Why anyone puts their real nam…
You replied about online usernames, but not about the question asked - do you apply to jobs using an alias / how do companies react when you change your name in the process?
Re: Security Update
#180Earlier quoted context omitted.
Well, nobody should be using MD5 (nor should they have been using it 20 years ago with the introduction of bcrypt). In fact, nobody should be using any hash function that was designed for speed (such as the SHA family) because you don't want fast hashing of passwords . Modern cryptographic hash functions that are tailored for password hashing (such as scrypt or Argon2) are much harder to brute-force and have tunable…
There are plenty of publicly leaked hash tables running MD5 and the like. Just because modern hash functions exist does not mean they are in use. [1] Also you do not need the hash table of a hardened system to get useful passwords. You need a reused password from a weak one. [1] https://hashes.org/leaks.php
They′re not saying nobody is using MD5; they’re saying “nobody should be using MD5” (emphasis mine).