251–260 of 263 posts
Earlier quoted context omitted.
And not servers hosted in other countries? I'd be very curious to hear the thought process behind that decision.
Perhaps all their employees live in the US, so they consider it not worth the trouble to fly someone to Indonesia whenever a server in Jakarta needs rebooting.
Earlier quoted context omitted.
It is not reasonable if the FBI does not have a warrant for your servers(/storage space). Instapaper is completely right to call this "theft". If his servers are included in the warrant because they were suspected of housing whatever it is the FBI was after, and the court granted the FBI the right to seize them, then yeah, it's reasonable. If he was sharing a physical machine with the bad guys, then yeah, sorry, that…
I'm guessing they could have asked to take the whole rack as to not have to tell the hosting company about the raid and risk alerting the target. They also did the raid in the middle of the night which shows they were probably trying to avoid alerting the target. They probably didn't have anyway to know which machine it was just which rack it was. They also probably didn't have to tell the hosting company directly ju…
Earlier quoted context omitted.
I think so too. He says: I have no idea whether I’ll ever see the server again In this case the host probably doesn't know better than him. According to the NYTimes they are a swiss company, they only rent space and connectivity from the data center. I see people jump up and down accusing their host being a bad host when their websites go down for 10 minutes. The thing is, shit like this happens all the time. Some ye…
The problem with DigitalOne was a complete lack of communication around this event. It was a long time (and a lot of badgering) before any of us learned anything about what had happened. I can sympathize with being busy during a crisis, but total silence for 24+ hours, with no working website, email, status page, or twitter account, is not acceptable.
Earlier quoted context omitted.
Are you joking?
No, not at all. Until a few months ago, Instapaper didn't require users to set a password -- you could (and originally were encouraged to) use it without a password at all. This makes a lot of sense. If more sites storing non-critical data did this we'd have far less password fatigue and people more wary about what they trust to such sites. Just now they see their "password1" as impenetrable security when they might…
Earlier quoted context omitted.
This would only be protection against thieves that steal your harddrives, if the US government had your drives they can legally compel you to divulge your password.
There are systems you can use to defeat this. One password decrypts the drive, another wipes it.
Earlier quoted context omitted.
If I get in your car that's just laying there on the street and "borrow" it for a week without telling you anything, do you think the court will question whether I overstepped my bounds ? Do you think I can avoid getting slapped? After all, I do have the right to drive cars, including cars which I don't own.
What? No, seriously-- what? How is this at all analogous to a warranted search? The FBI had permission to take something - so did they perform due diligence to make sure they took the correct something? That is the question. So let's say I gave you permission to drive my car. It's green. You hop in a green car near my house, find the keys in the ignition and leave for four hours of errands. (Typically, I'd give you m…
Earlier quoted context omitted.
Fantastic. One more question: does increasing the work factor automagically upgrade existing passwords in some way? As in, will bcrypt passwords created today be strong enough in 2020?
getsat and tptacek have already answered your question, so I won't rehash that (pun wholly intended), but I should point out that one interesting property of PBKDF2 is that you can increment the work factor (number of iterations). PBKDF2(password, iterations=10) == PBKDF2(PBKDF2(password, iterations=5), iterations=5) Thus you could, say, increase the number of iterations every month. All that said, you should still u…
Earlier quoted context omitted.
I'm not going to lie and say I was already thinking that, but I did have a notion that, in such a scheme, if somebodies passowrd was "1111111" then your salt + password would be the unimpressive 1111111111111. But if you don't mind a follow-up, wouldn't it still defeat rainbow tables? Why not?
In your scheme, if your password is "apple scrapple", the hash value is always going to be (say) "f1d2d2f924e986ac86fdf7b36c94bcdf32beec15". An attacker can precompute that and just use text search to find everyone with the password "apple scrapple".
Earlier quoted context omitted.
The Netherlands, Sweden, etc. provide pretty good coverage and is where a lot of the seedboxes for torrenting are held. If you have something you want the government to have a almost nonexistent (depending on what it is) chance of getting to, go with Russia, China, etc. and other countries that probably don't have the best relations with the United States.
Russia and China are perhaps good examples of places to host something the US government has little chance of getting to, but the governments of those countries are far worse about this sort of thing than that of the States, so I wouldn't want my data to be stored there.
But they are hardly likely to pass onto the FBI the fact that you read the wiki article on Marx and so might be a security risk.
Earlier quoted context omitted.
I dont understand. If you can use mixed-cased, letters and symbols you have 26 * 2 + 20 = 72 possible characters. 72^8 >> 1e9 It would still take more than 8 days to brute force at 1 billion/sec. And using a longer password (16 chars?) would make this a very long time. Or is there other trick that makes this fast? Or, is it simply that people don't choose random, long passwords?
You're looking at more like 5+ billion/sec today. There was a listing of modern consumer video cards + their hashing capabilities posted on another HN story recently, but I can't find it.
Sounds about right http://blog.zorinaq.com/?e=43 And a few times more if it's md5.