chickopozo

People use a GUI for git?

/facepalm Whilst the article is written like a movie plot you on the other hand are looking for things that are not there mate.

http://www.google.com/recaptcha/mailhide/d?k=01eHy-6e8CKpz-d...

k is your id and c is the ciphertext the key is stored on their server.

This has existed for years: http://www.google.com/recaptcha/mailhide/

And your email isn't stored but rather encrypted and the ciphertext passed via the url.

I think the software was called canoscan.

I bought a Canon scanner in 1996. It had a one click email button on it. I hooked my computer to the net so... does this mean I should really hold the patent?

How is this news? Its been done so many times I've lost count.

They used a hacky method from the old IE Toolbar. That's like me scraping a website and blaming them when they change it.

TL;DR Author is wrong about clickjacking and sandboxing is a good thing.

I commented on the page why the author should not give security advice.

You should use a different domain as there are tricks to leverage arbitrary js on a subdomain.

Sandboxing is to help protect the client from arbitrary crap. It was never intended to protect the server.

And as for UI Redressing (aka ClickJacking) browsers that support the sandbox attribute must support X-Frame-Options.

Great another unproven tool tech "journalists" will be dangerously touting as secure.

See: cryptocat.

He's saying it should not be considered secure until proven.

Dear Digg,

If you use the work social whilst creating a RSS reader you have already failed.

Sincerely, People who actually used Google Reader

P.S. A point-and-click html scraper to rss would be nice too.

But if you read up I have explained, fast is better in hash functions.

Encryption does not provide Integrity (hash) or authentication (mac)

crypt(1) should be an example of how not to do hashing.

>Outside of this, no one should be using MD5 in this day and age, I would even recommend against Sha256 and other variants in that family, though I have a lot of respect for Blowfish, etc.

@shanelija SHA-256 is a secure cryptographically secure hash function. It is not and was never intended nor should be used as a key derivation function.

Given time and email are not unique, they should not be used as a salt. Concatenation of a salt is not the correct method either, not for KDF and not for message authentication.

One of the aims of a hash functions is to be fast, really fast, super fast while making it computational infeasible to: make a message that will hash to a given value alter a message that when hashed will produce the same or a give value. Find two different messages with the same hash value.

bcrypt, scrypt, PBKDF2 are perfect for password storage.

YOU are not off the hook yet until you repeat these 2 sentences 10 times: A secure crypto algorithm/system/function/whatever MUST continue to be secure even if the algorithm/system/function/whatever is public.

It is perfectly fine to homebrew crypto given one key condition, you never ever ever ever use it for things that matter.

Blog: https://www.cloudcracker.com/blog/

I want my time back, three pages on basically nothing. I broke into my house last year because I lost my keys -> brb writing an article titled "How I became a burglar and locksmith"*

*I took my keys from in the house so... by ars standard that's serious theft.

Rather than reading that article might I suggest having a gander at moxie's https://www.cloudcracker.com and read his blog too for all the goodies.

The same hardware, in the same location, running the same software, same power source, next to each other.

It's quite likely actually.

Do you do your backups to an identical* computer right next to your main one? (* factor in wear)