103 reputation
6
bio website
location Newcastle upon Tyne, United Kingdom
age 29
visits member for 3 years, 8 months
seen Jul 17 at 12:36

Lapsed Catholic. Luddite Geek. Shy Chatterbox. A mass of contradictions wrapped in an open enigma.

Some days, I really regret making http://stackoverflow.com/a/3638034/14250 a comm. wiki question. Then I get back to helping people solve problems rather than trying to help myself score rep. (Man, but 370 upvotes. Three. Hundred. And. Seventy.)


Jul
22
comment Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?
@DanNeely Even if you clone the system, couldn't what you've cloned reach out across the network to a box on the original system via a hardcoded network address which you've cloned along with the rest? Yes, you could isolate the system, but at that point, you've changed the environment so radically that your tests don't test the thing you're testing.
Jul
18
comment Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?
@Matt I agree. It's a failure to comprehend, not a failure to convey. If this is the standard language, the contract really can't say anything else without massive risk with zero upside. At worst, you'd end up sending the message that you're willing to negotiate your culpability.
Jul
18
comment Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?
Sounds to me like he read it as "We can do what we like to your system, and claim 'accident' when we screw up", rather than "We don't want to be sued because of an unforeseeable situation". But yeah, AVOID.
Mar
6
comment At what point does something count as 'security through obscurity'?
+1: This is basically the more informed, intelligent, reasoned version of my snarky super-secret-crypto-port comment.
Mar
14
comment XKCD #936: Short complex password, or long dictionary passphrase?
@ElazarLeibovich "A lot of people will choose horse, and much less will choose trumpet. Which can also reduce the entropy a great deal."
Mar
14
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
@Dave The question was "Why should I trust them", not "Why should I trust this specific thing about them" If another site offered the same privacy policy or said that your data would be encrypted over the wire, the same concerns would be valid. Even Google's policy promises certain things, and the same question applies to them.
Mar
14
comment XKCD #936: Short complex password, or long dictionary passphrase?
@ElazarLeibovich I love the idea of some adorable ragamuffin going to colossal lengths to develop a heuristic data model to predict the entropy of certain password choices, in order to post "D00d so gaey" on my Twitter Feed. Surely he should just get back to his PHD Thesis.
Mar
14
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
@Yegg Based on one of the comments below, could you edit your answer to confirm how someone could verify that you're based in the US, and thus subject to privacy policy laws?
Mar
14
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
@HughAllen Also, even if it was registered internationally, these laws are generally applied globally. And in most places you'd be able to get around them, your site's reliability would be severly compromised.
Mar
14
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
@HughAllen There are perfectly legitimate reasons to guard against another site revealing your information, and just because WhoIs shows as US isn't proof that the business is registered there. Paranoia will destroy ya, but the right place to look would be a registry of incorporated businesses.
Mar
14
comment Why would someone trust DuckDuckGo or other providers with a similar privacy policy?
I've suggested an edit to this. Why single out DuckDuck? The same question applies to Google (especially to Google), Bing, Yahoo and all the others.
Feb
14
comment Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
+1 for being an actual answer
Feb
14
comment Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
The problem with all of the provided answers below is that they seem to explain why you can't get the answer back, but then raise the issue "given this, you'd be more likely to gain access than if it stored the password in plain-text, because you no longer need an exact match." The only way this is covered is when people say "Oh, but it's really unlikely". It's still more likely than if you have to get an exact match!