129 reputation
6
bio website
location
age
visits member for 2 years, 10 months
seen Aug 24 at 23:57

Aug
20
awarded  Editor
Aug
20
revised Should I use own constants when using well known hashing algorithms?
deleted 5 characters in body
Aug
20
awarded  Teacher
Aug
20
answered Should I use own constants when using well known hashing algorithms?
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
lol that was actually completely unintentional, but I'll happily take credit for it :P
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
+1, but mind you, "who's motivated enough" is a bit misleading because there isn't exactly a lot of motivation required for this. They've already spent the time required to scrape or otherwise acquire the emails, so the extra minute required to add a regex to the mix is peanuts.
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
I remember reading (edit: here's one of the many pages that explains this) that the spelling and grammar mistakes are intentional -- they want to make sure people who respond are unlikely to be the types of people who pay careful attention to thinks (and they want others to discard the emails). Pretty sure it's not a sign of laziness.
Aug
16
awarded  Commentator
Aug
16
comment Is using 'dot' and 'at' in email addresses in public text still useful?
I didn't get any true spam at my personal addresses until just a few months ago. Probably some person or company leaked my emails then. It's certainly not true that every legitimate address gets spam.
Aug
16
comment Is using 'dot' and 'at' in email addresses in public text still useful?
@Adnan: Instead of searching for @ can't they just search for gmail or other common domains? That's going to find anything even remotely like firstname [dot] lastname [i think i'm so clever] gmail [ooh yeah] com...
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
@SilverlightFox: That's unfortunate... though I guess I can't say I'm surprised. Good to know though, thanks.
Aug
16
comment Is it better to have a camera hidden or visible?
I don't get it, why would you expect any criminal to take off the face mask after he's disabled the visible camera? Not sure what good the hidden camera would do here.
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
@SilverlightFox: That's good to know -- it's exactly what I've been trying to figure out, because I'm almost certain that the spam I've recently started receiving in my personal emails must have been leaked by some company somehow (and I have a guess what company this might be, but I have no proof). Kind of a tangent, but did you try to follow up with them and ask them how your email was disclosed by any chance? I'd be interested in knowing how they respond to these kinds of incidents.
Aug
16
comment Using + for email addresses to find out who is selling your data: is it naive or is it effective?
I wish I had the time/energy to host my own domain. But anyway -- are spammers really that lazy? Spammers go through a whole ton of trouble to get people to read their emails (spoofing addresses, playing with the font sizes and colors, mixing punctuation in between letters to prevent filtering, etc.)... I can't see how taking an extra minute to automate the regex substitution would be an obstacle of any sort. The level of trouble necessary is basically zero... and not sure what the contactability risk is either, at least for well-known domains like Gmail.
Aug
16
awarded  Student
Aug
16
asked Using + for email addresses to find out who is selling your data: is it naive or is it effective?
Aug
16
comment What are the security reasons for disallowing the plus sign in email addresses?
The way I read their response is "we would like to be able to sell your email address with others without you being able to tell we've done this".
Aug
7
comment Is it safe to send clear usernames/passwords on a https connection to authenticate users?
Maybe consider hashing the password instead of (or in addition to) encrypting it.
Jun
6
comment Can users make use of a password manager when banks tell them never to write passwords down?
What clause have you seen that prohibits the user from writing down the bank password? Does it also preclude the bank's website itself? If not, then we need to see the clause to interpret it.
Mar
31
comment What technical reasons are there to have low maximum password lengths?
@s4uadmin: Never heard of a dictionary attack, huh?