@DavidFreitag Aw man, I'd drop the part where the girl sings.

The "huh ah" etc. are fine during the climax though.

@Simon That entire album is one giant goosebump.

All of the eargasm.

Yeah I'll try to remember to listen to the whole thing when I'm at work on Monday.

Wow. Are these guys serious?

passwordrbl.com

It seems like the sort of thing you'd see as a joke at blackhat

@tylerl that's astonishingly crap!

It must be a joke

@tylerl The basic idea doesn't sound that dumb.

Of course sending a salted sha2 hashed password to a third party is dumb.

The simplest secure way would be simply downloading the whole blacklist, but of course that'd give it away.

But you could also download an encrypted blacklist and then use a bit of fancy crypto.

That way the client wouldn't learn the contents of the blacklist and the server wouldn't learn the password of the user who logs in.

@tylerl Wow they didn't even get what a salt is:

> The salts utilized are the same amongst all PasswordRBL customers.

@CodesInChaos - it's the sending your passwords to the third party but that is worst. And yeah - the salt bit :-)

@CodesInChaos You say "they" but as far as I can tell, it's one dude, with no security experience to speak of. He's a network engineer by day, and this is his side business.

LOL: climatedepot.com/2009/10/06/…

and then China and India are like "don't worry guys, we got this"