@AJH not sure whether this is a question that would work on main, can I run it by you in here first? Basically I want to know whether 2FA is flawed in the case where the user logs into the website from the same mobile device that the soft token (eg Authy) is on - does that make sense?
^^^ also @ anyone else who cares to put me straight
@TerryChia @JackDouglas +1 yeah seems like a sensible q. my short answer would be yes did a blog post on a related topic the other day raesene.github.io/blog/2014/11/02/…
@JackDouglas if it isn't a dupe, it is definitely a question we should have, the short answer though is "yes, it's a potential problem in that it doesn't protect you from a compromised device, but it is still better than nothing"
@TerryChia it's actually a bit of a shameful story for the UK, they kicked out the natives of the British Indian Ocean Territories, to lease them to the americans for military purposes and now as there's no inhabitants the money for the domains goes to the UK gov.
wiicafe was a costly one, that was 4 different site names at various time, then I have about 4 personal related ones, another 5 family related ones and another 4 gaming community related ones
It also depends on the token's protections and the type of token. Amazon, Google and some other display the OTP on open. WiKID requires a token passphrase and a PIN prior to OTP delivery. — nowen21 mins ago
wtb comment downvote
why oh why do people assume that anything that looks like a security step must actually be better for them
Argh. Really trying not to feed the troll here, but he's a pretty damn good troll.
@Iszi, You're missing the fact that. There are few things in life for which there are 'objective criteria'. It's an argument people tend to pop up when they're ducking this issue. People with legitimate purposes should go to Information Security forums and be scrutinized by their peer group. Removing it from Stackoverflow.com will do far far more good than harm. We can normally over ever write policies based on net outcomes rather than absolute guarantees. This issue is in the real world. I accept that. That's no excuse for doing nothing. — Dan Allen1 hour ago
@Simon Go do it. I think I"m done with him. At least for now. I just don't have the energy, and am pretty sure any reasonable person can see that my arguments and the arguments of those before me are perfectly valid.
Really wondering why I'm even bothering with a user who only has 621 rep network-wide, about half of which was given to him for free (association bonus), and never even bothered to step into the IT Security site until this morning.
Here's an odd one: Can't download Cain & Abel on my system. Download appears to complete, but then the file disappears. Can't find it in AV logs, and even tried doing it with AV disabled. WTF?
I think it would be a better-suited issue for SU than here, but I don't need people like Dan ruining my day just because I ventured beyond my own little village. ;-)
I need to run VM's and stuff, so i need lotsa RAM, approx is 8GB for 3 VM's, but the laptop also has to be Future Ready, and have a bit of gaming capicity too (free time)
@Lighty Two things about that laptop, 1 the whole "Extra fast Hybrid Disc: 1 TB with 8 GB Flash Memory" is bullshit it has a 5400rpm seagate drive. That will need replacing immediately. 2, it doesn't have an AC-capable wireless card or gigabit ethernet.
@RoryAlsop I'm starting to wonder if I should probably bring that little essay over to an MSec.SE question or something. Seems it might be good as a "canonical answer" if the community (or at least moderators) concurs.
@Lighty I'm very happy with my HP ENVY, and have generally enjoyed products from their EliteBook and ProBook lines before. Haven't had a Pavillion though.
I talked it over with my dad because he funds 50% of it (because its used for study too), and he wants me to get the laptop at the local hardware store, theyre good friends of us, and because we bought alot of stuff there, including 12 PC's, I get lifetime warranty :P
@Iszi I would not only concur - I'd be enthusiastically supportive. It would make for a good canonical answer, but also has scope for a useful and interesting blog post!
@RoryAlsop Ah, thanks. Hadn't thought of that. Oh and "Part 4", for those interested, is going to be about why objective criteria are essential for moderation in our communities. Also covering why "hacking questions" is a category just as subjective and nearly as undefinable as "black hat questions".
@ThomasPornin I think that's the size of my laptop's display. And I do have a rather large "trunk"...
@Iszi Yeah - If you look at the 4 answers there, that is some good material. Your's covers some excellent space from the technical side; Kate's has a nice bit on liability, Travis has a contract element, and Gilles has the specific around SE's terms of service. Good material all round :-)
I think it's funny that Google thinks I have a life. Google music wants to start a radio, "It's friday night are you... Hosting a party? Hanging with friends?..."
@RoryAlsop I appreciate the support in that thread, but I think by now we need to stop assuming he's trying to selectively target malicious hackers and just accept that he wants to kill the hacking topic altogether.
Quote from a draft I have in progress (putting it down for now, will come back later): "Nearly every programming question in existence could potentially be about hacking."
(To be fair, that's not to say that every programming question in existence could just as easily not be about hacking - but there's an insurmountably massive gray area.)
I typed the following password in howsecureismypassword.net
yummy candy yummy
It said it would take 100 billion years for a pc to crack. Is this accurate? Even though it has English words (that are related moreover) it is more secure than a random string of length 14? If this is true everyone s...
I'm sure we have a duplicate for that, can someone find it?
It is NOT a duplicate of the xkcd question, because here the words are not chosen randomly
Actually, maybe we don't have a duplicate. Because there are really two questions: explain how entropy relates to character set and length, and explain that password checkers are crap
@Lighty Wow, is it just me or is HP's site really a bit too self-contradictory? "Cases ranging from 10 in. to 17.3 in." Umm... nope. Not seeing any 17.3" cases in that section. "Choose USB hubs from Targus, Belkin, and Sabrent: (View 1 Product)". "HP & Logitech keyboard/mouse combos" - no sign of Logitech there. "Ergonomic keyboards available" - nope.
yeah, I'm in the market for a cool bag, going to get my laptop get customized by the local hardware store
i have a 100,- giftcard for a huge electronics store over here (Mediamarkt.nl), so i can get a nice bag there and maybe something else, or just save whats left on the card
@Lighty Let me know if you come across anything good for 17.3".
I've found it generally a hard size to fit.
Strangely, a random backpack my wife has just barely fits it. So, I've been using that on the rare occasion I've actually taken this thing out. But it's a bit too feminine for me to keep as a long-term solution.
I typed the following password in howsecureismypassword.net
yummy candy yummy
It said it would take 100 billion years for a pc to crack. Is this accurate? Even though it has English words (that are related moreover) it is more secure than a random string of length 14? If this is true everyone s...
