@allquixotic Just cancelled Play Music subscription, may or may not get Spotify Premium soon :P
(Spotify just added two more albums - as I was listening! one turned up after reloading the page - to an artist while Play Music is still missing one from last year)
@WilliamLawnStewart Yes and no. It copied it, but when I tried to boot, the Windows partition would be assigned the D: drive letter, so I wasn't able to log in
At least that's what I think was the cause for it
Worked great on my desktop though, but that was just HDD to SSD. The other machine was a completely different hardware to migrate to
The most annoying part about it was, I booted the machine and I could log in with my domain account. But it would be a temporary profile. So I tried logging into the clients account and Windows told me no logon servers were available. Okay, sure, because I wasn't in the clients domain
So I drive over there, thinking, hey, I just need to connect it to the LAN and everything is great
But then I realized, shit, this Windows install doesn't even have the driver for the NIC of the new hardware :P
And then I realized the whole installation is fucked because of the drive letter thing
So I changed the password and logged in. That's when I realized the drive letter thing
Well, we just installed a fresh copy of Windows at that point because it wasn't clear how long it would take me to fix this and how well the system would work afterwards
Then I wanted to at least upgrade to Windows 8, but it cost 300 € from MS, so that was out of the question. Okay, then at least install a trial of Office 2013 until we get the key. Oh, there is no trial for Home and Business? Well...
Great, I just fixed a bug in our application. The line of code that caused it had the following comment above it:
//HACK: I don't understand why subtracting half a cell width is required or where this magical offset comes from,
// but it definitely solves any issues in regards to positioning the markers.
Turns out it doesn't solve shit, it breaks everything
Yesterday, I was working on some demo data generator on our backend, and it would simply not work and get hung up after a couple of records. I traced it down to a method in chancejs, a random data generator. It was an infinite loop, which had the following comment above it:
@Bob It's seriously insane. I was trying for several minutes to figure out why it wouldn't accept CONCAT(). Turns out it has to be VERKETTEN() wat O__o
@Bob like that website that was broken (I think this was on TDWTF) because a translation program translated everything, even the source code, and JavaScript didn't know about the pour keyword? (in French, pour = for)
Hey. I have an interesting problem. I just reset my password on reddit and logged out. Now I can't remember what the password was. Can I do something with the cookies?
if hitting "back" a bunch of times didn't work, then either your client-side session cookie was deleted, or the server-side session was invalidated, or both -- in either case, there's no way you're going to be able to recover that data
there's a 0.00001% chance that a reddit logout is client-side only, and that you could dredge up the cookie by poking around in the heap of your browser's address space, but finding the cookie would be difficult, error-prone, and unlikely to find it 100% intact (most likely it's been clobbered partially or entirely by now)
and if it's server-side, no amount of client-side poking is going to help anyway
@jokerdino why do you need to use "throwaway" email accounts? I'll never understand why people do that. I have more space than I'll ever need in my gmail; people are more than welcome to send my real email copious amounts of spam. Gmail's spam filter is so good that the only spam I still get is from Amazon, despite creating like 9 million filters trying to get rid of it
@allquixotic There were similar questions originating from similar accounts, all as spam bait, like Oliver said. It's not really apparent for "normal" users, but there's a pattern.
Generally, if you see really basic questions involving recovery of corrupted things, be cautious.
That's good at least. Lastpass integrates with your browser and replaces the FF manager. It will also migrate the user/pass combos from it into lastpass. And you can use it anywhere.
keepass, I think, will allow you to store your own database if you're not happy about the cloud. It's also open source if you're not happy about the corporate aspect
For that matter, how do you login to your gmail if you use google authenticator and get a new phone. You can't get into the play store to download it.. IT'S CIRCULAR!
@allquixotic No, they'll wait a couple of days and come back with different accounts promoting their own product. Then they'll accept the answer and generate reputation, etc.
Once I almost completely locked myself out because I turned off my phone on a flight and didn't remember the PIN. And I didn't remember my girlfriend's phone number -- or any number, for that matter. And without phone, no Gmail. Without Gmail, no contact outside. Without Gmail, no LastPass.
@jokerdino LastPass is really secure... security is a core part of their business model... especially if you lock down your account with a YubiKey
my whole digital life is tied to my YubiKey now, pretty much. bad if I get robbed because someone else can use the yubikey, but that's a physical layer problem -- I'm pretty heavily protected from digital attacks
@Raystafarian the default behavior of the yubikey doesn't have a time-based password, it's just a static (long!) password that gets "typed" into the device by a USB keyboard. but the yubikey is programmable, and you can enable OTP using the YubiCloud
actually the yubikey is quite advanced in terms of what you can do to its programming. it doesn't have a battery, but it has a small security chip inside of it that gets powered either by the energy of an NFC field (e.g. from a phone), or from the USB port. you can flash custom functionality onto it
I have both the OTP and LastPass on it, and they both work either via USB or NFC
I have my Google and Microsoft accounts' 2-factor auth tied to the OTP of the YubiKey
although the YubiKey doesn't have a timing chip included inside it (that would require a battery to keep track of time), so it can't by itself generate time based keys like the RSA devices, so, what they do instead is use the YubiKey password as the basis for a one-time password that's generated by your client device (e.g. Yubi authenticator app on Android, or Windows)
I have Google and Microsoft account backup one-time passwords stashed away at home, so even if I lose my YubiKey, I'll be able to recover
@Bob the way I see it, if I've got a key logger on my client (either android or windows), I've got much bigger problems than my yubikey key getting leaked
almost irrespective of what your security model is, if you're operating under the assumption that you can't prevent people from installing keyloggers onto your systems, you are basically unable to prevent people from gaining access to all kinds of your stuff
@OliverSalzburg @Bob I remember back in Office 95 and 2003, the English copies would select all with <kbd>CTRL + A</kbd> ("All"), and local copies would use <kbd>CTRL + T</kbd> ("Tudo")
What I don't get in this office is why they put Mac keyboards on docking stations for Fujitsu laptops. I constantly keep hitting Ctrl-W to delete the last word, and I end up closing all windows.
@Bob wrong. someone could steal my LastPass or Google password (e.g. Heartbleed), and they would also then have to successfully sniff a YubiKey OTP transmitted to the YubiCloud during the short period when it's valid, then use that OTP to somehow commandeer my YubiKey (note: the YubiKey's own key is never transmitted over the internet, ever)
The most important part of the yubikey security model is that the long password of the yubikey itself is never actually transmitted over the internet. Yes, it is transmitted to client devices, but these days any client device compromise by a malicious actor is a huge problem no matter what. It's designed to mitigate network-based attacks which don't have local client access.
@Bob It's just defense in depth. Since the device doesn't store the key, it increases the number of things a thief would have to grab -- and then know how to use -- to gain access. I have LastPass automatically lock itself out on my phone as soon as the phone goes to sleep, and the power button instantly locks the device. Plus FDE and remote wipe via McAfee. Thief grabs phone -> IDGAF.
There's a difference between a thief and a robber. A thief (or pickpocket) takes your phone while you're not looking, if you negligently leave it in an opportune place. Robber takes all your physical possessions (likely including your keys). Both types exist.
@slhck I'd tell them they're violating their own security policy -- which they signed when they hired on, and then made me sign when I hired on -- by asking me that question, and escort them to the nearest C-level executive to explain the problem.
@allquixotic Unless the device itself can generate a varying key (time-based, or you enter a code), it's nothing more than dumb storage. With a brand and some polish.
@slhck That would depend on the security policy of my workplace.
Ultimately, they have phisycal access to my work machine, so nothing unencrypted is truly hidden from my employers. And they have admin access to all the servers, so they can, theoritucally, access all info on any accounts on servers here
"Dear Desktop Support, you have Active Directory and perform password reset requests, is it really that inconvenient to do this for help desk tickets?"
@Bob actually, it looks like it does use a clock... interesting -- TIL
> The YubiKey has no battery but features a built in clock that uses the power from the USB-port. This clock can be used to measure the time between two OTPs, verifying user presence and that pre-recorded OTPs cannot be used.
I should open Notepad on my desktop tonight and have the YubiKey type in passwords several times and see if it's the same one every time... if it's different every time, or different every 30 sec or so, that's good... if not, hmm
so far I've only ever had it enter its password into password fields with "*" masking characters :P
it looks like, each time you generate a password by authenticating using the YubiKey, it writes a counter or something to the internal NAND (or whatever type of storage it uses; I presume it's a tiny amount of flash memory because the device is programmable)
that seems to be what they mean by "clock"
> When a YubiKey is validated, the Session and OTP Counter values are compared to last values submitted. If the counters are less then the previously used values the OTP is rejected. Copying an OTP will not allow another user to spoof a YubiKey – the counter value will allow the validation server to know which OTPs have already been used.
@Bob better than nothing -- the last 32 characters of the key transmitted by the device (that is, "typed in" by the USB keyboard) are effectively random from an attacker's perspective, unless they're able to physically break into the YubiKey device and extract its NAND, which they claim is very difficult to do without breaking the YubiKey totally
because the counter is used as a sort of salt for the encrypted OTP
so, somebody has a keylogger and captures the OTP -- they may be able to use that plus my password to authenticate once into one of my services, whatever service that happens to be, but it doesn't let them access any of the others (unless it's LastPass they captured -_-)
but if they keylog my Google account, for instance, they won't be able to get into my Microsoft account, or LastPass
for what it's worth, most systems I run tend to have between 20,000 and 100,000 open handles, depending on how much work I'm doing.... 70 million seems like a ridiculously high amount
@ThatBrazilianGuy if you came to the US, I would collude with retail store employees or hotel clerks to give you a fake, ridiculously high price to see the look on your face :D
@Braiam If you consider the dollar is more expensive than the real, and a dollar costs more in workhours here than in the US, then yeah, we're really being ripped off.
@allquixotic I've seen the opposite. Usually with a comment like "Oh! So cheap!" by the gringos.
But I own my own house, I have a job on a public institution (there's a whole industry for "concurseiros", people who apply constantly for exams just for the chance of a job like this, -- hey, they can't fire you!), I'm literate, I read books constantly, I speak English, I even speak proper Portuguese, I entered a university...
But Quora has some extremely relevant topics, such as:
> What are some of the most mind-blowing facts that sound like "BS" but are actually true?
> What are some witty and amusing things you have heard on an airplane?
> My girlfriend left me for another guy when she found out that I'm poor. Now I have won a big lottery (no joke) and she wants to come back. What should I do?
> What is something useful I can learn right now in 10 minutes that would be useful for the rest of my life?
@HackToHell There, there. Easy, now. The hardest part is admitting it, and you've done a great job. Now there's just 11 steps left. A great cheer for @HackToHell. Thanks, @HackToHell!
