« first day (3637 days earlier)      last day (52 days later) » 

10:15 AM
@MechMK1 Awesome! If only it wasn't such a silly idea in the first place :)
On the list of ridiculous ideas, would someone like to help this person find an alternate to TLS, since, you know, "management"?
0
Q: Is there any solution beside TLS?

MahzadOur development team is implementing TLS protocol for a web server. The type of clients are mobile apps and web browsers. Now there is a concern about bypassing TLS in any way trough MITM attacks and disclosure of the server's private key. Is there any solution independent of TLS for data-in-tran...

 
10:48 AM
I am already writing an answer
0
A: Is there any solution beside TLS?

MechMK1Rejecting TLS out of fear an attacker could have stolen a private key is like rejecting medicine out of fear someone could have poisoned it. The downsides far outweigh the risk of not using it. Why TLS is secure There are many many angles to answering this, but one that speaks for itself is that...

You might think "Everyone is using it, therefore it's secure" is a bad argument, and I would generally agree, but since it's management, "everyone is doing it, so you should do it too" works
 
 
1 hour later…
12:06 PM
I don't get this TLS dude
Everyone is telling him "Just use TLS, it works fine" and he just refuses
I'm this close to asking "Can you please tell me what company you're working for so I can make sure never to buy any of their products?"
We need a "Closed because OP is paranoid" reason
0
Q: How to know if your webcam was hacked a few days ago?

AnonymousHow do you find out if your built in webcam was hacked a few days ago? I have paranoia that someone might have hacked my webcam. I have an HP Elitebook. Is it really too easy to disable HP Webcam's LED? I checked my computer and did not find any storage video or image files. Also my firewall and ...

 
 
1 hour later…
1:24 PM
@MechMK1 the Russian roulette with 5 loaded chambers comment killed it...
 
@ThoriumBR That's basically what you do when you roll your own crypto.
 
when you implement your own crypto, usually you have 6 full loaded guns, one with 5 loaded chambers, and play with that...
 
I like to call it "Playing Russian Roulette with a Glock"
 
or a grenade...
 
Or go to an arab wedding
 
You wantz Dakka? You gottz to use more Dakka! 'ere's nevar enuff Dakka!
64
A: Are broiler chickens injected with hormones in their left legs?

OddthinkingThis claim raises so many questions! It is one of funnier claims on the site. First, does Bulgaria imports chickens? After all, if they grew all their own, this claim wouldn't be true. Poultry World says yes. Bulgaria’s poultry imports are dominated by broiler meat, while export revenues come ma...

This answer, holy shit
 
That whole thing is awesome :)
 
>tfw only left legs left
Can I say a random thing that has been bothering me for a while now?
 
2:02 PM
I expect nothing less! :)
 
Only if they pass a randomness test.
 
Okay, so has anyone ever thought about the security implications of UX?
I had those thoughts a while ago, when I upgraded to Android 11, and suddenly VLC wasn't working well anymore (the media controls were gone on the lockscreen)
 
@MechMK1 Of course.
That's the AviD's rule on security.SE
 
But is this something that is actively considered?
Like, I mean by UX people, not by security people.
 
Oh... hmmm... ask away on ux.SE?
 
2:11 PM
That if the "new thing" doesn't do stuff the same way "old thing" does it, people will refuse to upgrade
I will ask about that
I mean, look at the Windows XP era
 
Yes, I know AviD's law, but that to me is a bit like preaching to the choir - okay, maybe not fully, but it's security folks telling other security folks that their security solution should be usable
I'm more interested if UX folks think about security implications of their UX design
And aside from people refusing to upgrade, there is also UX around security
For example, e-mail clients showing that something form a trusted sender even though it's not
Or my favourite thing: 🍥
 
I don't get your reference to naruto.
 
terminology is a good example... the padlock says the site is secure, so the site claiming to be Bank Inc are trusted
or all those "McAfee secure site seals" around, that don't make any sense... it's just an image, I can make a site and put that picture on it
 
Or e-mails ending with something like "verified without virus by Avast®".
 
2:25 PM
@A.Hersean First of all, that's a fishcake
 
yeah, that ones too! I receive obvious phishing emails with that
 
Secondly, twitter uses a similar looking symbol after a user's name to show they're "verified", e.g. "the real whoever they claim to be"
So some users have begun using the fishcake emoji after their name
 
2:45 PM
Oh, OK.
 
3:08 PM
@MechMK1 I shamelessly posted your question on ux.SE: ux.stackexchange.com/q/135782/140765
 
@A.Hersean Nice!
 
3:47 PM
"Too broad"... Any suggestion to reduce it's scope?
 
 
2 hours later…
6:15 PM
One of the thinkers in the webdev world wrote about browser UI, particularly how certain message boxes need to appear at least partially off the page in order to avoid malicious web pages spoofing those messages.
I can't remember who that was or when I read that. Might have been Jeremy Keith (adactio), might have been quirksmode
Similar to the Twitter verified spoofing, using Unicode URLs to spoof valid domains has been discussed
On Stack Exchange, you cannot add a diamond to your username, because that's how moderators are identified
It would be great to have Security people vet designs, but it's probably not done much
When I was a webdev, it was as much as I could do to get the designer to think about UX and usability and accessibility
Users avoiding upgrades... Reminds me of all the techy users who decided to stick with Windows 7 because that used to be the smart thing to do (because Microsoft Is Evil and Windows 8 was bad and Windows 7 was still good enough)
I'm happy when users can fix simple problems themselves, but when I start finding out that they keep Windows Update disabled and are proud of it...
 

« first day (3637 days earlier)      last day (52 days later) »