Only one problem with that story: "It is designed to trick people into paying for supposed antimalware software that they don't need." Issue is that people do need antimalware software... just not this one.
Could someone shut this one down? It's probably one of (if not the) worst questions on the site, in terms of quality. It's already got two comments and one answer that all generally equate to "let me Google that for you".
I'm far from being an expert in the IT security and I have this maybe naive question. Many downloadable files are deployed on websites together with the corresponding hash numbers to ensure their integrity. If a bad guy hacks the website and replaces the original file with its modified version, t...
@GrahamLee - Regarding the "exact duplicate" above: I think it might be a better idea to try merging the two, instead of just closing the one and letting it die.
@Iszi I really wanted to write a comment on that one saying, here's the support doc link but it got a bit too long. Hey, I got some up votes for it but like you say, i was pretty much a google proxy. I feel slightly violated.
Excellent question! A few stats:
http://area51.stackexchange.com/proposals/8431/it-security
http://stackexchange.com/sites?expand=true
(bear in mind it's been 167 days, and we often let betas go on indefinitely if they are producing great content. Quality is, as they say, Job One.)
Also ref...
On a system I used several years ago users were forced to change passwords regularly and the new password was checked for similarity to previous passwords.
I can see that previous passwords could be easily checked for equality with the new password by comparing the hash to a list of expired hash...
In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, especially with knowledge of old passwords such as a departed employee might have for a shared service ...
@Iszi I think I need to clarify the question as I'm actually asking whether there is a secure way to do what was done on that system. I don't think there is.
I'm asking how it can be done without keeping old passwords in cleartext - which is essentially the same (only, using the negative form) as asking how to do it securely.
that question says "when you change from one password to another how do you do such and such enforcement" and the answer is "get them to enter the old password"
my question is "when you change password is it possible to check it's not derived from all previous passwords"
@StephenPaulger Perhaps it will help to specify what kind of system you were accessing that had this enforcement, and if indeed it was checking "all previous passwords".
With secure storage, the only password you can really get a good "similarity" check on is the current password - and only if you require entering the current password in the same dialog that submits the new one. Anything earlier than that (as mentioned in answers to my existing question) can only be checked for an exact match unless the passwords are in cleartext.
@StephenPaulger So, it is an exact duplicate, then.
Take a look at the non-accepted answers in my thread. Though I accepted @frankodwyer's answer, the others do a bit of a better job at spelling things out.
I think then, that some of the details I was alluding to were actually covered in other threads linked from that one. I'm sure I've seen it on here before.
@RoryAlsop So this means now is the time to take advantage of your rep before the limits go up!! Edit those tags and tag wikis and synonyms, edit really bad question titles, etc
@nealmcb LOL - I saw your meta post on this. I do try to get to the approve button as fast as possible, as do Graham and AviD - apologies if it takes a while
I wonder who all our diamond mods are, here? I know you, @AviD, and @GrahamLee for sure. Anyone else I'm just not thinking of? Are there any that have gone inactive?
@GrahamLee - Your Careers invite tweet didn't work.
Looks like the invite links are serialized or something.
@nealmcb I say merge when both questions have some good answers to them. When the duplicate doesn't have any answers, or the answers are of generally low quality, just close.
@nealmcb I learned, after doing it wrongly, that closing then merging avoids orphaned answers and moves the existing answers over to the master question. Closing as duplicate left me with a bit of cleanup work once
Kinda didn't want to post to Meta though because I'm just an odd pickle, and I'm not ready to do it just now either - I'm just curious if it can be done, and how difficult it would be.
@nealmcb when a question is merged, it's locked and all the answers are migrated but you can still see the original question text at the original question URL.
@GrahamLee True. However, at the same time, some questions can be "exact duplicates" but be asked in very different ways - one way perhaps being more clear than the other.
More or less, but there are some sysadmin on there
the invitation criteria are to convince someone with invites to give you one (ahem) or to score really highly on the SO site by rep and I believe by badge
Yeah, and I'm just a lurker around these parts. You'll see me flash across the screen regularly, I'm sure. I like the idea of the site, but I'm not very high on the knowledge end of things, just common sense.
@drachenstern I totally understand, and don't have a problem with that... I just don't know how I feel about people who aren't really vetted members of our community (or members of SEI) having diamond powers over our chat room.
@Iszi the question is what privileges are appropriate. Is it better that a ♦ from a different site can jump in and deal with problems here, or better that you have to be a security ♦ to ♦ security chat?
Bear in mind that both myself and @drachenstern are pro tem ♦s so no-one voted for either of us ;)
Besides, I seriously just treat my job as a mod like a janitor. Go around sweeping up the dirty bits, removing the graffiti, calling the maintenance department as needed, etc.
@drachenstern same here. Usually I only get involved in responding to mod flags, and only then when we don't have enough high-rep users for people to do things themselves.
@GrahamLee oh, I clean up spelling and grammar too, and I've deleted some flags and bombed some spam answers, but otherwise I think I've just pretty well abstained from close-voting and the like
I've even left comments "I could close, but I think it's a good Q, let's see if the owner edits" etc
Well, just looking at the few sites I know of off the top of my head that have gone through the full Beta process and all (Gaming, Cooking, English), it seems only 3 mods get elected. So, it looks like our team (presuming all pro-tems run) is full.
Would cross-site scripting be the tool of choice?
I wanna use WScript.Shell without having to change the internet zone option.
missing tags I can't add: vbscript, internet-explorer
@nealmcb Ah, that too. Does the merge process give you any opportunity to edit the final thread before the merge is done? Like, view both questions side-by-side, with the answers below, and re-compose the final question?
@RoryAlsop @GrahamLee @AviD - I'd feel a bit better if it came from a diamond, since you guys are familiar with the existing interface and process flow.
@ScottPack I don't think it's weird. I think it's exactly what a permalink should do. If I click on the permalink, I don't want to just re-open the question I'm already on - I want the link itself.
considering I managed to answer half of them in the last 4 hours
but brain dead now
oh - and was looking at our stats. Over 50% of all our traffic is from Google. Rory McCune's SDL post was number 5 on google search for SDL 2 hours after he posted it. Not half bad
https://addons.mozilla.org/en-US/firefox/addon/noscript/
Thank you!
Excellent question! A few stats:
http://area51.stackexchange.com/proposals/8431/it-security
http://stackexchange.com/sites?expand=true
(bear in mind it's been 167 days, and we often let betas go on indefinitely if they are producing great content. Quality is, as they say, Job One.)
Also ref...
Would cross-site scripting be the tool of choice?
I wanna use WScript.Shell without having to change the internet zone option.
missing tags I can't add: vbscript, internet-explorer
