This room was placed in timeout for 10 seconds; the topic of this room is "The first breach costs you an arm...." - conversation should be limited to that topic.
@AviD: Worth a sale purchase, especially with the season pass. It kinda ignores huge chunks of LOTR canon, but its probably a better AC style game than AC according to many reviewers. And the nemesis system somehow turns a randomly generated mook into someone you bother hunting down and killing (and Boy was I pissed when my nemesis at the time got himself killed by suicide by big stompy beast)
This room was placed in timeout for 30 seconds; the topic of this room is "The first breach costs you an arm...." - conversation should be limited to that topic.
I'm sorry but anybody clicking on any link in a channel dedicated to internet security, full of intelligent people who should know better, deserves what they get
@Kisunminttu heh, I'm leaving them till the nights seeing as how I'm working at the mo :) they've been good so far... the american whiskey was odd but is interesting to try the different ones
@kalina do you know anything about SQL Injections, since this room is about internet protection, I was hoping someone could give me some tips about protecting a login-page from SQL injections and other malevolent attacks
@AviD @Stefan just flagged @Gerwin for telling him to shuttup, since he was being stupid, (a) the flag passed so @Gerwin got banned, and (b) I think @Stefan should perhaps get spanked
@Noordung I know what you mean, @Adnan and I had a surprise visit from guys installing balcony windows a few months back, I felt so awkward. Had a nice chat with them at the breakfast table, though
@Noordung It's just the way my landlord likes to do things, he sticks a note at the door of our apt building: "blah blah blah will be done during weeks x-y" and that's it. When exactly is a mystery
@AviD is there any chance you could give me some advice in the protection against SQL Injections? at the moment I filter the special characters out, and turn them into html code such as: & for &... and then I filter that result again to make sure no special characters got through, I think this is an appropriate question to ask here because this chat is for internet protection?
stop being so condescending and actually try helping if you have the knowledge to help, rather than pointing and going "HA! that car has square wheels!"
@AviD actually, according to the information theory, without tag description and tag wiki giving it some context,... it's an oxymoron tag (that's a first, no?)
@AviD true. That's why I was asking about the expected entropy of passwords, it informs how much rope to give our users/attackers in this particular scenario
@Tinned_Tuna this is an easy issue, what you do is you make it so that support calls are charged directly out of an employee's wage, then you make it so passwords must be 30+ characters in length and after 3 incorrect attempts, the account is locked out for 30 minutes. Additionally, make it so those 30 minutes are logged and also deducted from wages
@Tinned_Tuna but yes, given a specific amount of entropy per password, you can calculate the mean time to break, and figure out what safety measure you want - but its more about "at what point do we get involved".
but, that circles back to my original question -- don't you need a decent estimate of the entropy of the passwords to tune it? Or is it just a case of trial and error?
e.g. if you know there are mostly proper passwords, or if the system value is very low, you never need to worry about escalation. (well unless you want to be proactive about what basically amounts to traffic floods.)
if you know the passwords are very weak, and high system value, then you might prefer to even allow the account lockouts. Better DoS than account compromise?
in your case, passwords are likely to be moderately weak (is this an assumption? a guess? what are we basing this on?), so you dont want either of those extremes.
and thats exactly where the tuning comes in - a tradeoff between UX, risk, value, and cost of manual intervention.
@AviD hence my asking, if anyone had any decent ball-park figures which generally apply. I expect the users of this system will be largely average in their password hygiene, but that's another assumption on my part.
