@Ohnana I hope that you see that the whole nomination is a joke.
I have, repeatedly, said that I'm not interested in being a mod.
I will cause a lot more issues than the ones I'll be fixing.
I'll close questions just because they don't feel right to me. I'll suspend users for saying something that can be seen as not nice, all while not being nice myself
Anyway. I still have the same opinion I've expressed several times here. I don't have an interest in being a mod, and I think I will have a negative effect on the community if I become one.
And was thinking, that wouldn't that serve are a good way to identify a hacker?
The question talks about implementing a delay between sending the response for an incorrect password request
So if we receive multiple parallel bad requests, we can be sure that it's someone not playing by the rules, not waiting for the pre-defined interval between login attempts, and thus mark them as malicious
And the alternative for them would be to wait between login attempts, which would slow down their brute-forcing.
@PeeyushKushwaha This is a pretty common technique for identifying attackers. Check out products like fail2ban for examples. It's not perfect, and the false-positive rate is abnormally high. At work I frequently mistype my password 5 times in rapid succession just because it's so damn difficult to type correctly with all the case changes special characters.
But if you set your threshold high enough (say 15 attempts in 2 minutes) then you'll get a better result.
the problem with multiple parallel requests is that some accounts are more commonly attacked than others. You can expect "admin" to get password attempts coming frequently by dozens of independent attackers.
So if the legitimate user mistypes his password once, the chance is high that he'll be flagged as an attacker.
because REAL attackers will have typed in bad passwords at the same time
@tylerl, even if you as a proper user mistype your password a lot, but if you wait between login attempts as the page takes time to load for you, then that shouldn't mark you as an attacker. What should mark you is if you're sending multiple requests, which can be a marker that you're not using the application UI which will definitely wait for response of the previous login attempt, whereas an attacker won't wait...
Hmm. Even if you restrict it to one user per IP, then one attacker could potentially try to hit multiple users instead of one. E.g. try to login from different accounts using the password "password"
Yeah so it seems like an effective system to me. This in addition to captcha if an ip attempts to access more than n number of accounts, and that too, with significant failure rate
Typically with Google, if your IP gets marked as "bad", then users will get a captcha. If they solve the captcha, they get a cookie which means they won't have to solve the captcha again.
I've heard from PLENTY of companies who have complained that nobody at their office can use [insert product] because they get some "you are running a bot" message. The only real advice I can give is "well, find the bot then."
@tylerl amusingly when my missus' ex-company moved their European base to Dublin they thought it was in the UK (d'oh) and were surprised when UK staff were reluctant to move country to be there...
@RoryAlsop On freenode, they got this thing where they consider it's morning when the user connects or become active, and it's evening when he leaves :)
If we download a file from the Internet, but not at all open that file (if we keep autorun off), are there any chances of virus spreading from that file?
The other one is looking at the well known risks from going to the website - a drive-by attack, whereas this one assumes the file is on disk. I think that's a separate scenario.
Meme: Canonical Time Zone
Originator: Unknown
Cultural Height: Early 2011
Background: American hubris on the part of our East cost users resulted in blanket declarations that EDT/EST (UTC-4/5) would be considered the de facto timezone of The DMZ. This was brought upon by inconsistent time of d...
> A MASTER KEY SHOULD NEVER BE EXPORTED UNLESS IT IS PROTECTED BY A STRONG PASSWORD
No sh** Sherlock
> The computation to export an identity master key is designed to deliberately require 60 full seconds of intense processing of “memory-hard” functions by the device performing the export.
If we download a file from the Internet, but not at all open that file (if we keep autorun off), are there any chances of virus spreading from that file?
@M'vy yep - I saw that. I think one more and I'll reopen. I do think it isn't really a dupe, but generally like the community view, rather than using my mod-powazz
> The hope is that someone who is merely playing around (for example an innocent child) will cease guessing not wishing to cause the phone's owner undue trouble.
it's a graduated site, mod work is (or should be) pretty much business as usual here, lots of things already have established procedure and you just follow it... not the case on betas tho
if I wasn't a mod on a beta I might even nominate here
but that takes too much of my time so I couldn't guarantee to be a good mod here
every mod I talked with about this says it's a lot easier to be a mod on a graduated site ... I'll take their word for it because I know that it isn't easy being a pro tem mod on beta.
Definition is just one part of it, there's also community building and teaching newcomers the ropes. You get a lot more support on a graduated site from an already established community. On betas, you're looking at more questions each time you answer one. It's more like having a kid vs having a pet kind of a thing.
@raz it fills a typed array (Uint32Array) with random values of that type, by reference, and also returns it (because logic)
it's an array of random uint32s of length length
You can technically use any typed array, but I just used uint32 because it makes using it modulo charLength easier since you don't have to account for negative values
In the OPs code they have randomIndex = Math.floor(Math.random() * password.length); I'm not sure how that stays within the bounds of password's length for an index... but ok.
It's also early in the morning, and I haven't had coffee yet
Meme: Canonical Time Zone
Originator: Unknown
Cultural Height: Early 2011
Background: American hubris on the part of our East cost users resulted in blanket declarations that EDT/EST (UTC-4/5) would be considered the de facto timezone of The DMZ. This was brought upon by inconsistent time of d...
