5 hours later…
I don't know how much of them can wear the NLP label or not, but in all case the skills you are referring to can be used either for good or bad purpose. It is always the ambiguity of what is usually called "manipulation" techniques. Under one form or another it is always a significant part of the activity of people having to interact with other people.
It can be a salesman (or some politic, if that makes any different) trying to sell their product, it can be a manager trying to raise the confidence of an employee.
It is often a question of saying the right words. I remember this classical example: as a manager, do not tell that a task you would-like a employee to do is easy, this is belittling, instead explain why this employee has all the capacity required to fulfill it.
The idea remains the same in both situation. In the second one however, both people have made a step forward which is a good thing.
Some people are better at it than other. Being on an IT Security website, I guess there might be some experienced social engineers around there that may know a lot about such things ;) !
@Aria Regarding Tor: people always hope to find the ultimate universal panacea. They hope that a firewall will bring total security to he whole network, that Tor will bring total anonymity. Even in the medical domain, new discoveries were always aimed at being the so awaited general solution.
The truth is that the world is complex, and there is no single solution to solve all problems, only a mix of partial solutions can help to advance toward a coherent and sane posture.
This is precisely such kind of wrong hope that some politician try to abuse by presenting the world using simplistic schemes with simplistic solutions.
There is on one side some boring politician telling gibberish about world economy and politics, how it is complex and hard to handle, etc. On the other hand you have some politician presenting such simplistic schemes and solutions.
Some people have the tendency to go toward the discourse they understand, no matter if it is right or not, at least they understand it.
Parkinson's law of triviality is C. Northcote Parkinson's 1957 argument that members of an organisation give disproportionate weight to trivial issues. He provides the example of a fictional committee whose job was to approve the plans for a nuclear power plant spending the majority of its time on discussions about relatively minor but easy-to-grasp issues, such as what materials to use for the staff bike-shed, while neglecting the proposed design of the plant itself, which is far more important but also a far more difficult and complex task.
The law has been applied to software development and...
3 hours later…
1 hour later…
13:11
2 hours later…
15:23
It was nice to have a goddess participating on SE ;). Well, I assume that a helping hand is good too!
One thing is that usually people do not like to learn new things. The evolution made us fear new and unknown things, consider them as potential danger, and prefer well-known conditions instead.
A constant learning and challenging means a constant confrontation with the unknown and accepting our own weaknesses and errors in order to progress.
Too much people try to avoid that and prefer to stay in the background, in their own comfortable routine, and are not happy or feel lost when some change may threaten this routine.
Moreover, you say that people should not work "like organization" (I have this image of an ant hill coming into my mind).
I don't know how it is other countries, but far too often schools are a mere tool to learn conformism to the pupils.
And once grown up some liberal company will hire them for some well-defined job where they will be expected to not discuss anything or do anything outside of their attribution.
This is what I call "martial" management: the CEO decide what must be done, management receives orders from higher layers and ensure that lower layer correctly apply them, and bottom of the hierarchy executes the low-level work, no question asked.
While I can understand the efficiency gain in such setting and the fact that this gain is required for actual military structures (imagine an assault order is given and soldier begin to deliberate about the what and how), I do not feel this is a sane way to live his life (knowing that our professional work constitute a major part of our life).
16:06
Like for example family - if everyone is unhappy and sacrifices oneself for the good of family but does not care of being good himself, then it's wrong
Similarly with the organization, not making initiatives and working for the corporation who is passive-aggressive (there's something like passive-aggressive organization), that person becomes victimized by it, and there's failure on both the employee and organization
employee who did not have any initiative on it's own (which would put passive-agressive organization against him), and organization which did not wanted to invest in individual people but instead wasted them
17:09
I think a right middle has to be found: one should not annihilate himself for the sake of the group, but on the other side one cannot live only by and for himself.
Often, in such large group, investors and high management first goal is short profit. We do not talk about making the company sustainable in the long run, nor do we talk about producing high quality goods, we talk about quaterly reports and stock market price.
If the company falls, that's not a problem: both investors and higher management can easily switch onto another company. Either management gets fired with high compensations, or they sell the company: in any case they win.
Or, as you rightly said, if they enter in the "too big to fail" class, then they get money from the government.
Fortunately, there are more and more people who are conscious of this, both from management and technical sides, conscious that the initial goal of a company is not solely to make money, but to provide the best service possible to the community and only then, to be paid for this service.
1 hour later…
18:38
@uhfocuz if you want to discuss that client side hashing thing further, I'll be in chat for a little bit, but it's getting a bit long winded for comments and the format is making it hard to really address your thoughts fully
I wasn't able to fully clarify in comments, but you are correct that client side hashing would increase the amount of time required to bruteforce the original password without having to expend server resources, but at the same time, it does the site itself no good at all. The password the user enters is not the authentication credential for the website, the client side hash is. It would only protect the user in regards to someone hashing the original password if it was reused on other sites.
also, another limitation I realized is that if you are actually going to do it "right" you'd also have to separate the username and password screens as two different requests as you would need a per-user salt which you would have to ask the server for after getting the username. This would also mean you have to store every username ever tried and generate a salt for it to avoid giving away if a particular username is valid. You could cheat it a bit and use something predictable
like username+shared value as the salt I suppose, but that would have a weakness if anyone came up with an attack against a hash using related inputs
and all of that is still for something that would only impact security of other sites and only when the user is not taking their own security seriously
@AJHenderson I still am strongly opposed to your claim that this would provide very limited advantage, it would double bruteforcing times, never could the real password be easily divulged in the scenario our HTTPS protocols are already broken, and XSS, no, tampering, yes but this data originates to the registration, would be just as effective as really using tamper data — uhfocuz 59 mins ago
19:11
@AJHenderson Introducing a salt on both hash operations (client side have insecurities obviously) and server sided that can be stored in a database and uniquely generated and possibly some protection mechanism embedded. This would not be a big deal as there will be as few as 10 users total in a closed system intended to be over secured
« first day (2082 days earlier) ← previous day next day → last day (3096 days later) »