Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally something that would take a developer only a few minutes, as a screening tool to differentiate f...
@makerofthings7 h-uh. is it just cuz its outdated, or did big bear really not endorse bcrypt (or the like) in such a high-profile post?
@IsziRoryorIsznti hehe, just realized the password submittal site (leakedin.com) was built by two of my most favorite noxperts in their fields: Shifflet and Gibson.
AES is a standard encryption routine that can be used consistently across multiple languages, assuming all the variables match up. My question is, what are the variables. I am aware of the following
Variant (is this AES-256, or just plain AES-128)
Data to encrypt
Key (128 bits is common)
Initia...
saw him mentioned in one of the articles as the minds behind the password collector site.
@Ladadadada and, dont forget Chris Shifflet, probably responsible for more wrong-headedness published and reiterated around the world web, than anyone else.
I guess being the largest one, they attract the most Google traffic and people ask lots of off-topic questions there that should be migrated elsewhere and just general nonsense.
Heh. I was just reading the reviews on that PHP Security book. Love this one: "This is the first technical book that I have read that doesn't obscure the topic with trivial details or complicated sentence structures with phrasing that is hard to follow."
@thisjosh I'd say it depends on what value you assign the password used for your LinkedIn account.
Slightly different, there.
Put on the tinfoil hat, and presume the site is hostile. Here's some possibilities...
1. The host also has the list of account names/e-mail addresses. Given your password, (and presuming you haven't changed it on at least one site where it was used) they may now have access to any number of sites where you used the same password - and also have access to sites and accounts where anybody else used the same password - whether they'd already cracked it or not.
2. The host only has the password dump. Let's presume they hadn't cracked your password yet. Well, they have now. Thanks for helping them build their rainbow table & cracking dictionaries.
Oooh... Giving me second thoughts about playing Diablo... "For example, the popular game Diablo ignores case sensitivity, which severely limits the password’s strength." blog.avast.com/2012/06/07/…
@Ladadadada Now that is fun - If you use a dictionary list you can get a good idea of what passwords people use. It shows that there are individuals there using all the passwords from "password0" to "password9", for example
Even more amusingly, the comment "Your password was leaked, but it has not (yet) been cracked. Fingers crossed." came back from the password I had been using there
Reassuring :-)
@AndrewGrimm heh - absolutely. Security has a huge chunk all about hot topics
For QotW #30, scheduled for publishing to the Security Stack Exchange Blog on 15 June, please post as Answers, and vote for your favorite question from the whole Security Stackexchange site.
Please post any question that you feel is of worth and the reason why as an answer below. Try not to prom...
@IsziRoryorIsznti I upvoted your leakedin answer after the first sentence.
havent even finished reading it yet - tldr as per usual ;) - but I was annoyed at all the answers, and was getting ready to write one of my own (a rare occurance), till I saw yours. kudos.
@AviD The rest of the post is pretty much covering what I've said in chat earlier: Presuming LeakedIn is hosted (or compromised via MitM or other method) by an attacker, the least you're doing by submitting your password is helping to build cracking dictionaries and rainbow tables.
only point I would add is regarding the identities of the entities - they are well known, as has been pointed out, but not in a good way, as I've pointed out.
I'm looking for a GNU/Linux distro that I can install in transparent setup to look for infected hosts on a LAN. I don't need to stop viruses and malwares but only identify them and the host where they come from.
I don't necessarily need fancy graphics but I would like something pre-configured a...
AES is a standard encryption routine that can be used consistently across multiple languages, assuming all the variables match up. My question is, what are the variables. I am aware of the following
Variant (is this AES-256, or just plain AES-128)
Data to encrypt
Key (128 bits is common)
Initia...
I'm looking for a GNU/Linux distro that I can install in transparent setup to look for infected hosts on a LAN. I don't need to stop viruses and malwares but only identify them and the host where they come from.
I don't necessarily need fancy graphics but I would like something pre-configured a...
