The Nineteenth Byte

8:01 PM

IANAL but I think that will be a non-issue for the TIO accounts I'm planning to implement. The server will only store a hash of the username and/or email address provided by the user.

TheBitByte

@Dennis Unless you can heavily invest your time in security, then think twice about accounts.

ArtOfCode

Also depends where your server is, @Dennis. When I had QPixel running, it was on an EC2 instance in Northern Ireland, so I didn't have to worry about COPPA at all.

Dennis

New York, unfortunately.

@TheBitByte Twice? I've been thinking about this for months.

TheBitByte

@Dennis Well then, better be prepared to read a couple dozen Security.SE posts, Troy Hunt' blog (troyhunt.com, this guy is super famous), and have monthly checkups/audits, and, so no.

betseg

@Calvin'sHobbies well? :P

TimmyD

8:09 PM

@TheBitByte Why would Dennis need to go through all of that, if it's just a dumb account that only has a hash of the username?

It's not like he's processing credit card information.

quartata

I'm under the impression that it is just for handling permalinks

also Dennis knows his shit so I'm not too worried

Dennis

@TheBitByte I know my crypto, and the server won't store any PII in cleartext. It's basically a glorified cookie. I'm not sure what kind of audits that would require.

TheBitByte

@TimmyD This reminds me of the quote: ""Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say."

New Main Posts

0

Q: Puzzle - Determine which of the variable addresses belong to global/local/heap variable

I have the following Puzzle to solve and I'm not really sure how I could do that. It says: There's an Ubunutu Linux C program which outputs the adresses of variables. v1: 0xa156128 v2: 0xff97410c v3: 0xf750e34b v4: 0x804a0c0 I know that the program uses no shared memory and at least one of th...

c hexadecimal

quartata

So?

Dennis

8:13 PM

No clue how that's relevant to the discussion.

TuxCopter

unless s.include???

TimmyD

@TheBitByte I'm not following.

TuxCopter

^^ Beautiful piece of Ruby code

quartata

Ruby loves its punctuation

TheBitByte

@TimmyD reddit.com/r/IAmA/comments/36ru89/…

Anonymous

8:16 PM

@Dennis Fair enough. DELETE FROM tbl_users, followed by cleaning logs, seems to be the safest way.

TimmyD

@TheBitByte Yes, I understand the context and the sentiment behind it. I fail to understand how that's relevant here.

Dennis

My confusion remains. TIO != mass surveillance.

quartata

It also makes no sense. If I knew I would never have anything to say I wouldn't care about free speech

TheBitByte

@TimmyD The point is, saying "but that's small data, nobody would bother to hack that, right?" is what leads us to dozens of issues in the end.

TimmyD

But there's no data to hack

DrMcMoylex

8:18 PM

Haha! Just posted my first ever robbers answer!

TheBitByte

@quartata mic.com/articles/119602/…

quartata

@DrMcMoylex You're under arrest

3

Dennis

@TheBitByte Have you read at all what I have been writing? I won't be storing any data that could be hacked, even if the server is breached.

TheBitByte

@Dennis So, wait, you're not storing any data, how do I make an account? That's an awesome invention!

Dennis

You do know what a hash is, yes?

Not a novel idea.

TheBitByte

8:23 PM

You know what a side-channel attack is, right?

We're in 2016, and being paranoid about website security is okay.

DrMcMoylex

TuxCopter

-.-

DrMcMoylex

@TheBitByte You have no idea what your talking about. If the server was hacked, the only thing any attackers get is a string that looks something like "abjr2sk63-ahovrt793hw-znk5hk88r".

Dennis

@TheBitByte Paranoia is a disease, not a way of life.

TheBitByte

@DrMcMoylex I know very well what I'm talking about. I've seen too many MD5 and SHA1 websites. Too many to assume that even the best person in the world might make mistakes in web security. With the amount of services getting hacked nowadays, nothing is out of the question, almost nothing is impossible. "But but it's only a hash right?"

TimmyD

8:26 PM

But again, there's no data to hack

quartata

@TimmyD don't even bother.

TheBitByte

@TimmyD Lots of websites have implemented hashes incorrectly. It's not like a hash is a magic solution to everything. If you think I'm joking around, just see the number of data breaches this year alone, and you won't call me paranoid after that.

DrMcMoylex

This is stupid. I'm done

Dennis

If you're just going to continue with the premise that I have no idea what I'm doing, there's no point in further discussion. If your stance is that no website should have user accounts because web security is hard, well... also not sure what to respond to that. If you don't want to create a TIO account, don't. It won't be needed to use the service.

8

PPCG TF2 Server - Shut down now

Transcript for