HNHacker News
TopNewBestAskShowJobs

k4ch0w

703 karma · joined May 1, 2017

submissionscomments
k4ch0w··on Ask HN: What are your favorite books of all time, and why?
Meditations - Marcus Aurelius - A Roman emperor's private thoughts to himself. He was a philosopher and practiced stoicism. He had everything a human could want, money, women, power and yet he reminded himself daily how fleeting it all was. How easily a man can be swayed from his purpose. How not to look down on others. It's my all time favorite book for keeping life in perspective.

The Road Less Traveled - M. Scott Peck - When I was struggling with depression and not feeling worth anything and generally a piece of shit someone pointed this book out to me. It talks about how no one can shoulder your psychology burdens for you and fix them. You have to take the work on full force and fix yourself. You may have suffered wounds in your childhood and be playing them out in your adulthood. It's all subconscious behavior.

The Game - Neil Strauss - I was struggling to understand women and relationships. This book fundamentally changed the way I understood myself and relationships with other people. Another great book for understanding that external forces can't bring you the happiness or fill the void you're hoping for.

k4ch0w··on The OWASP Top 10 is killing me
Hey man,

Did you add a captcha to your login? You could add one after 2 failed attempts from an ip.

I understand not wanting 2FA for lower conversion rates, but I'd recommend implementing it in the future. It's one of the best ways to mitigate an attack against knowing your password. The session cookie is another story.

As for the passwords, I'd enforce standards around what a user is allowed to use. You want to have it be at least 10+ chars with special characters. If they reuse the password on another site and that gets compromised there really isn't much you can do. However, if we assume the reused password from the other site is hashed with a salt and you enforce more chars, they are much harder to crack and thus prevent the plaintext password from being recovered and accessing your site.

A great way to demo what more chars does to a password here

https://www.betterbuys.com/estimating-password-cracking-time...

You should also maintain a record of the common IP address an account uses and require an email/text to allow access that would further mitigate your problem. I know your a startup, so this is more of a luxury feature.

k4ch0w··on Ask HN: What is your “I wish I did it sooner” moment?
Realizing that other people aren't way more intelligent than me and i'm stupid. It's just a perception based on nothing more then them acting more confidently, because they had an upbringing that gave them more self esteem. When the time came to perform I always exceeded the expectations of those around me because I always beat myself up and told myself I was stupid and not good enough. The insecurity pushed me to always try harder but in the end I was better than I realized. I just one day had to let it go and realize those thoughts of not being good enough weren't real.

Another thing is stopping relationships with people that would belittle, insult or use me. I instead paid close attention to who was there for me and built me up. I gave those people 5x the attention and built a stronger relationship with them because thats who you want in your life. Quality friends > Quantity. If someone keeps blowing you off you aren't a priority in their life, and you should treat them the same.

Oo last one.

Ask that cute girl out, if you're reading this, I know you are more than good enough.

k4ch0w··on Ask HN: How do you take notes when you're Bug Hunting or Pentesting?
I usually use OneNote or Markdown in sublime. I use it in conjunction with http://getgreenshot.org/.

I think a huge pain point is timestamping notes. So you generally start a pentest and it would be helpful to add a timestamp at each place you take a note. If you could then export it as a timeline of when events occurred that'd be awesome. The reason why you want to see the timeline is so you can hand it to the blue team and be like this is when we were doing bad stuff.

k4ch0w··on 150 days of living and coding in a van
Nice man that looks awesome, pretty jelly. I can work remote and have been thinking about leaving for a while. How much was the initial cost of the van? How did you maintain your internet connection? What would you say is the biggest struggle?
k4ch0w··on iTerm2: Please disable 'Perform DNS lookups to check if URLs are valid'
Thank you gnachman! Thanks for making my favorite terminal as well.
← PreviousPage 7 of 7