woobles

https://www.duosecurity.com/authentication-methods What? This exists...

This seems like simplicity just for simplicity's sake...

Look at that Wikipedia article under "Multiquines"

I will be very interested to see how this story develops in the coming days/weeks. Clever of these services, pitting State v. City.

Yes, they did, and Turing was chemically castrated. Not by the baddies, either. It might not be going to war to die, but that is still pretty messed up.

No. Query parameterization is how you avoid this. How do you propose that encryption would prevent SQL Injection?

Encryption encryption encryption.

This does seem to be a logical argument, these days. :/

The article specifies that many people targeted used emails unique to their dropbox accounts.

That's JSUT what they want you to think!

Fair enough. My numbers are of course based on an unsalted hash which has been stolen from a db or otherwise obtained by an attacker.

Further arguments include high overhead for learning (not to mention changing passwords) a given password, storage of passwords, and the idea that your password isn't summonable on demand.

I remain unconvinced that anything would assuage his paranoia, unfortunately.

One of my old bosses thought that all Lenovos possessed BIOS-level malware that could be activated at a moment's notice by the Chinese government should the US ever got to war with them.

He was a weird dude.

Very interesting. Thanks!

I would personally prefer to have my password at any time, rather than have to get in the "zone" to authenticate into my computer.

While this does sound interesting from a psychological/neurological perspective, I feel bad for anyone who actually tries to implement a password system based on this. 38 bits of entropy is nothing, a standard password with 38 bits of entropy would take about 5 minutes to crack (assuming a GPU that can compute 1 billion hases/second). Nevermind that by the NIST specification for human-generated passwords, a 30 character string of alphas would be 45 bits of entropy. Also, as some others have pointed out, storing people's unique strings in the clear invalidates any strength this scheme could hope to achieve.

Source: http://en.wikipedia.org/wiki/Password_strength#Human-generat...

Conclusion: Interesting psychological experiment, not actually backed by any appreciable crypto knowledge.

Edit: disregard my NIST comment, someone linked the paper used to get the 38 bit figure, http://bojinov.org/professional/usenixsec2012-rubberhose.pdf.

I'm going to assume you mean "What tools can a web entrepreneur use to check if his site can be hacked by script-kiddies". There are a multitude of static analysis and penetration testing tools out there, free and licensed. Fortify (Static analysis), HP Web Inspect and IBM AppScan (penetration testing) are just a couple easy(ish) to use tools. On the free side of things, BackTrack comes with a plethora of security tools one can use to assess your site.

Ah yes, that makes sense. I'm not terrific at business sense, thanks. I had not considered that targeting existing Yahoo customers doesn't necessarily cannibalize Google's customers, since they're clearly not jumping to move to gmail, are they?

I think a big part of the problem is that, were Yahoo! to enter the phone game now, they'd be years behind their competitors. iOS, Android, BlackBerry, and Windows mobile are all pretty established, and could all easily out-maneuver a new competitor. Second, I don't think she would really move into a market that Google is already working in by introducing competition for Android. Yahoo! needs to find some untapped market need and hit it HARD. Unfortunately, phones are probably not that need.

An evercookie is actually pretty straightforward to remove, if you know what you're doing with firebug/firecookie. The only tricky thing it does is persist a cookie in the sessionStorage of your window object, which isn't cleared when you clear your browser cache.