Avenging_Mikon posted:

You don't put your actual password in those, you use something of the same length and characteristics.

Powaqoatse posted:

the nazi site has been cleaned up a bit since, but archive.org shows the type of poo poo they sell/sold:
https://web.archive.org/web/20160223051112/http://midgaardshop.com:80/kategori/vrigt/klistermarken

infernal machines posted:

yes, a password inspector. don't use your actual password (any of them, for anything), just one you might use.

cool, no problem, and definitely something a layperson worried about wizardsec would use in the manner in which its intended.

Avenging_Mikon posted:

I dunno, I found them useful to demonstrate to people the importance of complexity.

French Canadian posted:

redleader posted:

pci dss gives fucks about exactly one thing: protecting cardholder data, and only cardholder data. you can store plaintext passwords on a sql server 2005 db with an asp.net 1.1 app running on windows server 2003 in tyool 20 loving 17 and as long as your cardholder data is 'adequately' protected you can get the big pci dss level one certificate

Powaqoatse posted:

speaking of secfucks, someone hacked a nazi merch webstore and handed over their customer db to Swedish antifa

theve sent out letters saying "if you can explain why you bought nazi memorabilia, please write back so we can remove your name from the list that will be published in one week"

https://twitter.com/NiclasWestlake/status/898195585802620928

closet nazis are freaking the hell out

infernal machines posted:

what kind of complexity? how does it work?

Avenging_Mikon posted:

Short vs. Long, use of special characters, numbers, capitals. People are really dumb, and having something to show them to say "look, this simple change gives you way more protection without making your life more difficult" is useful. The thing just evaluates attack space and compares to brute force speed to get approximate time to crack.

A Pinball Wizard posted:

Is there a translation of the letter somewhere?

quote:

Hello,

Your name has come to our attention because you have ordered products from the nazi website Midgård in the past. We would like to remind you that your identity is never fully protected when you are ordering nazi products over the internet. Nazi websites such as Midgård always assure their customers that their information is safe, but we always find out.

We have located all customers in in Skåne and Blekinge [two southern Swedish counties], and you are one of them. We therefore ask that you contact your local AFA branch to explain why you have ordered products from Midgård. We are planning to publish details of customers in Skåne and Blekinge,and if you don't want your details included - e.g. if you are not a nazi, or have left the nazi movement, we would like you to get in touch. Otherwise, you risk having your picture and personal information published on our website. If you do not contact us, we will assume you are a nazi and act accordingly. If we find you particularly interesting, we will contact your employer, neighbours and family directly.

Keep in mind that employers, landlords and others often Google for names, and we know from experience that our publications cause issues for nazis. When contacting us, please remember to provide a valid e-mail address, as we receive many e-mails. You can also visit our website https://www.antifa.se and use the contact form. Be prepared to answer some simple questions.

My PIN is 4826 posted:

dunno, but here's my liberal translation

anthonypants posted:

owns

Lain Iwakura posted:

so a friend is having fun with sprint today

https://twitter.com/sprintcare/status/898800482663014400

https://twitter.com/sprintcare/status/898901472594636801

https://twitter.com/sprintcare/status/898912177523892224

https://twitter.com/sprintcare/status/898918538546565120

https://twitter.com/sprintcare/status/898895355609202689

maskenfreiheit posted:

fun reverse of this story: Amex wouldn't let me create a username unless it had at least 2 #s.

gotta get dem high entropy... usernames? 🤔

tacked on my birth year like everyone else probably does 🎉

at least they let me create a complex password too

maskenfreiheit posted:

fun reverse of this story: Amex wouldn't let me create a username unless it had at least 2 #s.

gotta get dem high entropy... usernames? 🤔

tacked on my birth year like everyone else probably does 🎉

at least they let me create a complex password too

My PIN is 4826 posted:

dunno, but here's my liberal translation

maskenfreiheit posted:

fun reverse of this story: Amex wouldn't let me create a username unless it had at least 2 #s.

gotta get dem high entropy... usernames? 🤔

tacked on my birth year like everyone else probably does 🎉

at least they let me create a complex password too

Shinku ABOOKEN posted:

we actually got rid of predictable usernames at work because the brute force bots were getting way too good

Shinku ABOOKEN posted:

we actually got rid of predictable usernames at work because the brute force bots were getting way too good

Shinku ABOOKEN posted:

we actually got rid of predictable usernames at work because the brute force bots were getting way too good

infernal machines posted:

okay, so the issue is a "complex" password isn't necessarily a harder to crack password. assuming you're going for a human memorable password, you probably just want a long phrase rather than something that has a bunch of special characters in it. but also, if the thing just scores Name<birthyear> as complex* it's not very good either

*microsoft online services, i'm looking at you

Shinku ABOOKEN posted:

we actually got rid of predictable usernames at work because the brute force bots were getting way too good

infernal machines posted:

*to be clear, i'm talking specifically about this password inspector website (you know, the one the tweet was about), password strength indicators in general can be useful assuming they're part of the service you're creating an account for, and properly weight things. telling someone to put their password into a random website probably isn't doing them any favours though

infernal machines posted:

because a tool that says "check your password here" is a stupid tool*.

look at this website: http://www.speedypassword.com (http!!!)

do you think "Test your password below to check its strength and find out how secure it is!" suggests you should enter your actual password?

a site that offers to generate username and password pairs for you?

seriously?




*to be clear, i'm talking specifically about this password inspector website (you know, the one the tweet was about), password strength indicators in general can be useful assuming they're part of the service you're creating an account for, and properly weight things. telling someone to put their password into a random website probably isn't doing them any favours though

quote:

> e.- StartCom has developed a new CMS system and website, using a new
> language, PHP, from scratch.

mdl posted:

tl;dr: mozilla wants to readd the Totally Not Eddy Nigg/Mossad SSL vendor to the trust rolls

https://bugzilla.mozilla.org/show_bug.cgi?id=1311832#c16

https://news.ycombinator.com/item?id=15055707 if the circlejerk ever shows it instead of a blank page, lol.

vOv posted:

is that mozilla that wants to add it or is it some random gently caress

vOv posted:

is that mozilla that wants to add it or is it some random gently caress

Subjunctive posted:

that's just someone commenting in it now that startcom has applied to be re-admitted. there's nobody from Mozilla commenting on the request.

some credulous mozillan posted:

StartCom may apply for inclusion of new (replacement) root certificates[1] following Mozilla's normal root inclusion/change process[2] (minus waiting in the queue for the discussion), after they have completed all of the following action items, and shown that WoSign has no control (people or code) over StartCom.

Subjunctive posted:

people are always allowed to reapply. doing otherwise would require tracking employment and private company ownership to avoid deemed reapplication. "are permitted to reapply" is boilerplate from Kathleen, not an invitation. see her other similar bugs.

Subjunctive posted:

(disclosure: I wrote a bunch of the CA policies, authorized removals, and was Kathleen's boss)

mdl posted:

if only there were databases that had this sort of information, or if any industry had the capacity to do it, such as the "information" "security" industry, which already does it. apparently this is too hard for the multi-national browser vendors

Subjunctive posted:

I don't know of any database of private company employees, but I'm happy to be educated.