- Feature Articles
- CodeSOD
- Error'd
-
Forums
-
Other Articles
- Random Article
- Alex's Soapbox
- Announcements
- Best of…
- Best of Email
- Best of the Sidebar
- Bring Your Own Code
- Coded Smorgasbord
- Mandatory Fun Day
- Off Topic
- Representative Line
- News Roundup
- Editor's Soapbox
- Software on the Rocks
- Souvenir Potpourri
- Sponsor Post
- Tales from the Interview
- The Daily WTF: Live
- Virtudyne
Admin
For the frist one, you could also similarly argue, why did the Danish government put a system available on the internet that didn't enforce secure passwords, mfa and blocking credential stuffing?
Blaming a weak password, I'd argue, is missing the point.
Admin
Yes, but no. Both (pendantry: all) participants in a security process must have a "security first" mindset, or all the hardened security in the world won't help.
Admin
The best security - Just don't do it in the first place.
Admin
Unless the implant wasn't as unauthorised as the Ledger claims...
Admin
Allexxann, I salute your appropriate paranoia.
Admin
blockchain is this generation's "webscale".
Admin
While I've been interested in cryptocurrency (and wish I'd jumped on the bandwagon when I first heard about it in college, when it was under a dollar), I've never actually gone through with it. Probably just as well, since dead hard drives were a too-frequent occurrence for me in those days.
I keep coming back to the idea, but I'd like to get a physical wallet like the article mentions, and I never had an idea of if anyone was trustworthy. It's comforting (in a somewhat sour grapes way) that my hesitation was warranted.
Admin
I'd argue that the time for Blockchain being this generation's web scale was ten years ago. AI is this generation's web scale.
Admin
Laugh all you want about passwords and encryption, those Minoans showed how it's done. To this day noboday has been able to crack Linear A
Admin
The genius and elegance of blockchain/bitcoin, along with the fact that it provides no value, is what makes it such a long-lived nothingburger - a nothingburger that now costs $82k. That's because people who point out that a bitcoin in and of itself has no value are told they don't understand the complexity of the algorithms... and that somehow creates value (or demand, at least).
AI has a ton of obvious value and it's already being tapped!
Admin
I once did some work on a project involving labels that rewrote themselves over time. I wasn't convinced it was going to be useful, but helped with the problems they asked me to solve.
Eventually, the company ran out of funding, but it's hard to kill off intellectual property, so someone else wound up owning it, and I found myself at a meeting about how to add blockchain to the project. No one was quite sure what that meant, and it rather sounded to me like the only reasons the new owner wanted to do that is that it sounded cool, and some big player with a blockchain product might provide some sort of assistance, the precise details of which I didn't learn about.
So I went to one meeting at the big player, where no one seemed to have plans that could be expressed to any greater level of precision than "add blockchain". That's the last I heard about it.
Admin
Electrolytes! https://www.youtube.com/watch?v=kIZ9YuPm_Ls
Admin
The "our intrusion detection system is some guy in accounting" is super funny. But now I bet they are looking into AI...
Now, the damage should be minimal, as since 2010 you have needed
https://en.wikipedia.org/wiki/NemID
for anything serious, but for historic reasons many admins still accept the ID number as a password.
I blame the my parents generation, as when the ID# was introduced in the 1960ties to 'track' you between tax, healtcare, child support etc, people got upset, and was then told: Oh, the ID# will be a secret. Which have lead to decades of problems, when the ID# should not be any more secret than the name on your mailbox. ID# is on ID cards like drivers licenses, that you show everywhere.
Admin
I don't understand why keeping an ID#, like your SSN, secret is a bad idea? Can someone explain?
Admin
The Cryptobilis incident is fascinating, as it seems they got bought by a Chinese investor who used an NDA to temporarily prevent the previous owners from revealing that they were bought. https://www.youtube.com/watch?v=8JnHdr30v4g has a decent analysis, better than I could do in a short post.
Admin
When a datum is secret, knowledge of it can be taken as authentication. "Hello, my name is Jen Jensen and my ID number is 12345678". "Thank you Herre Jensen, how much money do you want to withdraw?"
Admin
For the same reason that you shouldn't use the same password on every web site, where none of those web sites salt/hash passwords - if one of those sites has a data breach, the attackers have your password for every web site, with the added benefit that you can't change your password.
Admin
There is a well-known protocol for unprotected secrets. Password of the day. Rotating passwords is not appropriate for most personal passwords, but it is still used for machine passwords, and still used for unsecured shared passwords.
They should be rotating their ID.s
(American cousins: you should be rotating your SSN):
Admin
Mostly because it's a user id - not a password.
Kim Larsen (known Danish musician - passed away some years ago) openly shared his own CPR-number, as it was the title of one of his music albums:
https://en.wikipedia.org/wiki/231045-0637
Admin
If government ID numbers make bad secrets, how are biometrics even remotely safe? You'd literally need surgery to change them, but at the same time there have been video games ranging from Star Trek 25th Anniversary all the way back in 1991 to Doom 2016 where you need to pick up a dismembered hand and use it to gain access to an area! Do modern biometrics use some sort of hashing algorithm so that the actual biometric data never leaves the device, similar to a private key? Even so, what if the device itself is compromised?
Admin
That's the thing, they ain't. Biometrics are only as safe as any other password. All it takes is one insecure system...