Unless you have access to a mobile phone's baseband source code, you cannot really trust anything about its level of security.
This was discussed on HN a while back and comes up quite often:
1,471 karma · joined January 23, 2013
https://cariad.keigher.ca
This was discussed on HN a while back and comes up quite often:
http://www.universetoday.com/15403/how-long-would-it-take-to...
>However, despite these advantages in fuel-efficiency and specific impulse, the most sophisticated NTP concept has a maximum specific impulse of 5000 seconds (50 kN·s/kg). Using nuclear engines driven by fission or fusion, NASA scientists estimate it would could take a spaceship only 90 days to get to Mars when the planet was at “opposition” – i.e. as close as 55,000,000 km from Earth.
> But adjusted for a one-way journey to Proxima Centauri, a nuclear rocket would still take centuries to accelerate to the point where it was flying a fraction of the speed of light. It would then require several decades of travel time, followed by many more centuries of deceleration before reaching it destination. All told, were still talking about 1000 years before it reaches its destination. Good for interplanetary missions, not so good for interstellar ones.
There's talk of other drive systems being able to pull it off but this is the only one that actually has been tested but never built to scale.
If you're in a situation where you're needing to rely on hashing a user's password for every action, your application has far worse problems than what password storage method is in play. Moving from your current password storage method that is inadequate to one that would be better also takes into account that you haven't done something completely wrong with session states.
[edit]
I misread the poster I was responding to assuming that they meant that the user was re-authenticating on each request. My thought process was that if they're storing credentials in a cookie in lieu of a session ID then that needed to be addressed first before even going down the avenue of correcting password storage.
Intel Xeon E5-1620 3.6 GHz: SHA: 8.16 seconds, SHA256: 11.01 seconds, MD5: 8.7 seconds
AMD FX-8320 3.5 GHz: SHA: 10.63 seconds, SHA256: 13.49 seconds, MD5: 10.06 second
Intel Celeron N2840 2.2 GHz: SHA: 32.4 seconds, SHA256: 39.75 seconds, MD5: 28.95 seconds
Intel Pentium M 1.7 GHz: SHA: 37.98 seconds, SHA256: 48.12 seconds, MD5: 34.49 seconds
SHA512 isn't going to make it much better.
http://www.pxdojo.net/2015/08/what-i-learned-from-cracking-4...
The author of this piece was doing about 156 hashes per second and after just over five days, he had only gone through and cracked 4,000 account passwords--we're talking 0.0001% of Ashley Madison's supposed userbase here. To run just over the 14,000,000 passwords from RockYou.txt on every single user account from AM, it would take up to at least two billion years.
SHA and MD5 can be calculated entirely in a CPU's registers without having to rely on RAM. Bcrypt for example requires the use of a matrix as part of its calculation, slowing down the process. A GPU has so few channels from the processor to memory that it cannot be effectively done in parallel.
All one has to do with Bcrypt is just adjust the difficulty and any advances in GPU technology or whatever can be nullified.
https://canar.io (mine)
Mine lets you free-form search whereas HaveIBeenPwned is there for searching just e-mail addresses.
If at all possible you shouldn't be storing passwords to begin with and instead relying on another service for authentication.
This should be the takeaway from this article.
The point of donating money to the author of the piece is to encourage them to continue writing this epic story. Giving them Bitcoin is akin to leaving a tip to your server where the tip appears to be currency but rather instead is a Chick tract with the suggestion that you'll pray for their soul.
And tell me, how does one cut out the middleman when they convert their Bitcoin earnings to US dollars or whatever currency they prefer?
It is not the responsibility of a network service provider to protect the assets of a customer. If you're given a network link and an allocation of IP addresses, it is your responsibility to use them wisely and securely.
> Or maybe universities and organizations could teach their employees to handle network security better.
This is more sane thinking.
$ cat payload.ps |netcat -q 0 $printer_ip 9100
This is what was originally posted:
To travel from Vancouver to the next principal Canadian city (Calgary), it requires 900 KM of driving and there's only really one metropolitan area of sorts between the two, meaning that you're going to be setting up cell towers that handle only so much traffic in a day.
As a result, to get service where you end up with just traffic shaping once you go beyond 6 GB (beyond that there is no real limit really), you need to go with a carrier that only services the larger cities. So in my case, my carrier services just Vancouver, Edmonton, Calgary, Toronto, and Ottawa, which are fairly dense areas with a combined population of 18 million or so, or just about half of the country's population. Once I leave the city, I have to piggyback on to other carriers however.
Hence why mobile carriers suck in Canada because the bigger carriers do not want to eat into their fairly large profit margins. They can afford to offer such plans, but they simply don't want to.
For the record, I pay $40 CAD/month ($30 USD or 27 EUR) for unlimited North American calling and text plus the "unlimited" data use.
Spotify accounts for 2 GB of traffic per month on my phone and some plans are barely affordable when you want more than that--fortunately I can do up to 6 GB before I am traffic shaped, but that isn't the say the same for all carriers in this country.
Generally I recommend that if you think that your password has been exposed that you just reset your password as if you have to ask that question then you might want to reconsider your password reuse.
(I am the creator of Canario)
Every app that runs on your systems with enough privileges can dump the memory and extract information via that.
http://www.cbc.ca/news/technology/faq-the-issues-around-muzz...
Visa claims it can do 2,000 transactions per second or 172,800,000 per day and Paypal suggests its maximum is 115 per second or 9,936,000 total per day [1]. At best, Bitcoin is able to handle 3% of the volume that Paypal is able to and it doesn't even register as a blip when compared to a single major credit card.
If we continue to read the link I cited for those numbers, we get these details:
>Let's assume an average rate of 2000tps, so just VISA. Transactions vary in size from about 0.2 kilobytes to over 1 kilobyte, but it's averaging half a kilobyte today.
>That means that you need to keep up with around 8 megabits/second of transaction data (2000tps * 512 bytes) / 1024 bytes in a kilobyte / 1024 kilobytes in a megabyte = 0.97 megabytes per second * 8 = 7.8 megabits/second.
>This sort of bandwidth is already common for even residential connections today, and is certainly at the low end of what colocation providers would expect to provide you with.
If we were to expect that everyone was to get onboard the blockchain, we would have to assume that we're all going to start sucking up 0.97 MB per second, or about 82 GB a day. This would mean that in a month, one would use just about 2.5 TB of bandwidth. If the average residential user were to want to transfer 2.5 TB for just a blockchain (ignoring modern life's pleasures like Netflix and other streaming services), you'd have to find an Internet service that would not impose a usage cap. As it stands with Comcast, if you exceed 300 GB, you'll get charged $10 USD for every 50 GB you use [2], meaning that a month's worth of transactions will cost you just about $450 on top of what you already pay for the privilege of having access to a blockchain.
This doesn't even take into account that transactions are replayed once confirmed so those numbers could end up even higher if the whole protocol isn't changed. Heck, I am not even taking storage into account which is a different problem all together.
The idea that blockchains are going to be the future is pure lunacy. It's either going to be limited to data centres that can handle this load or it's not going to be used at all. It has no future for the general public and is part of the reason why Bitcoin in itself is not practical.
[1] https://en.bitcoin.it/wiki/Scalability - Bitcoin's "official" wiki backs this up
[2] https://bgr.com/2015/11/19/comcast-data-cap-2015-bad-for-us-...
You're overlooking something here.
Ignoring the fact that the merchant won't typically see the credit card number if I am using it physically, you are correct that I have to offer it up to them if I am using an online store. However, there is an important distinction between a credit card number and a Bitcoin private key that you're neglecting to look at here.
A credit card number is just a reference to an account between the card holder and the issuer. In a situation where the credit card number becomes exposed via negligence not on the part of the card holder, the card holder themselves in almost all situations is not liable for the charges incurred that were not of their own. So if Target for example gets breached like they did in 2014 where millions of credit card numbers were exposed, the account holders of those affected cards are not on the hook for any purchases that they did not make. In fact, issuers and payment processors were largely able to determine who was affected and issued new cards very quickly.
The only situation I can easily recite where you are on the hook for your credit card number being exposed is if you willfully expose it to a third party. It is at this point that the credit card issuer can tell you to effectively "buzz off" and pay for the undesired purchases.
In the situation where the card becomes compromised, the solution for the issuer is to issue a new credit card number and then to deny all use of the previous number going forward. All charges are then reversed and it's a matter between the payment processor and the merchant to flesh things out. In a few days the consumer will have a new card and even in extreme cases with certain classes of credit cards, they'll have a card hand-delivered to them within 24-hours.
With Bitcoin, if the private key becomes exposed (and there are many, many ways for this to occur), then there is no recovery nor any third party to rely on to get the coins back. You're effectively out of luck and must then generate a new private key and public key and start anew.
Also with Bitcoin you need to install a third-party application on your phone or computer in order to make use of it. I can easily send a payment via credit card via telephone, Internet, or in person.
As it stands with credit cards, it's 180 days maximum for a chargeback; meaning that the consumer has six months to make up their mind on any transactions they may not deem acceptable.
How long should it be in escrow if we're to switch to Bitcoin? I don't see how merchants will want to wait six months for them to see any payments and I don't see how consumers will want to see the timespan lessened.
Here's a Bitcoin private key: 5JcgxNrn4WFcA8trEix7ComAyLNEsDEyBqYVjEo8JaaXWQQNg1u
Now you have the ability to drain whatever coins are in that wallet and I'll never see them again unless you somehow decide to return them to me.
You can probably convince a layperson to give you their private key through the same means you could ask them to tell you their passwords or whatever personal information they should not divulge.
> As you use your credit card, over time you give more and more people a direct line of access to your credit until it expires or gets revoked.
Credit cards are a form of payment. I go and pay my bill for using that credit card. A month before the card expires, the issuer sends me a new card. Provided I don't neglect to pay my bill and don't abuse it, my credit card will almost always allow the transaction to go through immediately.
> Until I can generate credit card numbers on the fly with one-time-use amounts of money, I'll have a use-case for Bitcoin.
https://www.bankofamerica.com/privacy/accounts-cards/shopsaf...
"To access the ShopSafe service, sign in to Online Banking and choose Use ShopSafe from your credit card Account Activity screen. Enter your spending limits and the ShopSafe service will automatically generate a temporary 16-digit account number, with expiration date and security code, that allows you to complete your purchase while protecting your privacy."
https://www.cardbenefits.citi.com/products/virtual-account-n...
"When shopping online or by mail order, you can use a randomly generated Citi card Virtual Account number instead of your real account number. Simply click Enroll in/Get below to begin using Virtual Account Numbers.
All purchases made with your temporary number will appear on your monthly statement with your other purchases and will include the Virtual Account Number that was used for each transaction."
So I buy a service with Bitcoin and it ends up being fraudulent, how do I get my Bitcoins back?
If I buy a service with my credit card and it ends up being fraudulent, how difficult is for me to get the charges reversed?
One of them relies on the fraudster having a change in heart and the other may not necessarily be fun but is more than likely to happen.