itcmcgrath

Someone also wrote a rebuttal of sorts: http://pastebin.com/DfuG9T1W

I fear you have read words that don't exist.

No argument there. I'm unsure what your point is though?

I'm guessing it is just an awareness ploy. If the news picks it up, it gives all the stories something in common to mention. Likewise with any defacement that happens, if someone sees a common word, they are more likely to search for it and hence find more.

Where or not it works for them or turns in to a bit of an embarrassment for them, is yet to be seen.

I'll keep an eye on google trends to see how it pans out: http://www.google.com/trends?q=antisec%2Clulzsec&ctab=0&...

Is it just me, or is it almost equally possible that you would see the 'double' tap print on the digit that is repeated anyway?

This would then reduce the possibilities to 12 instead of 24 resulting in a less secure code.

I think the other solution presented in the comments of the post offer a far superior result: Randomize the position of the digits displayed each time. This way you cannot relate a tap print to either a digit or a relationship to another.

If you really want it even more secure (unable to tell if the user has used a digit more than once), randomize the positions after each entry.

Of course, these solutions have a downside in that you will enter the code slightly slower and thus slightly increase the risk of 'over the shoulder' attack vectors.

The short and sweet:

Lulzsec is encouraging everyone to deface government websites with #AntiSec as well as in physical graffiti.

'Top priority is to steal and leak any classified government information, including email spools and documentation. Prime targets are banks and other high-ranking establishments'.

Claims to have Anonymous on board.

Does anyone else smell a less free Internet approaching closer?

If you really want to do something like this, PLEASE implement some form of out of band 2FA. For example, SMS a PIN to a mobile number once the link has been clicked. This gives the benefit of not needing to remember your password, but requiring more than just a forwarded email to sign in.

Sorry, but "Automatic login links are no less secure" is an extremely flawed statement.

Automatic login links have the same issues, but them some more.

Please remember people WILL forward emails. This means that people WILL have unauthorised access to your system.

If you are implementing the system as you have described, you are being negligent to your users. You are also setting yourself up to be the next Sony.

Except people are not use to simply forwarding an email giving anybody access to their account.

Well, they were pushing stuff out of first year and in to second year. They then moved stuff out of second year to cater for this (beyond this I wasn't there, so I cannot comment if it quite filtering down in the following years).

Suprised? Not I.

While studying at the University of Wollongong, they were dumbing down the computer science courses to improve pass rates and keep more students (who probably shouldn't be doing Comp Sc anyway).

Two of my first year courses with C++ were split into three after I completed them with the harder content removed (such as abstract classes, inheritance, etc).

A lot of Universities are run like businesses now, rather than academic centers of excellence (at least in my humble opinion).

And not without their own set of flaws either.

I wish I could up vote this all day.

This my first thought upon reading the article. If people designing websites are making decisions that are not really well thought out (like this), episodes like Sony will continue to happen.

It really makes me sad.

It also makes me angry.

Not to also forget that if you have automagic login links in the email, you can no longer forward that email to anyone without compromising your account.

Try educating end-users on that one!

After working in the Banking world and talking with IT from a lot of other institutions, hell, I'd even take people making the decisions actually being semi-competent in security as a major win.

IANAL, but:

Look up the "California Internet Trespass Law" for a start.

Among other things, anyone tampering with data on a network faces a criminal conviction.

Also, check out point from the state of Arizona: http://www.azleg.state.az.us/ars/13/02316.htm

"Accessing, altering, damaging or destroying any computer, computer system or network, or any part of a computer, computer system or network, with the intent to devise or execute any scheme or artifice to defraud or deceive, or to control property or services by means of false or fraudulent pretenses, representations or promises."

I think it would be safe to say this would be considered illegal in many places for a multitude of reasons.

I wish I could vote this up more. It isn't the 'SQL' in 'SQL Injection' that is the issue, it is the 'Injection'.

If you don't properly understand your database (or any other tech), assuming it doesn't have security issues because it is 'different' is the height of naivety...

Exactly. Unless you have what "some time" is, how can you possibly justify something. It all boils down to ROI and risk (including mental sanity).

Military use: Personal Grenade "Return To Sender" Protection.

Well, after viewing my history from going to this page, I think that browsers are going to have to come up with a way to group history into collapsible groups. Most likely by a combination of tab and host.

Definitely not looking for to companies using the URL page as the new scrolling status bar...

Thanks. Might have something to do with the project I'm currently working on...

Isn't that what caused all those business critical excel spreadsheets ;)

Unless it's your wife... Then you say 'Yes, dear'

A programmer programs computers, a developer develops real-estate and an engineer engineers engines. Just kidding, obviously.

The question is highly subjective to the organisation using those titles, but generally you will find Programmers, Software Developers and Software Engineers perform the exact same role.

I've notice some people do get a bit touchy about what you call them though...

By the way, this has been discussed to death on StackOveflow http://stackoverflow.com/search?q=Difference+between+program...

Most interesting is how APRA (Australian Prudential Regulation Authority) is essentially calling some Australian financial institutions negligent:

"APRA has noted that its regulated institutions do not always recognise the significance of cloud computing initiatives and fail to acknowledge the outsourcing and/or offshoring elements in them"

In Australia, the major banks already do, such as Westpac, nab and ANZ.

I'm guessing the potential to provide a public focus point for negative sentiment towards the banks could scare quite a few away from it perhaps?