royce

6 ms·

1.
by royce 9mo ago
The rest of the snark/ bitterness aside ... NTP takes latency as a constraint, and accommodates for it. And far from a disgrace, NTP was a brilliant design for its time, and has proven to be far more future-proof than should have been
2.
by royce 2y ago
Someone seems to have dropped the "EXCEPT EUROPA" part. ;)
3.
by royce 2y ago
I work in telco, too - by my read, they're not disagreeing: Although Diameter was intended to replace RADIUS, the protocol itself offers no security when used over TCP. As a result, RFC 6733 suggests that Diameter messages shou
4.
by royce 2y ago
The paper https://www.blastradius.fail/pdf/radius.pdf ) explicitly states DIAMETER "never replaced RADIUS for many common use cases" and "the protocol itself offers no security when used over TCP". S
5.
by royce 2y ago
CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3596 Nothing on oss-security list yet, but it'll appear here: https://www.openwall.com/lists/oss-security/2024/07/0
6.
by royce 3y ago
Naively, would there be any value in providing an RSS feed of new adds, date changes, etc. ?
7.
by royce 3y ago
"[PATCH] socks: return error if hostname too long for remote resolve Prior to this change the state machine attempted to change the remote resolve to a local resolve if the hostname was longer than 255 characters. Unfortunately that di
8.
by royce 4y ago
That's an entirely different threat model. hotpotamus is right - the article, and the threat model, are about offline attack of back-end password hashes , after they've been stolen or leaked. The speeds against fast hashes are
9.
by royce 5y ago
Being able to firmly reject all unauthenticated messages is still the target end state. The risk of a threat actor sending an email that looks completely legit, and simply asking the user to "check their spam folder", is very real
10.
by royce 5y ago
Site author here. Thanks for helping to get the word out - every bit may help someone. While I consider my page to provide useful color, and I validate and summarize and cache info updates locally to add value ... it won't scale for lo
11.
by royce 5y ago
Am I the only one who thinks this sounds a lot like how pyramid schemes work?
12.
by royce 7y ago
It's now been cracked - and now we know why it took so long: https://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.h...
13.
by royce 7y ago
It depends on the organization. Some larger financial institutions are sometimes more likely - or even bound by internal policy - to simply trigger their standard card-cancellation procedures. Instead, one could present the financial instit
14.
by royce 7y ago
Or Alaska or Hawaii - same problem (shipping restrictions invisible until checkout). It's insane. They know exactly where I live.
15.
by royce 7y ago
The superset of all of the original CSRG-shipped cracking-eligible descrypt hashes is actually about 1400 hashes, drawn from a slightly smaller number of overlapping accounts among releases. Many of them appear to have been temp/test&#
16.
by royce 8y ago
I'm startled that there's no mention of app whitelisting yet. Code signing reduces ops overhead and latency in environments that are using app whitelisting. If the code is signed, then the signing certificate can be trusted once
17.
by royce 8y ago
Yep, that was exactly why (or at least, very strong circumstantial evidence): https://productforums.google.com/d/msg/websearch/H4XbbwWmtAY... I don't think it was ever officially announced/admitted
18.
by royce 8y ago
Now that Google+ is going away, can we have the +string operator back in Google Search, to force inclusion of a single string (instead of having to use double quotes)?
19.
by royce 8y ago
For us (early regional ISP, mid-'90s), a lack of separate per-service hostnames caused significant scaling fragility. In the initial rollout, all services were served from a single physical host with just one listening IP, which the ba
20.
by royce 8y ago
If someone is developing web applications in such a way that they need support from their browser vendor to make them work properly ... they're doing it wrong.
21.
by royce 9y ago
What about the other case - when they're not random, but also not reused ... such that the psychology of the user's password-selection methodology might be exposed?
22.
by royce 9y ago
Just because the horse is out of the barn doesn't mean that the owner of the barn knows about it yet.
23.
by royce 9y ago
> What does that buy you, if they are in plain text? Nothing. That's why I was agreeing with you for that subset. But N may be smaller than you might think, when frequency data is also supplied by the API. https://gist.
24.
by royce 9y ago
> Shadowed password files may as well store passwords in cleartext; if those passwords are not reused anywhere, the situation is safe Wait, what? If they were randomly generated and of sufficient length, yes. If they weren't rando
25.
by royce 9y ago
Random passphrases are indeed a good idea. XKCD #936 advocates for 4 words randomly selected from a 6000-word dictionary, which is 6000^4, or ~1.296 × 10^15, which isn't actually that strong if the service in question has chosen a weak
26.
by royce 9y ago
I'm quite familiar with password attack scenarios. If high-value targets are selecting passwords that would be vulnerable to a targeted cracking attack, the solution isn't to blacklist a half-billion passwords (when they could jus
27.
by royce 9y ago
A combination of public leaks and private contributions. He does a pretty good job of vetting them and determining what era they're from (by polling some users to see when that password was used/changed on that service, etc.)
28.
by royce 9y ago
Because: 1) In an online attack, against a properly-configured service, even if password spraying is used, only the first few thousand passwords can be tried before rate-limiting, CAPTCHAs, etc. kick in. Would a user with a known leaked p
29.
by royce 9y ago
The ranking in Troy's list is based entirely on how common the words are. Here are the top 10, with their relative frequency: c4a8d09ca3762af61e59520943dc26494f8941b:123456 (20760336) f7c3bc1d808e04732adf679965ccc34ca7ae3441:1234
30.
by royce 9y ago
Some large services do use the actual dumps, and correlate them with the email address associated with the current user, in order to give users a personalized warning that they're reusing a leaked password that's already associate

More ›