Hacker Newsnew | past | comments | ask | show | jobs | submit | mhellmic's commentslogin

rewatchability should indicate a light-weight movie. If you want that, you look at rewatchability, if you want something more complex, you use quality. I think this is the underlying assumption.


I don't think this is right. People watch movies like Blade Runner and Citizen Kane repeatedly.


What if you rely on the service to know all your password and you only know your key to the service .. and then somebody manages to take over your account (getting access to your mail address) and to delete all your data?

That would be not as bad as him knowing your passwords, but still inconvenient.


This might sound stupid, but the most straightforward solution I can think of is to back up the passwords locally every now and then.

Some background: I wrote this to scratch my own itch. I have really secure passwords, and different ones for every site I use. I keep those in a Truecrypt container, which is stored on my Dropbox.

That's secure, but it's not convenient. I simply can't securely access my passwords while on the road, e.g. from a friends computer or from my iPhone. I would always have to install Truecrypt and get the image file from Dropbox etc.

I wanted something with a true zero setup. I can still back up the passwords to my Dropbox Truecrypt image once per week.


I would like to disagree on that:

"It's not really about MD5, SHA1 or BCrypt, (...) It wouldn't matter if the passwords were all in plaintext if they never got out."

It is also about the hashes, because a good security infrastructure should anticipate the possibility of a leak and still protect the users.

For that, you need to use the right encryption so that users don't have to change their passwords in the next days, but have 5+ years for that.

And yes, I see that you are promoting dedicated authentication services (which would do it right), it just looks strange to me there.


You're absolutely right, what I meant is that its not just about using the right algorithms and making sure they are implemented and used correctly. It's also a whole host of other things including avoiding SQL injection, CSRF, XSS, data leakage in logs, proper access and provisioning, following and reacting to the constant stream of security alerts (case in point: the MySQL Ubuntu issue that cropped up yesterday).


Just to be clear, the pirate party (with 7.4%) is in the parliament, not in the government. The government will most likely consist of a coalition of the parties CDU and SPD, so that the Pirates will be in the opposition.

I am sure you meant that, but it wasn't clear to me.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: