Hacker Newsnew | past | comments | ask | show | jobs | submit | more professorTuring's commentslogin

So they are taking advantage of something that should be mandatory.

These are the things that let you know the kind of company you are dealing with.


One of the good things about masks-in-public being a cultural thing is that you might not look like a weirdo wearing a mask on a plane in the future, regardless of whether a pandemic is in progress.


I am hoping this normalizes mask wearing in public in general in the future.

I would love to default to face mask and sunglasses in most “no expectation of privacy” places. Almost all high end/national retail uses some sort of facial recognition systems now.


That is exactly what I feel.

More and more I find Amazon to be closer and closer to a Chinese Bazar of cheap quality items (kind of an AliExpress or dx but with a different perceived quality).

I believe they will gain a lot of customers among people who just want cheap stuff (or don't care if it is original as long as the brand is clearly visible and is cheaper) but definitely they will lose customers that use Amazon for convenience (more or less the same price, better refund policies, availability of products...)

It's a pity. Hopefully others will fill that space.

In Spain, El Corte Inglés with its new on-line platform is getting closer and closer.


No, you can only access browser's stored passwords if you can log in as the user in the machine (see second response).

In this case, anyone can access that registry and get the pwd.


I guess they were proud for using encryption instead of hashing, hence, more secure!

Definitely they didn't follow the one and only rule of security: don't roll your own.


Hashing is not an option for locally saved passwords. Some kind of token-based Auth scheme could work, but not hashed passwords.

That said, the much greater problem is the idea of using a hard-coded key, instead of generating a unique key for each device/installation.


Unique keys don’t help much. It only takes one person to write a script and put on github so that it can dynamically find the key and unencrypted stored password.


Again it's a grad level thing, but many smart grads can work out why encrypting isn't better. At least of the many I've interviewed, even ones I didn't hire could figure this much out.


Kudos to the security expert for the finding but his web page gave eye cancer.

Seriously, consider lowering the contrast or chaging typography... Don't know, but it was hard to read in its original form...


IMHO, the website was a wonderful and easy-on-the-eyes experience to read.

I am visually impaired. I need sites to look like this just to consume them.

This was my experience and yours was different. Being able to let the viewer choose is critical so that everybody can use the web.


“I don’t like dark themes” would have been an adequate critique.


I also can’t read it as is, but it’s even worse than that: the page is not compatible with Reader View on iOS Safari.


Not true. Not true by far. That's an over statement. 2FA is only one of two factors, you need the the password, you need the mobile number and you need to obtain a duplicate or being close to your victim.

You should be worried if you are a POI or you are being targeted personally. And if it is so, SIM Swapping it's just one option and if it doesn't work there are other methods (breaking in, stealing yubikeys, mobiles...)


You don’t always know if you are a target.


Is SMS 2FA Secure? No, I agree.

Is SMS 2FA enough for most of the people today? Yes

Is SMS a cost-benefit solution for most uses? Yes


Is offering or forcing SMS 2FA and not offering an option for only TOTP asinine? Yes.

It’s free, and requires a tiny bit of additional configuration to enable. No reason not to offer it.


In a previous company, one of the employees enabled 2FA for their staff account (it was mandatory), stored the backup codes on his phone (presumably as a photo) and it fall in the ocean the next day.

With large enough numbers, you'll see everything, but you don't even need large numbers to get people whose lives are made more difficult by technology.


Yes, that is exactly what I want. Life should be much more difficult without the TOTP and backup codes, so much that it takes a great deal of resources to get around it, if at all possible. Maybe even providing heavy documentation such as a Facetime call with various proof so that fraudulent actors are sufficiently deterred.


Dude. If somebody wants into your account specifically, they’ll get into it. 2FA, specifically SMS based 2FA, is really about the provider getting mass compromised because people recycle their password across all their sites.

It great for keeping people using scripted attacks against a huge list of accounts. It isn’t really to keep people specifically after your account out.

If somebody wants your shit and specifically your shit.... they’ll get it...


> If somebody wants your shit and specifically your shit.... they’ll get it...

How? I don't think Brian Krebs has been hacked, even though he's extremely targeted by hackers (his site is literally the benchmark for performing DDOS attacks on).


In a previous job I implemented a recovery page with a long random key (also posted as a QR code) that you could print out and use as an emergency password reset if ever required. You'd scan the QR code and it would take you to a page where you could set a new password directly.

This, coupled with a "I know what I'm doing, never let support reset my password" option that disabled changing the user's password for anyone without direct write access to the production database was pretty good for security, I feel.


There is a reason for that, most average Joes just can't handle the technology. You can change OTP-SMS in Banks for TOTP, but it involves more complexity and probably it will be more prone to user errors.

Configuring the seed, remembering an extra password to use the OTP... For me it's not that hard, but probably my mom will need some help in order to remember all the steps...


So make it a non default option? No one who doesn’t want to use TOTP would even have to know about it.

I know some services require SMS in order to force collection of user’s phone number, for data selling purposes and to prevent bots.


Not long ago I watched a tv show from Spain that wanted to make some awareness about this topic. They bought some fish and prawns and more seafood that should contain "lots of microplastics".

They took all of it to a laboratory and the laboratory found nothing at all. The presenter told the audience that it was surprising for him, and that they thought that the results were a letdown for the purpose of the documentary but that it was "good news" that we can still enjoy food without microplastics...

I would say that the results will vary vastly depending on the place you obtain the samples, but anyway, we should change our relationship with plastic...


Kudos to the show for still airing the episode anyway (whatever their reasons might have been)


Plot twist: the show was paid for by Big Plastic.


So we eat tons of the stuff every year. Now what? Try searching for "what happens to ingested microplastic". To kill the suspense, most everyone looking to scare you with huge numbers also seem to avoid answering that more interesting question. But from the small amount of information that I could gather, I suspect that the answer is too big of a let down (figuratively and literally) to make interesting news. Happy trails to all looking for answers.


Everything I've heard is microplastics can cause infertility.

https://www.sciencemag.org/news/2014/06/can-plastics-cause-i...

https://environmentjournal.online/articles/microplastic-poll...

https://www.theguardian.com/us-news/2019/may/24/toxic-americ...

None of this is conclusive, but there's more and more evidence that microplastics might be causing serious reproductive issues in humans.


The fact that we don't yet know the ramifications, if any, doesn't mean that it isn't a potential problem. This is true for the complex chemical soup that is our bloodstream these days, making any sort of inferences to specific isolates exceedingly difficult and even off the mark.


I'm reading comments and I think some of them are unfair.

First of all, I can see how this functionality is oriented towards the average Joe, not developers, sysadmins or hackers in general.

This helps the user, to an extent, to protect his assets from malware or accidents.

Also, it is undocumented, probably for a reason, this could be an early version that will be evolved and announced once the feel comfortable.


I was asking myself, how would I steal a mattress in a hotel?

Probably buying a new one, the cheapest for the size, I will exchange packaging, make the bed and... profit?

How long till the staff detect it?


Open a window, have your friend waiting down below ready to catch it?


You can open a window in a hotel?


Like many other things, it depends on some combination of which hotel you're staying in and where you are in the world. There are plenty of places that would be suffocating if you couldn't open a window.

That said, if this were my mattress theft scheme I'd probably prefer to source a suite that had a usable balcony rather than worry about the windows.


And then use a pulley to pull up the replacement one?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: