skysight-inc/HackerNews huggingface dataset:
That's a very interesting way to categorize passwords. I wonder if one reason why banks etc. don't auto-generate passwords is to avoid liability: I can totally imagine a class-action lawsuit where a lawyer claims that all the auto-generated passwords were insecure.
This one is new, so they haven't learned all the corner cases that make VoIP more difficult than anticipated.
"There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with an overly creative password."

Indeed and then one's email potentially becomes the weakest link in one's password security.
> You're hashing them anyway right? So the storage doesn't change

No, but the time spent computing the hash does change and you open yourself to denial of service attacks. Just pick a max password length of like 200, or whatever your hashing algorithm mandates (55 for bcrypt).
While the collisions themselves would increase it's not statistically significant to cause an issue in practice. Plus the idea here isn't to increase the strength of the overall construct. It's to ensure that all characters that the user entered have some contribution to the final product.

What I'd consider a much worse issue is considering the following to be the same by silently truncating things:

- some really long password ... that ends with foo

- some really long password ... that ends with bar

- some really long password ... that ends with baz

The only acceptable alternatives when using something like bcrypt are:

- Restrict user passwords to 72 bytes (not chars!)

- Hash with something like SHA-512 prior to passing them to bcrypt.
in japan you can completely bypass them if you just need corrective glasses. result: glasses are dirty cheap.
Good point, the security section could be beefed up some more. Pull requests are welcome :)
> Because hours worked doesn't affect salary.

> Unless we're talking consulting, that's exactly what Salary lets you do.

We are clearly having communication issues and I'm not sure how you are addressing what I'm talking about.

My point is: Work longer -> slightly more productive -> slightly higher pay.

> You're effectively trying to stifle and derail the entire conversation

If the conversation starts from an inconclusive or flimsy premise then it should be derailed.

It is far too easy to make bad decisions based on flawed studies.

> and also that women are reporting under-compensation.

The first step is to work out if it's a real issue we could be, or should be, solving.

It could be a problem worth addressing if the gap was driven by sexism.

It could be a problem worth addressing if the small pay gap was a major contributor to women leaving the industry.

It could be a problem if the small pay gap was a strong contributor to women not entering the field.

It could be a problem if we we were seeing a rapidly widening gap.

Etc etc.

But you have to actually make a case.
Thanks! I'm so excited for Crystal to hit 1.0 and be production ready. May need to try it out now though. Thanks again
> So if the politicians point is that renewables destroy jobs, the evidence does not support this claim.

My point isn't that more people employed = cheaper energy. Obviously that's not how economics works.

My point was, if politicians are advocating for building out more fossil fuels because renewables "take away jobs" that argument has been proven false. [0]

[0] http://fortune.com/2017/02/21/donald-trump-jobs-coal-mining-...
For folks that easily get scared by elisp it would be awesome if there was a possibility to use org-mode from Atom or VS Code. That way someone who is a beginner with not a lot free time can try it out with the "support wheels" of a familiar environment.
>I mean, I can imagine that a clueless user might have the illusion of safety if they're using something like "1q2w3e4r5t" but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother?

It's not an illusion, 1q2w3e4r5t is indeed better than aaaaaaaaa, even if it's just the numbers interleaved with qwerty (and probably easy to brute force generate up to it).

>if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother?

Because not everyone who uses "aaaaaaaaa" (or "1q2w3e4r5t" for that matter) knows "full well" that it's insecure?
I heard that for the first time, so I looked around and found this paper: http://www.cs.columbia.edu/~lierranli/coms6998-7Spring2014/p...

Here the problem seems to be that the base power needed (beta in table 4) is way higher than for wifi.

I wonder if the numbers have changed since 2012 though.
This is why my new server system sends you a password for every login you want to do to your email. Of course you do stay logged on, so it is not needed very often.
I thought the price is twice as low, isn't it a bit to high?
I was wondering this as I read it as well. Yes, we know it would be fairly easy to compromise an individual account by guessing common passwords. But that assumes you have one particular account in mind. If you're just looking for bank accounts to access, you first need a list of usernames to try (ideally usernames of non-tech-savvy people) and then you need to run your entire password guessing routine for each one.

I'm no security expert, but I start to wonder if the "practical" entropy of a given password is actually much higher than the theoretical entropy numbers people derive.

Serious question: when is the last time anyone has had an account compromised because of a weak password?
Marilyn vos Savant, the person with the highest recorded IQ
Thanks for the feedback. Yes, I probably do share too little, and I get too discouraged when reddit downvotes my stuff to oblivion.

> Next time you build a product try to post it online everywhere like Reddit and Show HN. I'm sure you'll gain more confidence and experience from it.

Here's the problem, I never "build a product". My free time is not nearly enough to build a proper product that would a) be fun for me to write b) interesting enough for the general public.

Basically the best I can do is show a few screenshots or a few hundred lines of interesting code. In my experience, that's not enough to gain traction on Show HN or Reddit. Sometimes I share screenshots on IRC and do get some interesting follow-up discussions but that doesn't really help me to get these projects any further.

Maybe I should gather up the courage and start posting to reddit /r/gamedev "screenshot saturdays" threads for getting feedback and encouragement. Although I'm not really doing a game here.

But yeah, I mostly try to not think about the idea that I'll never finish these projects and have fun while hacking on them. I've been doing this for 20 years now and never really "shipped" anything, so I might as well stop worrying about finishing and just have fun.
Dropbox is just an FTP server.

I'm not saying this will be the next Dropbox, but dismissing products so offhandedly because you underestimate the average user's aversion to "writing a few lines of Javascript" is silly.
I unchecked some checkbox at install and have never seen this on my windows boxes.

I can see a philosophical opposition to this stuff, but practically it doesn't affect me at all.
From the cnn article: "Chandrayaan-1 spacecraft is small -- about half the size of a smart car -- making its detection even more noteworthy."

Thank you NASA!
> This one is new, so they haven't learned all the corner cases that make VoIP more difficult than anticipated.

No need to be rude. This is Show HN. Sharing first attempts is the whole point.
As an american living in Paris, I actually think that NYC would be better for vacations. Of course if you really want better for vacations, you go to the american southwest not the northeastern megalopolis.
Freshdesk at Gozoomo.
>I am being serious when I ask this question: does anybody brute force passwords?

Very many people. And not all systems stop them from doing so.

And database leaks happen all the time too...
literally anything, assuming the congressional votes were the same and we ended up with a Republican house and senate. The would try to impeach her from day 1
> If you want employer-funded healthcare to include dentistry, then that's not going to be solved by medical people but the employment market - industries where workers have market power (e.g. IT) will get such conditions, and industries where worker's don't have market power (e.g. fast food) won't.

And how is that anything useful anyway? It's not like dentistry is any cheaper when your employer pays for it. If anything it will be more expensive because of the added bureaucracy and separation of who pays from who benefits. This is one of the reasons costs have spiraled out of control in the US healthcare market. If you need money for dentistry, ask your employer for a raise, not dental insurance.
I am in awe.

We can track objects in space like these - yet we failed to track down MH 370.
"No better program to access email from anywhere than a browser. Have you heard about MUA-s?"

You understand the difference between accessing email and reading email? I'm talking about JavaScript accessing email, and acting on it. You're talking about a human being reading a message.

"Special mails should be used for authentication which would specially handled by the browser accessing your mailbox. This is abusing the mail protocols in my opinion."

We're already sending registration emails and password reset links. We currently have a system where the end user has to read an email and click a link in it. My suggestion would just allow
us to skip the human part and let the JavaScript read it directly, with a perfect fallback built in for people who don't have their browsers configured to have access to their mail.

"Certificate based auth does have something to with this: an existing, partially supported solution for auth with no magic needed and no need to reinvent the wheel, with hacks and extra complications."

Even with certificate based auth, you'd still end up having email involved with registration or password resets in some fashion.
> Ophthalmologists

Doctor

> dermatologist

Doctor

> general practitioner

Doctor

> optician

Not a doctor
> if the user getting their password stolen is not a problem for you because it's not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences. If they care enough about it they'll care enough to pick a decent password.

Surely that's a cop-out? If the user getting their data stolen is not a big deal for you, why bother securing any system at all?

The reason service providers set password rules is because there are many, many people who do not understand what a good password is, or the risks associated with losing them. There are people out there using the same password for everything, unaware that the compromise of one service can spell doom for their financial life.

Developers really need to start taking responsibility for their code. Setting password rules, while arbitrary, are about protecting users. This may upset those who are tech-savvy and know what they are doing, but that really weighs nothing compared to the benefits it brings to those who are not.
> Plus the idea here isn't to increase the strength of the overall construct

I see. If that wasn't a design goal, this construction is sound.
Engineers are the worst at this part of the game. They'll sign anything you put in front of them. At several of the places I've worked, I've been given crap boilerplate forms like that to sign. HR/hiring people will look at you like you're some kind of weirdo if you balk at any of it. Here are the reactions to my reluctance as I recall them.

* One company wouldn't budge. Later, I got a better deal, but it was risky the way I went about it.
* At another company, I just didn't sign it. They didn't stop me from starting work but when the omission was noticed they had an HR person pester me about it a few times. They eventually gave up.
* At yet another place, I crossed out the parts I didn't like. They just kind of shrugged and said okay.

At no time did I ever want anything unreasonable. I just didn't want all the things that I or my descendants designed/built/invented/helped-whatever to be assigned to ['company'] in perpetuity, etc. And I didn't want a contractual responsibility to come and defend patents in courts, or give depositions at my expense.
Cool!

From my cursory reading, it doesn't seem like you can rotate keys, though.
I mean you get appraisal A (original house), then you know what additional profit and features to add to get appraisal B. There is a lot of slack in the remodel business and economies of scale to exploit so you can probably guarantee a nice return. Especially if you can guarantee a pool of work to contractors (start with having them bid on it and then maybe get a few in house contractors). You can probably get exclusives on materials as well.
I just installed this last week and couldn't be happier with the Keychain product.

However I installed it with Homebrew and the Mail integration seems to be missing. Does anyone know why that feature isn't installed in the Homebrew version?
Somebody got into my bank account and attempted to steal some money. Luckily, we were able to stop it quickly and the bank had the money back in our account the same day. It was pretty upsetting so I sent a letter to them with a lot of questions about their system and eventually somebody from the inside called me.

One of the questions I asked was why they limit password length. The (low) limit suggests that they were storing the password rather than a hash of it. They wouldn't confirm that was what they were doing, but their ultimate answer to me was stop worrying - you aren't responsible for fraud.

I also asked for a list of all the external IPs that had accessed my account and I couldn't get that for privacy reasons. I'm not sure whose privacy they were worried about, but I guess it wasn't mine. In the end, it was an incredibly unsatisfying exercise.
Weird, I developed so many side projects. But my most successfull one is a webshop which I configured in woocommerce with 1 product in it
Its not "Australia's" Power problem, its the state of South Australia...
I was trying to sign up to an online gaming site recently, and my initial password was shown as being "strong" but was rejected — not enough "special" characters. It was 24 chars long and straight out of Keepass, but whatever.

I asked Keepass for another password; it included special characters, was 24 chars long and "very strong", according to the website. Rejected.

I then noticed that the message was telling me I could not have more than 16 characters, so I trimmed the password to something rated as "medium". Accepted.

So yes, password rules are bullshit.
> it's not that they're going to finally fully document the Win32 API (their online documentation is quite often inaccurate)

Okay, this is tangential to your point, and I'm no fan of Microsoft's, but I really have to defend MSDN here. MSDN is by a wide margin the best and most complete API documentation I've ever seen. Yes, it's wrong sometimes, but that's because it fucking exists. Almost every function, and certainly every function a typical developer is going to care about, is documented. Even crazy obscure shit like wmvcore COM interfaces[1]. You don't even know what that is, but look at all that fucking documentation! Oh my god. My life would be so much harder as a Wine developer if it weren't for MSDN. Every win32 API developer at Microsoft deserves a gold fucking star for actually writing documentation. They certainly don't deserve chastisement for not being perfect.

[1] https://msdn.microsoft.com/en-us/library/windows/desktop/dd7...
I wonder it who designs those rules, in general, notices that when you require "at least one Uppercase" people will just press shift for the first letter, and when you require "one number" people will suffix or prefix the password with the number "1" [0]. And I don't know how that would increase security.

[0] for example: http://www.the-interweb.com/serendipity/index.php?/archives/...
Hm, I think I read about someone going back to Windows from Mac because of that. It was quite popular here on HN, were you the guy?

I will have a look at the Linux Subsystem anyways. Can´t be wrong to check that.
don't forget infowars
Not mentioned:

Password reuse across sites.
Have some check as to whether the same password can be used for the same username / email across other sites. I discovered this one early; back in 2000 I was an admin for a student portal at uni created by Virgin. As an admin I could manage people's accounts; including reset their passwords. The field for me to change their password had their current password; it was hidden by asterisks so I couldn't see it... until I clicked view source on the site :/. So now I had everyone's passwords & their email addresses; my guess is I could have taken advantage of this for at least 80% of those accounts.

Password change frequency.
Changing your password can be annoying; but there is some benefit (so long as you're not changing too often).

Password reset rules.
If you click "forgot password", many sites still use the memorable question with questions which are often publicly available (e.g. to get someone's mother's maiden name, this information's on the public record, and can often be found through someone's social media too by looking through their contacts, then the contacts of those sharing their surname; as their mother's maiden name will match their uncle's surname, and most people with their surname will be friends with both their mother and their uncle). Emailing a reset link is great; but relies on email which isn't (and some people's mail's very unsecure; e.g. company mail can often be legitimately viewed by the company's IT team; and that's the non-hacky scenario).
How I Made the “Fastest Interactive and Scroll-Animations Website”, Ever
> woman kissing woman - 7 codepoints, woman + ZWJ + heart + ZWJ + kissy lips + ZWJ + woman

LOL, I knew about the crazy flag characters, but I had no idea it was this bad. Does "woman + ZWJ + heart + ZWJ + hands pressed together + ZWJ + woman" become "2 women lovingly holding hands"? Unicode has become completely absurd, and I am grateful every day that I'm not one of the poor coders having to implement it.

Humorously enough, input methods have not advanced at all. To type any of these things, I need to open a character picker, then either type in the character's name if I know it, or scroll through pages of symbols until I find the one I want. Yet we still call this "text."
Ruby together: Community funded developer infrastructure
In a properly working market, at the point the power grid fails due to lack of supply, the spot price should be infinitely high.

Given that, no sane supplier would refuse to sell given they would be making unlimited profit. Hey, I'd be connecting up my windup flashlight if I got paid $999,999,999 per kilowatt hour.

The issue must be a bad market. Either people aren't paying for what they use, there isn't sufficient transmission capacity to have a sufficiently large market to avoid local monopolies, there are price caps or floors, the market isn't fast enough (no automated trading), or new entrants are limited from participating.

In a correctly working market, electricity never fails because all people using electricity at the time of the failure would be paying an infinitely high price, and therefore be bankrupt.
This is why passwordless designs are best and why I'm building new things without passwords.

I think the future will be passwordless with biometric as a added layer of safety.
Preventative care isn't really insurable though.
Styling Angular Applications with Angular Material Udemy Course
> 1q2w3e4r5t

"COMMON PASSWORD: IN THE TOP 9635 MOST USED PASSWORDS

Your password is very commonly used. It would be cracked almost instantly[1]"

I do realise there's a difference between cracking a local system password vs a website password but always assume a site's database is going to be leaked at some point

[1] https://howsecureismypassword.net/ (Don't go putting real passwords in there..)
I agree that compile to binary languages are better for distribution, and has always been a pain point with interpreted languages like Ruby. Ruby actually does this better with its ecosystem (RubyGems, Bundler) than a lot of other mainstream languages.

Just to nitpick, capturing STDOUT is not that hard in Ruby at all. Definitely not as easy as Stdio.capture, but Ruby gives you a variable called $stdout, which you can assign to local variable and treat it like a file. If you would rather not print messages out during the test, then you can just temporarily assign $stdout to nil.
>We're going to need a new word for resolution at depth.

Well then I have good news for you - we already have a metric for resolution irrespective of the depth at which an object is rendered, and we've had it for years. That metric is Pixels Per Degree (PPD). PPD complements the way the eye resolves images (visual acuity) and is independent of depth. ~62 PPD is generally the maximum resolution of the human eye - although motion/shapes/contrast/color can alter (increase or decrease) this threshold.

PPD takes into account FOV, binocular overlap, and rederable pictures - all in one clean metric.

The truth of the matter is that when companies use this standard unit such that all AR/VR display resolutions can be compared on an level playing field, that tends to lift the veil that is obfuscating how poor the actual imaging resolutions truly are.
yep just something simple but healthy, there you go https://en.wikipedia.org/wiki/Nutraloaf yum :D
I think you're right, but the Doom name has a lot of marketing value.
Okay, I'm game: HHHnHHHHnHHHHHnnnnnnnnnHHnnnnnnHHHHH

It's a password that I postulate is more secure that the average and yet is only made of two different symbols and would've been rejected by the proposed "x amongst y" character policy.

It's a bit far fetched but not that much, you'll notice that the pattern is simply the first digits of pi, so it's fairly easy to remember. And the letters are "Hn", like hacker news.

That's my point, really. If you think you know better than the user how to pick a password, then just do it. Otherwise don't get in my way, you don't know how I generate my passwords.
Interesting, it does look great! I'm curious, how do we keep the MkDocs project updated as the guide evolves?
I don't know, man. I did not have the same experience as you
Who cares about remembering passwords? Like my burner mobile phones, I use burner passwords. I use a one time password and the next time I need to log in to the website, I request my password to be reset and use the link that is emailed to me...
You know, there is one thing I don't ever want to happen: to have JS running in my browser access to my emails and act upon that automatically.

This has way too many security implications which don't make it a reasonable idea:

1. If sites can set up such action, then for that (I don't trust anybody's site to have any form of Access to my emails, except my mail providers per se),

2. if the browsers supply these actions, then for that cause (it would be exploited, or if it would be perfectly secure then it would also be perfectly useless).