skysight-inc/HackerNews huggingface dataset:
This article includes some good points, but puts them together into something inane. It's true that silly constraints lead to trivial changes that lead to crackable passwords. It's also true that assuming brute force over all character classes included in a password is wrong. Those are precisely what the "correct horse battery staple" comic was getting at. Picking words at random (that is, based on a PRNG - not "random" meaning "arbitrarily, by hand") from a dictionary, brute force over that dictionary is the best an attacker can do, and the (dictionary size ^ number of words) calculation is a correct measure of entropy, and with sufficient entropy no passwords will be duplicated. The "correct horse battery staple" hypothesis is that this gets a better score on "entropy per difficulty memorizing" than generating passwords by drawing randomly from a dictionary of typeable characters, and I find that to hold - it's also easier to type actual words.

The other odd point is that we shouldn't be advocating stronger methods of choosing passwords because we should be using multifactor authentication. I don't dispute that we should be using multifactor authentication in more places, but even in that case weak passwords are a problem!
I would think that in an ideal world the old device would sign a statement indicating that the new device has full authority to act on its behalf in the future.

In a less-ideal world, it'd be nice if there were a way to sync devices without having to trust an eminently untrustworthy second party.
I don't know how to read that definition - it contains more legal jargon. What is "received for use by an employee"? When are electronic communications "processed into intelligible form"? Is a server that stores and processes data an employee?

And for 100% sure PRISM received and stored mass data about American communications - both internet records and phone records. There's no debate about that. There was even (faux) legislature proposing moving the storage site from NSA hands to partner hands.

These articles seem like minor quibbles, mostly to do with terminology, but not the broad implications of the program.

There are so many damning slides. Like...

"Of these 1,789 applications, one was withdrawn by the government The FISC did not deny any applications in whole or in part." (42)

"With all querying if you discover its in the US, then it must go to the OSC quarterly report... 'but its nothing to worry about'" (99)

http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPl...

Looked quickly through the articles, not sure if I saw anything really damning - they seemed like minor quibbles.

I must depart for non-tcp-mediated social obligations and consider this an incomplete reply - apologies for that. Hopefully the thread is alive later, and another poster can fill in the conversation here as it evolves. Adeiu.
Yeah, I get why he was trying to tie his point to something well-known. But I found the title maddening. If he had said, say, "Why horse battery staple is solving the wrong problem," I would have read his article with interest. But my increasing irritation as I waited for him to deliver on the promise in the title kept me from properly appreciating his point.
So this looks like a dating site for advertisers and those who are willing to provide some advertising space on their t-shirts. Seems to me, not a very new concept. But somehow, I find it less humiliating then when people are dressed as mascots for some real-estate agency. Decency preserved.
Why does it seem like such a remote possibility that Laura Poitras would be letting Jacob Appelbaum have access to the Snowden documents when the two of them have worked together on post-Snowden NSA reporting?

An example: http://www.spiegel.de/international/world/the-nsa-uses-power...
The Awesome Reading List
You're right, there's no way to be completely certain. It's like the adage: "Two can keep a secret, if one of them is dead." When someone else has access to your data, there always exists the possibility that it can be used in some way you don't like.

What I wanted to convey is that user data was not used (at that time) in an untoward fashion by Dropbox. Everyone that I worked with took privacy and security very seriously, and we knew that user trust is tough to earn and easy to lose. Handing data to the government automatically, without a warrant or confirmation of authority, would not have been something that anyone was interested in doing. But the government does have ways of making you do things that you don't want to do (see: Yahoo).

The biggest problem that I have with all of the Snowden revelation stuff is this: people seem quick to blame the companies who are complicit rather than the government who is the root of the problem. The government's efforts against security and privacy are the biggest threat the technology industry has ever faced, and if left unaddressed I believe it will inevitably lead to the US losing it's leadership position.

One last point, regarding Dropbox's CFO. Sujay had been at Dropbox for over three years (since 2010) and was involved in the CFO search for a long time. That they picked him for the role says a few things, but I don't see it as Condoleezza stacking the deck.
What's the shortest business plan you've ever received?
How many pages? Was it any good?
Linkbaity title from a PhD student with something to sell: the example cited was entirely correct about password strength, and is something the article author admits is important as it is the underpinning of using password managers.

> Even if we entertained the XKCD comic and started training users to select four random words instead of a complex single-word password, I argue that it would not amount to a significant increase in security.

> People are not very creative and tend to think the same way when choosing passwords.

He also completely strawmans the XKCD example: it's not that you should pick four words yourself, it's that you should use four randomly chosen words (using an RNG/PRNG). In this sense, we're just picking fewer random symbols we have an easier time remembering out of a larger symbol space, but this is functionally equivalent to picking passwords of random characters. That was the point of the XKCD comic - that a random chosen password is stronger than your l33tspeak choice of a word or two.

> This means that we should stop blindly classifying password strength based on the number of bits of entropy3, and should consider first and foremost how dictionary-attack resistant the passwords is.

If you look at the right number of bits of entropy, then you get this property: a lot of entropy in the password means that the subspace of passwords it lives in is large, and that a dictionary probe of the space is unlikely to find it quickly. Dictionary attacks are just a particular form of brute force that prioritizes some kinds of passwords over others. In the case you actually followed the XKCD example, you'd have good resistance to dictionary attacks: your password is randomly placed in a large subfield of possible passwords, and the randomness removes any benefit of guessing particular words over words at random.

He's still sticking to the strawman version of the XKCD comic, and attacking a much weaker idea than was actually presented.

> This means that instead of a password strength meter you should be ensuring that there is no skew in the distribution of passwords. If each password is guaranteed to be unique, the advantage of a statistical guessing attack is greatly reduced.

He even admits that the solution actually proposed by the XKCD comic would mitigate the attacks he's talking about, and only his strawman version doesn't.

The rest of the article is obvious security cliches about password managers and 2FA.

I seriously suggest that this guy stop giving security advice that's wrong and clearly just meant to market his own work.
So I've got a question. Isn't using a password manager with unique, big, long, randomly generated passwords per site essentially the same as two-factor authentication? Something I know (the master password) and something I have (the encrypted password list). The password list lives on my laptop, on my phone, etc.
Furthermore, when I use 2 factor auth, I end up storing the lose-your-phone recovery password in the password manager anyway, so I'm probably missing the point of the SMS-, token- or Authy- based validation anyway.
"I'm an age bigot." - Ron Conway

A horrible attitude - one I thought was receding. To actively promote it is quite disturbing to me.
It seems like the major gripe is against passwords like "p@assword", not against passwords like "correcthorsebatterystaple".

If you truly choose 4 words randomly, the number of possibilities is > 1e24 (at least 1 million words in english language, likely not including slang or names).
You may have stumbled upon a strategic product category: VB6 like development tools compiling to iOS Android and web, backed by Office, Azure and other Microsoft software and services. Has the potential to get businessesand developers back onto the Microsoft platforms.
The unusual number of complaints on this thread were actually because of a bug causing a bad experience. This was our fault and it has been fixed.

We don't mind the change of link - we just want knowledge shared on Quora to get to as many people as possible and we don't mind if it happens on other sites. But I wanted to let you guys know that this was a bug and the behavior is back to normal (nothing with share=1 will ever require viewers to sign in / trigger this level of complaints). There can be so much negativity here that it can be hard to tell the difference between general hate (as radmuzom suspected) and a real problem, but in this case it was a real problem.
There will always be legal loopholes that allow federal prosecutors to try someone in a state in which they never set foot, and they'll always have the funds to put together a pro team that's smart enough to convince a jury that you're worse than Hitler because they're the friggin' federal gov't, and even if you aren't already bankrupt, they can freeze your accounts so you can't pay your own team.

The fundamental problem is their incentive for doing this, which is based entirely on convictions and time behind bars, and has nothing to do with fairness. I don't claim to know what the _right_ basis for prosecutor incentive is, but I do know that if it's throwing people in jail, we end up with a lot more people in jail (which has happened/is happening in the US).
You want the spaces. Leaving them out leads to collisions, which burn entropy.
Agreed.

The article did stem from me reading blogposts where people were interpreting the XKCD comic into: just chose four words instead of one password.
We can consider it incomplete, or disagree with the design choices, but broken means it doesn't do what it's supposed to do. Here, it does everything the author intended it to do, and everything the description says it does. When you say it's broken, it sounds at least to me like you're imposing your own requirements on a project you have nothing to do with. It's like calling Microsoft Office broken because it can't handle Open Office files. It's not broken, it just doesn't have all the features you would have included.
Seafile is great if you dislike SpiderOak's closed-sourceness. Open source android and desktop clients, client-side encryption, can start with a free service then move to self-hosting when you're so inclined.

imho, it's the best option until we get a good user-friendly decentralized offering.
How do you still not understand this is not practical for majority of people?

The solution isn't "just ride public transportation".

The solution is less polluting vehicles, ie. hybrid/electric cars. More efficient roadways (ie. "smart roads"), etc.
This idea is not viable as far as I can tell... Besides the obvious flaw of this service (it is a centralized business, which compromises most of the benefits a decentralized currency like Bitcoin has to offer) there HAS to be an objective way to determine whether a person is fulfilling their obligation to wear the tshirt. The only way I can think of to do that is to have "eyes on the ground", a second group of people who are "verifiers" who monitor the "badgers", and who are independent contractors willing to accept a very fluid employment arrangement... at this point you are sort of hamstrung with bitcoin because it has no significant smart contract system to encode the responsibilities of the various parties (the verifiers, badgers, and badgerhunt.com)

Until a cryptocurrency-based smart contract system becomes established (such as ethereum or codius) I just don't see how this type of business idea is going to be feasible (but certainly the roads of silicon valley are paved with the bodies of people arguing this or that business model is never going to work :-)
"The wicked man flees when no one pursues."

If everyone was constantly breaking the law then there would be no known criminals who haven't been arrested. There would no John Gottis or Whitey Bulgers. As soon as the government wanted someone arrested, they would just immediately arrest them for breaking copyright law or whatever. No need for the FBI to meticulously build cases, we're all guilty all the time and our only hope is to boycott Dropbox.

And if the government suddenly decides to start enforcing ex post facto violations of the law, we're all screwed anyway. There's no point in living your life by being afraid of what might be in and out of fashion in the future. If the government decides to start arresting people who have broken existing laws (not to mention future ones) there there are literally millions of people who have openly admitted to doing drugs or otherwise violating existing prohibitions. I can't think of many cases where the average citizen was prosecuted because they admitted to a minor crime on facebook, not to mention any cases where the government changed their minds on the law and started going after people.

I live a normal, boring life and do normal, boring things. I'm not going to get arrested for eating fast food while watching reality tv, or drinking beer and watching sports. I don't do anything that harms (or helps) anyone else, I'm the average American. I have nothing to hide and absolutely no fear of government intelligence collection.
I'd genuinely like to know (and I promise that I'm not going for a vi/emacs discussion), why don't more people use KeePass? Specific to asking you, did you know about KeePass and, if you did know, what turned you away from it? It is both open source and free and, from what I've seen, has a good number of clients.

Maybe I'm barking up the wrong tree and the marketing or brand awareness of LastPass and 1Password is much higher than I suspect.
Where on earth do you travel if you have to go on antibiotics, just for traveling? Some people get a little sick from the different kind of bacteria cultures in different part of the world, but not something a doctor would put you on antibiotics for. A lot of people die every year for taking antibiotics they didn't necessarily need to take, so if your doctor prescribes antibiotics for a simple "vacation stomach", I'd change him or her out pretty quickly. [1]

[1] http://www.nytimes.com/2012/05/17/health/research/popular-an...
One thing I found a bit alarming is that the FAQ page says advertising funds are held by the site. It's good they realize the threat though and say a multisig solution will be rolled out. I hope this multisig solution will be rolled out quickly, otherwise I don't see big advertisers trusting the site with a lot of money.
When Keurig fights “coffee pirates,” who loses? Loyal consumers
Here is a non pdfy link: ftp://ftp.cs.cmu.edu/usr/jcr/gedanken.pdf
ReportLab.
I would argue that most of the value of those companies was created post-bubble.
I agree that the title is more link-baity than it should. For what it's worth, part of it was just a witty title.
I disagree. I think he was trying to be too clever.

The law in California, according to what I read here, is simple: building these things for use in drug activity is against the law. The reasonable man test is essential to the integrity of our legal system. And if you have a couple street thugs with $800k stuffed in their hidden compartment, a reasonable man would know exactly what they were up to. But they offered him more business. He gambled, and he lost.

Though I do find the sentence far too harsh. Give the guy 5 years.
We are actively working on a multisig scheme where advertisers won't need to trust us with the money and we will only act as a pure middleman, signing transactions when the campaign is completed. The scheme is relatively well know at the present stage of Bitcoin development, but it still takes some time to implement right. We ourselves are not interested in holding other people's funds, it's dangerous.
These are not equivalent scenarios. They are all one-shot deals and, significantly, there isn't an obvious connection between the sale and the law-breaking. They could probably be altered to match a little more. Here's my take on the third:

You sell special hunting rifles that are designed to kill elephants. Sometimes people need them for self defense, you say when people ask. You insist that purchasers not mention that they will use them to hunt protected species, especially elephants. One of your clients asks you to come out to the field to repair his gun. While there, you see a stack of elephant tusks in the back of his truck. You tell him to get them out of there. Then you sell him and his friends more guns over the next year. They are caught and convicted of poaching, and then you are too.
> What is there to prevent “letmeinfacebook” from being the new most common four word password for Facebook accounts?

This comment suggests the author doesn't really understand the XKCD password scheme. The point is to choose four random words, not the first four words that pop into your head.

Also you cannot rely on an automatic-password-checker to tell the user their candidate password is weak: If it flags 'password1' as a weak password the user will just switch to 'password2' and that will become a common (ie. weak) password, at least until the password checker's database is updated.
A previous discussion of the game in a different article:

https://news.ycombinator.com/item?id=7719520
Sorry for the late reply, but I think the difference of being able to regulate my level of attention, ie, browsing the internet when the lecture is particularly dragging, being able to look things up when I get confused, etc actually make it easier to focus on the large majority of the lecture. By being able to take quick mental breaks, and not having to expend full focus when, eg, the professor is belaboring the part of it that I already know because other students did bad on the quiz, for instance, actually makes it easier to stay fresh and focused during the other parts of the class.

Self-regulation, even if you end up doing mostly the same thing, is substantially different from being forced to do it continually, at least in terms of the mental strain it places on me. I always got much more out of long lectures where my attention sort of wandered in and out, and was punctuated by a mixture of doodles, thinking about other things, and sharply focusing on the key points and arguments. Let's not pretend every word out of a professor's mouth is golden, and the students are going to be seriously disadvantaged if they miss a few here and there.

Part of the disservice we're doing to high school students is that we're not actually teaching them to self-regulate in a useful way: we're teaching them to do all or nothing.
And even 7zip's AES implementation is hand-rolled, iirc, so I wouldn't exactly trust it with my life.
Exactly. Ironically it's good advice for master passwords too.

I use a password manager, but we should recognise there is one prominent issue with them, in that they create a single point of failure. The article suggests that the strength of algorithms like scrypt will keep you safe, but that doesn't stop low tech hacking methods (key loggers, shoulder surfing, etc...). We should be looking at using master passwords in conjunction with hardware dongles, if we really care about maximising security.
I think fufilling a lifelong dream to play pro football and the minimum salary of $420,000 explains why there are thousands of people lined up to take these jobs despite the well known health risks.

BTW - The incidence of alcohol related arrest for NFL players mentioned, while in my opinion excessive, is probably below average for young US males which is prob over 2% per year for DUI alone. What's amazing is how common this is in general - 1 in 139 licensed drivers each year are arrested for DUI.

http://www.duifoundation.org/research/facts/
At the moment, the Apple business model is far out in front of the Microsoft business model, from a sheer profit perspective.
FWIW the "spawn pop ups whenever you click anywhere on the page" was a bug that was fixed.
Not under any program. None of Snowden's documents show that the US government has the access you think they have, and all the companies involved and the government have explicitly denied it. You're going with Greenwald's misinterpretation of a slide against all evidence to the contrary.

Regarding Greenwald's incompetence: https://docs.google.com/document/d/1N0dRIEqagB9V4ipNMdT3q8h4...
The truncation was a bug that was fixed. Sorry about that.
I loved the first book, and hated the rest. I got as far as half-way through Heretics of Dune when I suddenly asked myself, "Why are you still reading this?" and stopped.

I've since re-read Dune three or four times (most recently by way of an excellent audio-book version).
> You modify a car for better speed and handling. Later it gets used to rob a bank. You go to jail.

People modify cars for speed all the time. Most of them hoon around tracks or country roads, which isn't a crime - or, at least, is nothing more than a traffic ticket.

> You download Tor for a friend of a friend. They use it sell drugs online. You go to jail.

People use software to protect their anonymity all the time. Some just don't like the government, others don't like to respect copyright. Not a criminal matter either way.

> You sell someone a special hunting rifle (out of season). They use it for poaching. You go to jail.

People collect guns all the time. Most of them shoot at paper or clay pigeons or hoon around on the firing range, which isn't illegal.

These scenarios compare pretty poorly to what we've heard the person in this case did: he, for years, aided drug trafficking. In the first paragraph he admits to knowing this - when someone pays you money to install an ultra-secret compartment in your vehicle, and when you pull out nearly a million dollars in cash while trying to fix it, you damn well know what's up.

If I tune your car up, my expectation isn't that you're robbing a bank. On the other hand, if you bring it for repairs and I discover the problem is twenty bags of sequential bills in the trunk throwing off the suspension, my expectation is going to change pretty quickly.

The law isn't a magical thing that you can circumvent with the right incantations, nor should it be. It's better to have this flexibility, not worse.

ED: This is a controversial comment, which surprises me a bit. Let me add I'm not much of a fan of the war on drugs. But my central thesis is that allowing the legal system to apply a dose of common sense prevents such things as mandatory minimums and blind sentencing, which is a good thing all around.
/u/tuhdo made a gif screencast http://www.reddit.com/r/emacs/comments/2ixp7m/pdf_tools/cl6n...

other comments may be useful to build http://www.reddit.com/r/emacs/comments/2ixp7m/pdf_tools/