Gavin Williamson has done another whoopsie – politicalbetting.com
Comments
-
Good post. This is also basically my perspective on the situation.Selebian said:
Have had similar discussions (name change wasn't considered though!) as a relation of mine - some kind of cousin? cousin's son* - apparently told his mother that he considered himself a girl and started dressing in women's clothing. This was some years back; I'd had little contact with him and only sporadic contact with his mother although both came to our wedding. She had effectively disowned him, which horrified my wife and I and led to the discussion.Philip_Thompson said:
My wife made an interesting point to me the other day - she said that she'd have no objections if either of our girls decided they wanted to be or are boys. But she would have an issue with them changing their names, that we spent a long time picking their name for them and that it'd be upsetting to have that name discarded.rcs1000 said:
We have a friend with a 13 year old daughter. Said daughter has decided she's now a boy and wants to be known as "Norman".Sandpit said:
Welcome to California!rcs1000 said:
Times change.TheScreamingEagles said:
All man, well he was when I met him in 2015.CorrectHorseBattery said:I might be wrong but I believed Foxy to be a woman? Many apologies if I am wrong
I always find it polite to make sure that I am not misgendering people, so I like to start each conversation with "[x], how nice to see you. Tell me, how do you self identify these days?"
Of course, there are limits to this. One shouldn't ask more than once (or at most twice) per day.
The funny bit is that when I call her by her birth name, she's totally OK with it. Doesn't seem to bother her in the least. But when her mother calls her by it... it's breakdown from hell.
And this makes me think that (in many cases) this is all a part of teenage rebellion. (And the fact that the parents did saddle her with a rather untraditional name. And this might be a little bit revenge for that.)
Perhaps if someone switches their gender, their parents should pick a new name for them in their new gender, instead of picking their own?
These are big decisions though, we'd support our children, but I'd certainly be concerned that it might be a manifestation of a different mental health issue and we'd try and work through that. People with gender issues are of course real and should be supported, but I think that there is a danger that people with mental health issues can latch on to anything more tangible as a cause and solution. The treatments have long term implications, even delaying puberty, so it's not s decision to be taken lightly particularly when there is a risk that the real underlying issue is different.
I hope that if we ever get to those issues (our eldest is only 3) they will be much better understood and the services much better.
*I'm using male terms as he was a boy and identified as such when I knew him. I don't know the situation now - the mother cut off contact after I expressed the opinion that she was doing the wrong thing and all I ever had for him was an email address - we emailed to offer support/a friendly ear if needed, but never heard back.
What I would also say is that, in this day and age; if you disowned your children for this, then you would find yourself socially ostracised and probably cancelled. It isn't an option.0 -
1% lead for the Conservatives on the latest Nanos, 32.6% to 31.6% for the Liberals.Andy_JS said:Two of the Canadian pollsters have the People's Party on 7.6% and 7.9% respectively, ahead of the Greens and the Bloc Quebecois. The other pollsters have them much lower though.
https://en.wikipedia.org/wiki/Opinion_polling_for_the_2021_Canadian_federal_election#Campaign_period
Trudeau ahead as preferred PM on 29.9% to 26.3% for O'Toole
https://nanos.co/wp-content/uploads/2021/09/2021-1947-ELXN44-Nightly-Tracking-Report-2021-09-07vR61.pdf0 -
Britons oppose the decision to suspend the triple lock 32% to 22%. Tory voters split, 34% in favour, 35% opposed.
Only 18 to 24 year olds in favour of the suspension
https://twitter.com/YouGov/status/1435635557745504257?s=200 -
What would she have to do to not keep getting promoted/kept on?TheScreamingEagles said:Dick in!
We're all getting two years of Dick.
Priti should be sacked for this.
The head of the Metropolitan Police is expected to be given a two-year contract extension within days after weathering a series of controversies.
Dame Cressida Dick’s position has been questioned in recent months after a sharp rise in teenage murders in London, allegations of institutional corruption at Scotland Yard and the arrest of an officer for murdering Sarah Everard.
Though the deal has yet to be finalised, Dick, 60, is thought to have secured Home Office backing to stay on as Britain’s most senior police officer and the extension could be announced as early as Monday, sources said.
https://www.thetimes.co.uk/article/dick-to-get-two-more-years-as-met-commissioner-bb3t6sb8n0 -
(over-simplified, but you still might regret asking - and I might get corrected by an actual expert)Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Competent password management on a site means that the password is never stored, only a hash of it (which converts the password to a seemingly random - but in fact reproducible for the password - string of characters of uniform length).
When you log in, the hash of what you type in is compared to the stored hash to verify your password. If it matches, then you're in.
Insecure hashing methods (see md5) are open to manipulation so you can find collisions - i.e. different inputs that give the same hash. There are also tables of hashes of popular passwords available online - e.g. hashes of 'password'.
So, if RCS chooses a password that gives the same hash as 'password' anyone hacking PB.com for example and recovering the hashed passwords will think that RCS's password is in fact 'password' by looking it up in such a table) even though it is not. The joke is that becuase only hashes are compared, typing 'password' to log in to PB.com will get you in, as the hash matches the hash of RCS's password. Likewise on other sites, where his other unique passwords will all have a hash that lets you in if you enter 'password' as the password*. So what RCS does would make his accounts completely insecure*. Also very computationally intensive (if possible at all, depending on hashing method) to generate on demand passwords that will have a hash that collides with (matches) the hash of 'password'
*note, this shouldn't work in reality as sites should also add their own random strings to the passwords before hashing, so that the hashes for 'password' on PB.com and on google.com for example should not be the same4 -
% who agree [X] would be a better alternative for funding the NHS+social care than the gov's current plan of raising National Insurance:
Raising capital gains tax: 43%
Raising income tax: 27%
Cutting public spending: 22%
Using more money from the estates of individuals: 18%
Raising VAT: 16%
Borrowing more: 13%
https://twitter.com/BritainElects/status/1435629242969116675?s=20
https://twitter.com/chriscurtis94/status/1435602395908739072?s=200 -
And 45% D/K which is not surprising as how many really know about the pensioner triple lock, unless they are pensionersHYUFD said:Britons oppose the decision to suspend the triple lock 32% to 22%. Tory voters split, 34% in favour, 35% opposed.
Only 18 to 24 year olds in favour of the suspension
https://twitter.com/YouGov/status/1435635557745504257?s=200 -
He was completely obsessed with becoming a girl, told all his relatives, asked to try on his Aunties clothes even though she is a size 10, and just like that the desire disappeared.TOPPING said:
I have a friend (a lot of "friends" here on PB on this subjectNerysHughes said:
My friends son who is a 6ft 14 year old, probably weighing 13 stone told his mum at the start of the year that he wanted to wear womens clothes. He said that they had been talking about gender in class and he said he might want to be a girl now. She dealt with it brilliantly and just listened to him without judgement. It was all he could talk about for a month and they were at the stage of a shopping trip to get him a dress. Then one day he came home from school and said he did not want to be a girl anymore and that was the last she heard of it.kle4 said:
I doubt it is 'all' that in all cases but at times it might seem a bit trendy. I think there was a phase where celebs used to cavalierly say they were bi, which probably annoyed actual bi persons.rcs1000 said:
We have a friend with a 13 year old daughter. Said daughter has decided she's now a boy and wants to be known as "Norman".Sandpit said:
Welcome to California!rcs1000 said:
Times change.TheScreamingEagles said:
All man, well he was when I met him in 2015.CorrectHorseBattery said:I might be wrong but I believed Foxy to be a woman? Many apologies if I am wrong
I always find it polite to make sure that I am not misgendering people, so I like to start each conversation with "[x], how nice to see you. Tell me, how do you self identify these days?"
Of course, there are limits to this. One shouldn't ask more than once (or at most twice) per day.
The funny bit is that when I call her by her birth name, she's totally OK with it. Doesn't seem to bother her in the least. But when her mother calls her by it... it's breakdown from hell.
And this makes me think that (in many cases) this is all a part of teenage rebellion. (And the fact that the parents did saddle her with a rather untraditional name. And this might be a little bit revenge for that.)
He has no feminine traits whatsoever so I just assume ot was a cool thing to say at the time.) who's child (13yrs old) is either a boy who believes they are a girl or a girl who believes they are a boy. I met his child last year at a party - hold on must have been two years ago - and the child was dressed androgenously. I recently saw a picture of them in their new (senior) school uniform and I couldn't remember/work out which way "round" the transformation was.
I do know that the school (old style public school) was pretty accommodating given the androgenous uniform the child was wearing.
I don't for one second think they are doing it because it is "cool". Although I'm sure some are. Convinced or confused would be my guess at it.0 -
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...4 -
Thanks for that. Terribly written for passing straight to the Board, but makes some good points well enough to be a reference document.DecrepiterJohnL said:Re computer security. The Register this week published an interesting, non-technical article about responding to ransomware attacks. You do have a plan, right?
https://forums.theregister.com/forum/all/2021/09/06/what_do_do_when_hit_by_ransomware/1 -
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...1 -
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...1 -
I was there thinking, this is Robert making a clever joke right? Or am I just an idiot. And thus, I said nothing.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...2 -
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...0 -
Which means the media reaction over the coming days and weeks, is going to be important in the polling.Big_G_NorthWales said:
And 45% D/K which is not surprising as how many really know about the pensioner triple lock, unless they are pensionersHYUFD said:Britons oppose the decision to suspend the triple lock 32% to 22%. Tory voters split, 34% in favour, 35% opposed.
Only 18 to 24 year olds in favour of the suspension
https://twitter.com/YouGov/status/1435635557745504257?s=20
99% of non-retired people probably don’t understand the full extent of the proposals.1 -
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...9 -
I think sensible schools are aware that in some cases it is a rebellion / phase, and in some not. So they accept as is sensible and see what happens.TOPPING said:
I have a friend (a lot of "friends" here on PB on this subjectNerysHughes said:
My friends son who is a 6ft 14 year old, probably weighing 13 stone told his mum at the start of the year that he wanted to wear womens clothes. He said that they had been talking about gender in class and he said he might want to be a girl now. She dealt with it brilliantly and just listened to him without judgement. It was all he could talk about for a month and they were at the stage of a shopping trip to get him a dress. Then one day he came home from school and said he did not want to be a girl anymore and that was the last she heard of it.kle4 said:
I doubt it is 'all' that in all cases but at times it might seem a bit trendy. I think there was a phase where celebs used to cavalierly say they were bi, which probably annoyed actual bi persons.rcs1000 said:
We have a friend with a 13 year old daughter. Said daughter has decided she's now a boy and wants to be known as "Norman".Sandpit said:
Welcome to California!rcs1000 said:
Times change.TheScreamingEagles said:
All man, well he was when I met him in 2015.CorrectHorseBattery said:I might be wrong but I believed Foxy to be a woman? Many apologies if I am wrong
I always find it polite to make sure that I am not misgendering people, so I like to start each conversation with "[x], how nice to see you. Tell me, how do you self identify these days?"
Of course, there are limits to this. One shouldn't ask more than once (or at most twice) per day.
The funny bit is that when I call her by her birth name, she's totally OK with it. Doesn't seem to bother her in the least. But when her mother calls her by it... it's breakdown from hell.
And this makes me think that (in many cases) this is all a part of teenage rebellion. (And the fact that the parents did saddle her with a rather untraditional name. And this might be a little bit revenge for that.)
He has no feminine traits whatsoever so I just assume ot was a cool thing to say at the time.) who's child (13yrs old) is either a boy who believes they are a girl or a girl who believes they are a boy. I met his child last year at a party - hold on must have been two years ago - and the child was dressed androgenously. I recently saw a picture of them in their new (senior) school uniform and I couldn't remember/work out which way "round" the transformation was.
I do know that the school (old style public school) was pretty accommodating given the androgenous uniform the child was wearing.
I don't for one second think they are doing it because it is "cool". Although I'm sure some are. Convinced or confused would be my guess at it.0 -
I'm told that the only unacceptable password on any site is "Ivehadeffingnuffof this'TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
0 -
I have access to sixteen different systems at work, and each month I have to come up with a new password for each system.OldKingCole said:
I'm told that the only unacceptable password on any site is "Ivehadeffingnuffof this'TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
I have to come up nearly 200 passwords each year, it's a bloody challenge.0 -
I think this song is relevant:NerysHughes said:
He was completely obsessed with becoming a girl, told all his relatives, asked to try on his Aunties clothes even though she is a size 10, and just like that the desire disappeared.TOPPING said:
I have a friend (a lot of "friends" here on PB on this subjectNerysHughes said:
My friends son who is a 6ft 14 year old, probably weighing 13 stone told his mum at the start of the year that he wanted to wear womens clothes. He said that they had been talking about gender in class and he said he might want to be a girl now. She dealt with it brilliantly and just listened to him without judgement. It was all he could talk about for a month and they were at the stage of a shopping trip to get him a dress. Then one day he came home from school and said he did not want to be a girl anymore and that was the last she heard of it.kle4 said:
I doubt it is 'all' that in all cases but at times it might seem a bit trendy. I think there was a phase where celebs used to cavalierly say they were bi, which probably annoyed actual bi persons.rcs1000 said:
We have a friend with a 13 year old daughter. Said daughter has decided she's now a boy and wants to be known as "Norman".Sandpit said:
Welcome to California!rcs1000 said:
Times change.TheScreamingEagles said:
All man, well he was when I met him in 2015.CorrectHorseBattery said:I might be wrong but I believed Foxy to be a woman? Many apologies if I am wrong
I always find it polite to make sure that I am not misgendering people, so I like to start each conversation with "[x], how nice to see you. Tell me, how do you self identify these days?"
Of course, there are limits to this. One shouldn't ask more than once (or at most twice) per day.
The funny bit is that when I call her by her birth name, she's totally OK with it. Doesn't seem to bother her in the least. But when her mother calls her by it... it's breakdown from hell.
And this makes me think that (in many cases) this is all a part of teenage rebellion. (And the fact that the parents did saddle her with a rather untraditional name. And this might be a little bit revenge for that.)
He has no feminine traits whatsoever so I just assume ot was a cool thing to say at the time.) who's child (13yrs old) is either a boy who believes they are a girl or a girl who believes they are a boy. I met his child last year at a party - hold on must have been two years ago - and the child was dressed androgenously. I recently saw a picture of them in their new (senior) school uniform and I couldn't remember/work out which way "round" the transformation was.
I do know that the school (old style public school) was pretty accommodating given the androgenous uniform the child was wearing.
I don't for one second think they are doing it because it is "cool". Although I'm sure some are. Convinced or confused would be my guess at it.
https://youtu.be/LwfoQ0A39KQ0 -
Needs to be “SnowWhite&The7Dwarfs”, as you need to include a number and a special character.TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
Although many will argue that Snow White is a special enough character on her own.2 -
-
-
-
-
I don't mind looking like an idiot sometimes! It's the ones who won;t admit it on PB that are the ones to be suspicious of.TheWhiteRabbit said:
I was there thinking, this is Robert making a clever joke right? Or am I just an idiot. And thus, I said nothing.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
Edit: Not intended to refer to you, sorry!0 -
-
My daughter tried hard to conform and be straight when she was a teenager. She wasn't happy in her own skin, at all. When she was 18, 12 years ago, she announced to all and sundry she was gay. Ever since then, she has been as happy as a happy thing, and is getting married soon. We all celebrate her sexuality, we don't mourn it.Selebian said:
I have a lot of respect for that position.Cookie said:
Because I love the people they are. And I don't want them to be unhappy with the people they are.TOPPING said:
Wow seriously? Why?Cookie said:
I would, quite frankly, be heartbroken if any of my girls decided to become boys.Philip_Thompson said:
My wife made an interesting point to me the other day - she said that she'd have no objections if either of our girls decided they wanted to be or are boys. But she would have an issue with them changing their names, that we spent a long time picking their name for them and that it'd be upsetting to have that name discarded.rcs1000 said:
We have a friend with a 13 year old daughter. Said daughter has decided she's now a boy and wants to be known as "Norman".Sandpit said:
Welcome to California!rcs1000 said:
Times change.TheScreamingEagles said:
All man, well he was when I met him in 2015.CorrectHorseBattery said:I might be wrong but I believed Foxy to be a woman? Many apologies if I am wrong
I always find it polite to make sure that I am not misgendering people, so I like to start each conversation with "[x], how nice to see you. Tell me, how do you self identify these days?"
Of course, there are limits to this. One shouldn't ask more than once (or at most twice) per day.
The funny bit is that when I call her by her birth name, she's totally OK with it. Doesn't seem to bother her in the least. But when her mother calls her by it... it's breakdown from hell.
And this makes me think that (in many cases) this is all a part of teenage rebellion. (And the fact that the parents did saddle her with a rather untraditional name. And this might be a little bit revenge for that.)
Perhaps if someone switches their gender, their parents should pick a new name for them in their new gender, instead of picking their own?
Because they would be doing themselves all sorts of irreversible physical harm.
I don't think I want to deny any grown adults the right to reassign their gender. The mental anguish such people must be in for this to seem an attractive option must be huge. (Though I'm not convinced in all cases gender reassignment assuages that mental anguish as anticipated.) But it's a fairly huge thing to go through. All other things being equal, living a life in which you remain the gender you started out as is the simpler and easier path. I don't want my daughters to have to go through it.
I'm slightly surprised you're surprised. I'd expect most parents to feel the same. I don't think its hopelessly antediluvian to hope that your daughters grow up to have the sort of life their parents do: i.e. find and marry some man and have children.
I want my children to be happy. And the route 1 approach is the most straightforward way to achieving that,
Years ago (at uni, so ~ 20 years ago) I had an argument with a friend in which I said that I would prefer my (future) children not to be gay. Purely because, at that point, I believed that gay people still faced a lot of prejudice and being gay would likely mean a harder life than being heterosexual (I would have absolutely accepted and supported gay children).
Fortunately, we've moved on as a society, which means that I no longer care either way.3 -
LOL, sixteen. I think I’m on 60, although some do renew quarterly rather than monthly.TheScreamingEagles said:
I have access to sixteen different systems at work, and each month I have to come up with a new password for each system.OldKingCole said:
I'm told that the only unacceptable password on any site is "Ivehadeffingnuffof this'TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
I have to come up nearly 200 passwords each year, it's a bloody challenge.0 -
-
Password1! is clearly more secure because it has a symbol.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...0 -
-
Selebian said:
(over-simplified, but you still might regret asking - and I might get corrected by an actual expert)Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Competent password management on a site means that the password is never stored, only a hash of it (which converts the password to a seemingly random - but in fact reproducible for the password - string of characters of uniform length).
When you log in, the hash of what you type in is compared to the stored hash to verify your password. If it matches, then you're in.
Insecure hashing methods (see md5) are open to manipulation so you can find collisions - i.e. different inputs that give the same hash. There are also tables of hashes of popular passwords available online - e.g. hashes of 'password'.
So, if RCS chooses a password that gives the same hash as 'password' anyone hacking PB.com for example and recovering the hashed passwords will think that RCS's password is in fact 'password' by looking it up in such a table) even though it is not. The joke is that becuase only hashes are compared, typing 'password' to log in to PB.com will get you in, as the hash matches the hash of RCS's password. Likewise on other sites, where his other unique passwords will all have a hash that lets you in if you enter 'password' as the password*. So what RCS does would make his accounts completely insecure*. Also very computationally intensive (if possible at all, depending on hashing method) to generate on demand passwords that will have a hash that collides with (matches) the hash of 'password'
*note, this shouldn't work in reality as sites should also add their own random strings to the passwords before hashing, so that the hashes for 'password' on PB.com and on google.com for example should not be the same
Thank you both!rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...1 -
-
Well in all honesty I'd still prefer them to be straight - but only for the same reason. A close family member is a gay woman and as far as I can see this has caused her an awful lot of misery over the years. She is now, happily, after a great deal of time, expense and heartbreak, a parent, but it has been far from an easy ride. I'd hope my daughters wouldn't have to go through that. Again, the route 1 approach seems easier, cheaper and more likely to result in a happy outcome.Selebian said:
I have a lot of respect for that position.Cookie said:
Because I love the people they are. And I don't want them to be unhappy with the people they are.TOPPING said:
Wow seriously? Why?Cookie said:
I would, quite frankly, be heartbroken if any of my girls decided to become boys.Philip_Thompson said:
My wife made an interesting point to me the other day - she said that she'd have no objections if either of our girls decided they wanted to be or are boys. But she would have an issue with them changing their names, that we spent a long time picking their name for them and that it'd be upsetting to have that name discarded.rcs1000 said:
We have a friend with a 13 year old daughter. Said daughter has decided she's now a boy and wants to be known as "Norman".Sandpit said:
Welcome to California!rcs1000 said:
Times change.TheScreamingEagles said:
All man, well he was when I met him in 2015.CorrectHorseBattery said:I might be wrong but I believed Foxy to be a woman? Many apologies if I am wrong
I always find it polite to make sure that I am not misgendering people, so I like to start each conversation with "[x], how nice to see you. Tell me, how do you self identify these days?"
Of course, there are limits to this. One shouldn't ask more than once (or at most twice) per day.
The funny bit is that when I call her by her birth name, she's totally OK with it. Doesn't seem to bother her in the least. But when her mother calls her by it... it's breakdown from hell.
And this makes me think that (in many cases) this is all a part of teenage rebellion. (And the fact that the parents did saddle her with a rather untraditional name. And this might be a little bit revenge for that.)
Perhaps if someone switches their gender, their parents should pick a new name for them in their new gender, instead of picking their own?
Because they would be doing themselves all sorts of irreversible physical harm.
I don't think I want to deny any grown adults the right to reassign their gender. The mental anguish such people must be in for this to seem an attractive option must be huge. (Though I'm not convinced in all cases gender reassignment assuages that mental anguish as anticipated.) But it's a fairly huge thing to go through. All other things being equal, living a life in which you remain the gender you started out as is the simpler and easier path. I don't want my daughters to have to go through it.
I'm slightly surprised you're surprised. I'd expect most parents to feel the same. I don't think its hopelessly antediluvian to hope that your daughters grow up to have the sort of life their parents do: i.e. find and marry some man and have children.
I want my children to be happy. And the route 1 approach is the most straightforward way to achieving that,
Years ago (at uni, so ~ 20 years ago) I had an argument with a friend in which I said that I would prefer my (future) children not to be gay. Purely because, at that point, I believed that gay people still faced a lot of prejudice and being gay would likely mean a harder life than being heterosexual (I would have absolutely accepted and supported gay children).
Fortunately, we've moved on as a society, which means that I no longer care either way.0 -
99 per cent of non-retired people (or lots of them anyway) do not understand that their future pension is partly determined by decisions taken now, and that their pension would have been higher if the triple lock had been followed, as increases are compounded. The media have done everyone a disservice, and the government has been very clever, in presenting this as only benefiting those already retired.Sandpit said:
Which means the media reaction over the coming days and weeks, is going to be important in the polling.Big_G_NorthWales said:
And 45% D/K which is not surprising as how many really know about the pensioner triple lock, unless they are pensionersHYUFD said:Britons oppose the decision to suspend the triple lock 32% to 22%. Tory voters split, 34% in favour, 35% opposed.
Only 18 to 24 year olds in favour of the suspension
https://twitter.com/YouGov/status/1435635557745504257?s=20
99% of non-retired people probably don’t understand the full extent of the proposals.1 -
I used to have one login/password for all sixteen systems then we hired some IT/security consultants who tested our system and decided I was a security risk if my login credentials were compromised so the solution was to give me access to all sixteen systems individually.Sandpit said:
LOL, sixteen. I think I’m on 60, although some do renew quarterly rather than monthly.TheScreamingEagles said:
I have access to sixteen different systems at work, and each month I have to come up with a new password for each system.OldKingCole said:
I'm told that the only unacceptable password on any site is "Ivehadeffingnuffof this'TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
I have to come up nearly 200 passwords each year, it's a bloody challenge.
Turned out I was the only individual working at the company who had access to all sixteen systems, not even the board had such access.0 -
The ability for humans to create secure passwords is surely something we can evolutionarily adapt to0
-
A great surprise that the most popular target is the tax almost no-one pays and raises just enough money to feature as a statistical footnote in the accounts, and is subject to lots of avoidance.HYUFD said:% who agree [X] would be a better alternative for funding the NHS+social care than the gov's current plan of raising National Insurance:
Raising capital gains tax: 43%
Raising income tax: 27%
Cutting public spending: 22%
Using more money from the estates of individuals: 18%
Raising VAT: 16%
Borrowing more: 13%
https://twitter.com/BritainElects/status/1435629242969116675?s=20
https://twitter.com/chriscurtis94/status/1435602395908739072?s=20
1 -
Which is why current best practice is not to require frequent password changes.TheScreamingEagles said:
I have access to sixteen different systems at work, and each month I have to come up with a new password for each system.OldKingCole said:
I'm told that the only unacceptable password on any site is "Ivehadeffingnuffof this'TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
I have to come up nearly 200 passwords each year, it's a bloody challenge.1 -
Urgh. I'm dipping into PB as light relief from trying to work out my CGT, after realising belatedly that my unit trust has changed its procedures in a way which have made me potentially liable for it for the last 5 years. Happily no actual liability till this current year (because of other and much larger changes). But it is a pain to calculate.algarkirk said:
A great surprise that the most popular target is the tax almost no-one pays and raises just enough money to feature as a statistical footnote in the accounts, and is subject to lots of avoidance.HYUFD said:% who agree [X] would be a better alternative for funding the NHS+social care than the gov's current plan of raising National Insurance:
Raising capital gains tax: 43%
Raising income tax: 27%
Cutting public spending: 22%
Using more money from the estates of individuals: 18%
Raising VAT: 16%
Borrowing more: 13%
https://twitter.com/BritainElects/status/1435629242969116675?s=20
https://twitter.com/chriscurtis94/status/1435602395908739072?s=200 -
In almost every company I’ve encountered professionally, the board directors are the weakest link in the IT security chain.TheScreamingEagles said:
I used to have one login/password for all sixteen systems then we hired some IT/security consultants who tested our system and decided I was a security risk if my login credentials were compromised so the solution was to give me access to all sixteen systems individually.Sandpit said:
LOL, sixteen. I think I’m on 60, although some do renew quarterly rather than monthly.TheScreamingEagles said:
I have access to sixteen different systems at work, and each month I have to come up with a new password for each system.OldKingCole said:
I'm told that the only unacceptable password on any site is "Ivehadeffingnuffof this'TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
I have to come up nearly 200 passwords each year, it's a bloody challenge.
Turned out I was the only individual working at the company who had access to all sixteen systems, not even the board had such access.
They demand access to systems they don’t need, and demand exceptions to the rules that all other employees have to follow.3 -
2FA always leads to fun with The Senior Manglement Team....Sandpit said:
In almost every company I’ve encountered professionally, the board directors are the weakest link in the IT security chain.TheScreamingEagles said:
I used to have one login/password for all sixteen systems then we hired some IT/security consultants who tested our system and decided I was a security risk if my login credentials were compromised so the solution was to give me access to all sixteen systems individually.Sandpit said:
LOL, sixteen. I think I’m on 60, although some do renew quarterly rather than monthly.TheScreamingEagles said:
I have access to sixteen different systems at work, and each month I have to come up with a new password for each system.OldKingCole said:
I'm told that the only unacceptable password on any site is "Ivehadeffingnuffof this'TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
I have to come up nearly 200 passwords each year, it's a bloody challenge.
Turned out I was the only individual working at the company who had access to all sixteen systems, not even the board had such access.
They demand access to systems they don’t need, and demand exceptions to the rules that all other employees have to follow.4 -
Look on the bright side: being rich enough to have to worry about CGT in the first place is a nice problem to have.Carnyx said:
Urgh. I'm dipping into PB as light relief from trying to work out my CGT, after realising belatedly that my unit trust has changed its procedures in a way which have made me potentially liable for it for the last 5 years. Happily no actual liability till this current year (because of other and much larger changes). But it is a pain to calculate.algarkirk said:
A great surprise that the most popular target is the tax almost no-one pays and raises just enough money to feature as a statistical footnote in the accounts, and is subject to lots of avoidance.HYUFD said:% who agree [X] would be a better alternative for funding the NHS+social care than the gov's current plan of raising National Insurance:
Raising capital gains tax: 43%
Raising income tax: 27%
Cutting public spending: 22%
Using more money from the estates of individuals: 18%
Raising VAT: 16%
Borrowing more: 13%
https://twitter.com/BritainElects/status/1435629242969116675?s=20
https://twitter.com/chriscurtis94/status/1435602395908739072?s=200 -
It’s more socially acceptable to disown them for being a Tory.darkage said:
Good post. This is also basically my perspective on the situation.Selebian said:
Have had similar discussions (name change wasn't considered though!) as a relation of mine - some kind of cousin? cousin's son* - apparently told his mother that he considered himself a girl and started dressing in women's clothing. This was some years back; I'd had little contact with him and only sporadic contact with his mother although both came to our wedding. She had effectively disowned him, which horrified my wife and I and led to the discussion.Philip_Thompson said:
My wife made an interesting point to me the other day - she said that she'd have no objections if either of our girls decided they wanted to be or are boys. But she would have an issue with them changing their names, that we spent a long time picking their name for them and that it'd be upsetting to have that name discarded.rcs1000 said:
We have a friend with a 13 year old daughter. Said daughter has decided she's now a boy and wants to be known as "Norman".Sandpit said:
Welcome to California!rcs1000 said:
Times change.TheScreamingEagles said:
All man, well he was when I met him in 2015.CorrectHorseBattery said:I might be wrong but I believed Foxy to be a woman? Many apologies if I am wrong
I always find it polite to make sure that I am not misgendering people, so I like to start each conversation with "[x], how nice to see you. Tell me, how do you self identify these days?"
Of course, there are limits to this. One shouldn't ask more than once (or at most twice) per day.
The funny bit is that when I call her by her birth name, she's totally OK with it. Doesn't seem to bother her in the least. But when her mother calls her by it... it's breakdown from hell.
And this makes me think that (in many cases) this is all a part of teenage rebellion. (And the fact that the parents did saddle her with a rather untraditional name. And this might be a little bit revenge for that.)
Perhaps if someone switches their gender, their parents should pick a new name for them in their new gender, instead of picking their own?
These are big decisions though, we'd support our children, but I'd certainly be concerned that it might be a manifestation of a different mental health issue and we'd try and work through that. People with gender issues are of course real and should be supported, but I think that there is a danger that people with mental health issues can latch on to anything more tangible as a cause and solution. The treatments have long term implications, even delaying puberty, so it's not s decision to be taken lightly particularly when there is a risk that the real underlying issue is different.
I hope that if we ever get to those issues (our eldest is only 3) they will be much better understood and the services much better.
*I'm using male terms as he was a boy and identified as such when I knew him. I don't know the situation now - the mother cut off contact after I expressed the opinion that she was doing the wrong thing and all I ever had for him was an email address - we emailed to offer support/a friendly ear if needed, but never heard back.
What I would also say is that, in this day and age; if you disowned your children for this, then you would find yourself socially ostracised and probably cancelled. It isn't an option.3 -
Radacanu wins first set.....2
-
That's sad.Selebian said:
Have had similar discussions (name change wasn't considered though!) as a relation of mine - some kind of cousin? cousin's son* - apparently told his mother that he considered himself a girl and started dressing in women's clothing. This was some years back; I'd had little contact with him and only sporadic contact with his mother although both came to our wedding. She had effectively disowned him, which horrified my wife and I and led to the discussion.Philip_Thompson said:
My wife made an interesting point to me the other day - she said that she'd have no objections if either of our girls decided they wanted to be or are boys. But she would have an issue with them changing their names, that we spent a long time picking their name for them and that it'd be upsetting to have that name discarded.rcs1000 said:
We have a friend with a 13 year old daughter. Said daughter has decided she's now a boy and wants to be known as "Norman".Sandpit said:
Welcome to California!rcs1000 said:
Times change.TheScreamingEagles said:
All man, well he was when I met him in 2015.CorrectHorseBattery said:I might be wrong but I believed Foxy to be a woman? Many apologies if I am wrong
I always find it polite to make sure that I am not misgendering people, so I like to start each conversation with "[x], how nice to see you. Tell me, how do you self identify these days?"
Of course, there are limits to this. One shouldn't ask more than once (or at most twice) per day.
The funny bit is that when I call her by her birth name, she's totally OK with it. Doesn't seem to bother her in the least. But when her mother calls her by it... it's breakdown from hell.
And this makes me think that (in many cases) this is all a part of teenage rebellion. (And the fact that the parents did saddle her with a rather untraditional name. And this might be a little bit revenge for that.)
Perhaps if someone switches their gender, their parents should pick a new name for them in their new gender, instead of picking their own?
These are big decisions though, we'd support our children, but I'd certainly be concerned that it might be a manifestation of a different mental health issue and we'd try and work through that. People with gender issues are of course real and should be supported, but I think that there is a danger that people with mental health issues can latch on to anything more tangible as a cause and solution. The treatments have long term implications, even delaying puberty, so it's not s decision to be taken lightly particularly when there is a risk that the real underlying issue is different.
I hope that if we ever get to those issues (our eldest is only 3) they will be much better understood and the services much better.
*I'm using male terms as he was a boy and identified as such when I knew him. I don't know the situation now - the mother cut off contact after I expressed the opinion that she was doing the wrong thing and all I ever had for him was an email address - we emailed to offer support/a friendly ear if needed, but never heard back.
In my family I don't know anyone who is trans, but I do have a cousin whom if they were to say they are it wouldn't surprise me. In fact I don't think it would surprise many people, be one of those "we always knew" kind of things if they did say that.0 -
Oh, absolutely! And I've just finished the spreadsheet anyway so I can pack up, thank goodness.pigeon said:
Look on the bright side: being rich enough to have to worry about CGT in the first place is a nice problem to have.Carnyx said:
Urgh. I'm dipping into PB as light relief from trying to work out my CGT, after realising belatedly that my unit trust has changed its procedures in a way which have made me potentially liable for it for the last 5 years. Happily no actual liability till this current year (because of other and much larger changes). But it is a pain to calculate.algarkirk said:
A great surprise that the most popular target is the tax almost no-one pays and raises just enough money to feature as a statistical footnote in the accounts, and is subject to lots of avoidance.HYUFD said:% who agree [X] would be a better alternative for funding the NHS+social care than the gov's current plan of raising National Insurance:
Raising capital gains tax: 43%
Raising income tax: 27%
Cutting public spending: 22%
Using more money from the estates of individuals: 18%
Raising VAT: 16%
Borrowing more: 13%
https://twitter.com/BritainElects/status/1435629242969116675?s=20
https://twitter.com/chriscurtis94/status/1435602395908739072?s=200 -
As if today's twenty year olds give a stuff about the state pension being higher in the final quarter of the century. They probably reckon, if they think about the subject at all, that the retirement age will be about 80 by the time they finally catch up with the ratchet. Either that or the welfare system will already have gone bust by that point. And they may well be right.DecrepiterJohnL said:
99 per cent of non-retired people (or lots of them anyway) do not understand that their future pension is partly determined by decisions taken now, and that their pension would have been higher if the triple lock had been followed, as increases are compounded. The media have done everyone a disservice, and the government has been very clever, in presenting this as only benefiting those already retired.Sandpit said:
Which means the media reaction over the coming days and weeks, is going to be important in the polling.Big_G_NorthWales said:
And 45% D/K which is not surprising as how many really know about the pensioner triple lock, unless they are pensionersHYUFD said:Britons oppose the decision to suspend the triple lock 32% to 22%. Tory voters split, 34% in favour, 35% opposed.
Only 18 to 24 year olds in favour of the suspension
https://twitter.com/YouGov/status/1435635557745504257?s=20
99% of non-retired people probably don’t understand the full extent of the proposals.1 -
Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.0
-
Because remembering X different passwords is hard especially when you rarely use them.Sandpit said:
In almost every company I’ve encountered professionally, the board directors are the weakest link in the IT security chain.TheScreamingEagles said:
I used to have one login/password for all sixteen systems then we hired some IT/security consultants who tested our system and decided I was a security risk if my login credentials were compromised so the solution was to give me access to all sixteen systems individually.Sandpit said:
LOL, sixteen. I think I’m on 60, although some do renew quarterly rather than monthly.TheScreamingEagles said:
I have access to sixteen different systems at work, and each month I have to come up with a new password for each system.OldKingCole said:
I'm told that the only unacceptable password on any site is "Ivehadeffingnuffof this'TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
I have to come up nearly 200 passwords each year, it's a bloody challenge.
Turned out I was the only individual working at the company who had access to all sixteen systems, not even the board had such access.
They demand access to systems they don’t need, and demand exceptions to the rules that all other employees have to follow.
My default advice here is to use a password manager to store everything and allow it to generate random passwords as otherwise it's a world of pain when a system gets compromised.
0 -
-
Not a surprise that the only plausible solution (wealth ) isn't mentioned at all.algarkirk said:
A great surprise that the most popular target is the tax almost no-one pays and raises just enough money to feature as a statistical footnote in the accounts, and is subject to lots of avoidance.HYUFD said:% who agree [X] would be a better alternative for funding the NHS+social care than the gov's current plan of raising National Insurance:
Raising capital gains tax: 43%
Raising income tax: 27%
Cutting public spending: 22%
Using more money from the estates of individuals: 18%
Raising VAT: 16%
Borrowing more: 13%
https://twitter.com/BritainElects/status/1435629242969116675?s=20
https://twitter.com/chriscurtis94/status/1435602395908739072?s=20
0 -
How often in an Olympic year has SPOTY gone to a non-Olympian?FrancisUrquhart said:Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.
0 -
I suspect passwords will eventually go the way of the dinosaur...CorrectHorseBattery said:The ability for humans to create secure passwords is surely something we can evolutionarily adapt to
2 -
Scholz ahead in Bavaria in terms of chancellor preference with Infratest Dimap:HYUFD said:
Still a comfortable 10% lead over the 2nd placed SPD for the CSU and still almost 10% more than their CDU sister party are polling in the rest of Germany in many polls.Gary_Burton said:It gets worse for the CSU in Bavaria - 28% in this poll. Also slightly better for the SPD who are 2nd on 18%:
https://twitter.com/Wahlrecht_de/status/1435627306895171586
https://twitter.com/Wahlen_DE/status/1435645352238108674
Scholz (SPD): 39% (+17)
Laschet (CDU): 18% (-15)
Baerbock (GRÜNE): 13% (-2)0 -
On security:
More than two decades ago, a place I know implemented its own security and alarm system - apparently it was an experiment to see whether it was a business area they wanted to move into.
It was all rather a mess. Firstly, locks were put on the doors leading into the toilets, so you had to wave your security card at an RFID receiver to get in and out. People complained, because it potentially gave the management the chance to see how long people were spending on loo breaks.
Then there was an incident one weekend. Some engineers were working when the alarm was triggered. All the doors locked. Because some idiots had designed it as a fail-secure, not fail-safe system, they were trapped in their parts of the building. The site security guard was also locked in, and could not reset the system. In the end a couple of engineers had to smash the window into a server room, climb in, and reboot the computer. Only then did the doors unlock.
The system was abandoned, and an alarm firm further up the road came in to do a proper job ...3 -
I'd go further, it's now considered bad practice to require regular password changes. I'm pretty sure that NIST, NSA, and the UK's NCSC and the like all recommend against it.DecrepiterJohnL said:Which is why current best practice is not to require frequent password changes.
0 -
She won't win it regardless of what happens in the US Open, but she has something special....again crucial 30/30, smashes a perfect Ace.Philip_Thompson said:
How often in an Olympic year has SPOTY gone to a non-Olympian?FrancisUrquhart said:Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.
The best seem to get better when the pressure is being turned up.0 -
41% oppose raising more money from the estates of individuals, only 18% in favour.eek said:
Not a surprise that the only plausible solution (wealth ) isn't mentioned at all.algarkirk said:
A great surprise that the most popular target is the tax almost no-one pays and raises just enough money to feature as a statistical footnote in the accounts, and is subject to lots of avoidance.HYUFD said:% who agree [X] would be a better alternative for funding the NHS+social care than the gov's current plan of raising National Insurance:
Raising capital gains tax: 43%
Raising income tax: 27%
Cutting public spending: 22%
Using more money from the estates of individuals: 18%
Raising VAT: 16%
Borrowing more: 13%
https://twitter.com/BritainElects/status/1435629242969116675?s=20
https://twitter.com/chriscurtis94/status/1435602395908739072?s=20
So they may support raising more money from the wealth of the living but not from the wealth of the dead
https://twitter.com/chriscurtis94/status/1435602395908739072?s=200 -
Damon Hill was the last, in the dreadful Olympic year that was 1996.Philip_Thompson said:
How often in an Olympic year has SPOTY gone to a non-Olympian?FrancisUrquhart said:Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.
0 -
Using the summer Olympics the last time was 1996 when Damon Hill won SPOTY.Philip_Thompson said:
How often in an Olympic year has SPOTY gone to a non-Olympian?FrancisUrquhart said:Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.
1992 was won by Nigel Mansell, 1988 Steve Davis, 1956 Jim Laker are the only times non Olympians have won SPOTY in Olympic years.0 -
Maybe in fairness all humans look alike to his spider. Whilst it is unfair to blame the spider for all of his mistakes who can doubt that he is in day to day charge?0
-
No surprise, it is Soder's home turf and CSU supporters hate Laschet after he beat Soder to be the Union chancellor candidate.Gary_Burton said:
Scholz ahead in Bavaria in terms of chancellor preference with Infratest Dimap:HYUFD said:
Still a comfortable 10% lead over the 2nd placed SPD for the CSU and still almost 10% more than their CDU sister party are polling in the rest of Germany in many polls.Gary_Burton said:It gets worse for the CSU in Bavaria - 28% in this poll. Also slightly better for the SPD who are 2nd on 18%:
https://twitter.com/Wahlrecht_de/status/1435627306895171586
https://twitter.com/Wahlen_DE/status/1435645352238108674
Scholz (SPD): 39% (+17)
Laschet (CDU): 18% (-15)
Baerbock (GRÜNE): 13% (-2)
On that poll 10% more Bavarians will vote for the CSU than actually want Laschet to end up Chancellor0 -
Even that can be a pain when some applications do not allow passwords to be pasted in, and the password manager has generated a password including characters not available to your outsourced Ukrainian staff with their funny keyboards.eek said:
Because remembering X different passwords is hard especially when you rarely use them.Sandpit said:
In almost every company I’ve encountered professionally, the board directors are the weakest link in the IT security chain.TheScreamingEagles said:
I used to have one login/password for all sixteen systems then we hired some IT/security consultants who tested our system and decided I was a security risk if my login credentials were compromised so the solution was to give me access to all sixteen systems individually.Sandpit said:
LOL, sixteen. I think I’m on 60, although some do renew quarterly rather than monthly.TheScreamingEagles said:
I have access to sixteen different systems at work, and each month I have to come up with a new password for each system.OldKingCole said:
I'm told that the only unacceptable password on any site is "Ivehadeffingnuffof this'TheScreamingEagles said:
When I get told my password has to be eight characters then I make my password 'SnowWhiteAndTheSevenDwarfs'TOPPING said:
I have been known to add the requisite number of "1"s depending on how long the effing password is required to be.Sandpit said:
Ooh, so you go with Password11 rather than Password1!TOPPING said:
Thing is, it's always the capital "P" in Password11 that will fool the hackers.rcs1000 said:
OK...Carnyx said:
What does that last clause mean, please??rcs1000 said:
All my passwords are different, and I algorithmically generate them so their hashes collide with "password" for added security.CorrectHorseBattery said:
Companies that do the following:eek said:
What companies - without any quote - I haven't a clue what you are on about.CorrectHorseBattery said:If anyone does work for one of these companies, I suggest resigning and sending an email to the Information Commissioner (or whatever they are called nowadays).
I recall one Dido Harding oversaw such a security failure at TalkTalk, whatever happened to her?
Don't use encryption of any kind
Store passwords as plain text
Use unsecured and/or publicly accessible db environments
And these companies exist
Proper computer systems don't store plain text passwords. So, they'll have a table in their database that has:
username, password
rcs1000, 5f4dcc3b5aa765d61d8327deb882cf99
Now, "5f4dcc3b5aa765d61d8327deb882cf99" is not the actual password, but is instead what's called a "hash". That is, it is the output of a function - in this case the MD5 hashing function for the string "password". The reason for this is that if someone breaks into your system and downloads the database, you don't want them to be able to see the actual passwords. Them only knowing the hashes of them makes it more secure.
However, the joke is that there will be multiple inputs that all generate the same hashing output - perhaps thousands of strings (or even millions if you let your string length expand sufficiently) - as 'password'.
By using complex passwords that share the same hash as "password", I actually have a massive security problem, because people wouldn't need to guess my actual passwords, they could just type "password".
It's the best cryptography joke I've ever come up with...
I have to come up nearly 200 passwords each year, it's a bloody challenge.
Turned out I was the only individual working at the company who had access to all sixteen systems, not even the board had such access.
They demand access to systems they don’t need, and demand exceptions to the rules that all other employees have to follow.
My default advice here is to use a password manager to store everything and allow it to generate random passwords as otherwise it's a world of pain when a system gets compromised.1 -
And she breaks serve.....0
-
Presumably if that pattern holds firm for another week or two (caveat: I don't know how far universities will go in trying to force students to use Covid tests, which would send the 20-24 numbers flying as well,) then we'll have a good indicator that the youth casedemic isn't about to filter through into mass hospitalisation and death amongst the middle aged and the olds?Malmesbury said:0 -
Raducanu now 6-3, 3-2 up with a break, after Bencic double faults...0
-
Yes, the US Open is not on proper telly so it doesn't count except that she may pick up some adverts on the back of this. At the moment, Emma Radacanu is not even the British number one, or even number two, though she should go top when the rankings are recalculated.FrancisUrquhart said:
She won't win it regardless of what happens in the US Open, but she has something special....again crucial 30/30, smashes a perfect Ace.Philip_Thompson said:
How often in an Olympic year has SPOTY gone to a non-Olympian?FrancisUrquhart said:Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.
The best seem to get better when the pressure is being turned up.
ETA and this morning, Bencic was favourite to win this match.0 -
Who the hell would implement a fail-secure system, on a building that wasn’t a prison or MI5 HQ?JosiasJessop said:On security:
More than two decades ago, a place I know implemented its own security and alarm system - apparently it was an experiment to see whether it was a business area they wanted to move into.
It was all rather a mess. Firstly, locks were put on the doors leading into the toilets, so you had to wave your security card at an RFID receiver to get in and out. People complained, because it potentially gave the management the chance to see how long people were spending on loo breaks.
Then there was an incident one weekend. Some engineers were working when the alarm was triggered. All the doors locked. Because some idiots had designed it as a fail-secure, not fail-safe system, they were trapped in their parts of the building. The site security guard was also locked in, and could not reset the system. In the end a couple of engineers had to smash the window into a server room, climb in, and reboot the computer. Only then did the doors unlock.
The system was abandoned, and an alarm firm further up the road came in to do a proper job ...
Doesn’t come close to meeting any known building code.
And their server room had a window? There’s your security hole, right there.1 -
Which it surely is. Only way is down after this.Northern_Al said:
Thanks for the credit on the header TSE. I feel like my life's work is now complete.TheScreamingEagles said:
All man, well he was when I met him in 2015.CorrectHorseBattery said:I might be wrong but I believed Foxy to be a woman? Many apologies if I am wrong
0 -
She is the real deal...she is duffing up very good players....despite hardly any tennis during the pandemic, certainly not against world class opposition.DecrepiterJohnL said:
Yes, the US Open is not on proper telly so it doesn't count except that she may pick up some adverts on the back of this. At the moment, Emma Radacanu is not even the British number one, or even number two, though she should go top when the rankings are recalculated.FrancisUrquhart said:
She won't win it regardless of what happens in the US Open, but she has something special....again crucial 30/30, smashes a perfect Ace.Philip_Thompson said:
How often in an Olympic year has SPOTY gone to a non-Olympian?FrancisUrquhart said:Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.
The best seem to get better when the pressure is being turned up.2 -
I wouldn't rule out the possibility of her winning it if she wins the US Open.FrancisUrquhart said:
She won't win it regardless of what happens in the US Open, but she has something special....again crucial 30/30, smashes a perfect Ace.Philip_Thompson said:
How often in an Olympic year has SPOTY gone to a non-Olympian?FrancisUrquhart said:Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.
The best seem to get better when the pressure is being turned up.
The amount of affection and support she won from Wimbledon was incredible - and if she follows that up with a Grand Slam she'll be a champion too. She has a great PR machine behind her . . . I could definitely see her winning SPOTY if she wins the US Open.1 -
On the positive side both my son and I have got negative results on the PCR tests. My wife is on the phone at the moment as hers did not come through for some reason one way or another.
Less good is that both my daughter and her friend had passed LFTs before they went to a concert. Her friend subsequently had to do a PCR and failed so my daughter did one too and also failed. The tests were within a very short time of the concert and my daughter did not see her friend again so the strong probability is that her friend was already infected and infected her.0 -
Blocking password pasting is another thing that the NCSC recommends against.DecrepiterJohnL said:Even that can be a pain when some applications do not allow passwords to be pasted in, and the password manager has generated a password including characters not available to your outsourced Ukrainian staff with their funny keyboards.
There is some genuinely very good advice at the NCSC, and for more technical recommendations NIST does a lot of good work. It would be nice if businesses took notice.
3 -
Indeed. I'd apply for a job as password denigrator with @TheScreamingEagles' firm except I've seen the dress code.glw said:
I'd go further, it's now considered bad practice to require regular password changes. I'm pretty sure that NIST, NSA, and the UK's NCSC and the like all recommend against it.DecrepiterJohnL said:Which is why current best practice is not to require frequent password changes.
2 -
Watching on Amazon but picture is a bit jumpypigeon said:Raducanu now 6-3, 3-2 up with a break, after Bencic double faults...
0 -
This was back in 1997/8 period, when things were a little different. But yes, failing secure was insane. Especially as the system was designed in their spare time by a couple of engineers (AIUI). I don't think they had a spec aside from 'build an alarm system'. The window was an internal one, inside the building; not an external one.Sandpit said:
Who the hell would implement a fail-secure system, on a building that wasn’t a prison or MI5 HQ?JosiasJessop said:On security:
More than two decades ago, a place I know implemented its own security and alarm system - apparently it was an experiment to see whether it was a business area they wanted to move into.
It was all rather a mess. Firstly, locks were put on the doors leading into the toilets, so you had to wave your security card at an RFID receiver to get in and out. People complained, because it potentially gave the management the chance to see how long people were spending on loo breaks.
Then there was an incident one weekend. Some engineers were working when the alarm was triggered. All the doors locked. Because some idiots had designed it as a fail-secure, not fail-safe system, they were trapped in their parts of the building. The site security guard was also locked in, and could not reset the system. In the end a couple of engineers had to smash the window into a server room, climb in, and reboot the computer. Only then did the doors unlock.
The system was abandoned, and an alarm firm further up the road came in to do a proper job ...
Doesn’t come close to meeting any known building code.
And their server room had a window? There’s your security hole, right there.
If there'd been a fire and the system failed (power cut?) we'd have been toast.
Oh, and the computer controlling the system might have been running a development version of the OS, not a stable one. Just to add to the hilarity.1 -
9/2 now which is too short imo. Someone tipped her at 20/1 recently on pb, I think. Same price for her to win the US Open!Philip_Thompson said:
I wouldn't rule out the possibility of her winning it if she wins the US Open.FrancisUrquhart said:
She won't win it regardless of what happens in the US Open, but she has something special....again crucial 30/30, smashes a perfect Ace.Philip_Thompson said:
How often in an Olympic year has SPOTY gone to a non-Olympian?FrancisUrquhart said:Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.
The best seem to get better when the pressure is being turned up.
The amount of affection and support she won from Wimbledon was incredible - and if she follows that up with a Grand Slam she'll be a champion too. She has a great PR machine behind her . . . I could definitely see her winning SPOTY if she wins the US Open.0 -
Try exit and re-enter.....Big_G_NorthWales said:
Watching on Amazon but picture is a bit jumpypigeon said:Raducanu now 6-3, 3-2 up with a break, after Bencic double faults...
1 -
Might be your internet connection, mine's clear and consistent.Big_G_NorthWales said:
Watching on Amazon but picture is a bit jumpypigeon said:Raducanu now 6-3, 3-2 up with a break, after Bencic double faults...
Bencic is really having to fight to try to stay in this.1 -
Absolutely, on some days I've gone to work in a morning suit.DecrepiterJohnL said:
Indeed. I'd apply for a job as password denigrator with @TheScreamingEagles' firm except I've seen the dress code.glw said:
I'd go further, it's now considered bad practice to require regular password changes. I'm pretty sure that NIST, NSA, and the UK's NCSC and the like all recommend against it.DecrepiterJohnL said:Which is why current best practice is not to require frequent password changes.
1 -
Reminds me of the time OGH told me off for mixing him up with TSE!
I made that up by the way0 -
It seems to have settled thanksFrancisUrquhart said:
Try exit and re-enter.....Big_G_NorthWales said:
Watching on Amazon but picture is a bit jumpypigeon said:Raducanu now 6-3, 3-2 up with a break, after Bencic double faults...
0 -
What channel # is GB News.....if I have jinked her.....I will be sent to watch it right?1
-
No sound for me for some reason (yes, I have checked I'm not on mute).pigeon said:
Might be your internet connection, mine's clear and consistent.Big_G_NorthWales said:
Watching on Amazon but picture is a bit jumpypigeon said:Raducanu now 6-3, 3-2 up with a break, after Bencic double faults...
Bencic is really having to fight to try to stay in this.0 -
236 on freeview.FrancisUrquhart said:What channel # is GB News.....if I have jinked her.....I will be sent to watch it right?
0 -
Again comes back from 0-30....at 18, asking a girl out was nerve wracking enough for me.....1
-
All OK no GB News for youFrancisUrquhart said:What channel # is GB News.....if I have jinked her.....I will be sent to watch it right?
0 -
If only you knew me then, I would have told you my awesome chat up lines.FrancisUrquhart said:Again comes back from 0-30....at 18, asking a girl out was nerve wracking enough for me.....
0 -
Sky 666FrancisUrquhart said:What channel # is GB News.....if I have jinked her.....I will be sent to watch it right?
1 -
Bencic's head's gone. 4 straight unforced errors at 0-30 up. Raducanu's opponents just seem to mentally disintegrate.0
-
I wouldn't want the break now....i would just want to get on with it.0
-
Sounds like an episode of the mid/late 1990s BBC TV drama Bugs. Precisely the sort of thing that used to happen on the show.JosiasJessop said:
This was back in 1997/8 period, when things were a little different. But yes, failing secure was insane. Especially as the system was designed in their spare time by a couple of engineers (AIUI). I don't think they had a spec aside from 'build an alarm system'. The window was an internal one, inside the building; not an external one.Sandpit said:
Who the hell would implement a fail-secure system, on a building that wasn’t a prison or MI5 HQ?JosiasJessop said:On security:
More than two decades ago, a place I know implemented its own security and alarm system - apparently it was an experiment to see whether it was a business area they wanted to move into.
It was all rather a mess. Firstly, locks were put on the doors leading into the toilets, so you had to wave your security card at an RFID receiver to get in and out. People complained, because it potentially gave the management the chance to see how long people were spending on loo breaks.
Then there was an incident one weekend. Some engineers were working when the alarm was triggered. All the doors locked. Because some idiots had designed it as a fail-secure, not fail-safe system, they were trapped in their parts of the building. The site security guard was also locked in, and could not reset the system. In the end a couple of engineers had to smash the window into a server room, climb in, and reboot the computer. Only then did the doors unlock.
The system was abandoned, and an alarm firm further up the road came in to do a proper job ...
Doesn’t come close to meeting any known building code.
And their server room had a window? There’s your security hole, right there.
If there'd been a fire and the system failed (power cut?) we'd have been toast.
Oh, and the computer controlling the system might have been running a development version of the OS, not a stable one. Just to add to the hilarity.1 -
Boris Johnson telling Tory MPs at the 1922 “we must never forget… we are the party of low taxation” - the day after announcing a £12bn tax hike on workers to fund NHS and social care
https://twitter.com/singharj/status/1435651577633820681
Boris Johnson is committed to "low taxation" in the same way he's committed to "libertarianism".
They're things he cares about only as far as they directly affect himself.
https://twitter.com/AdamBienkov/status/14356572204910264380 -
I would have said 'in the same way he's committed to marital vows.'TheScreamingEagles said:Boris Johnson telling Tory MPs at the 1922 “we must never forget… we are the party of low taxation” - the day after announcing a £12bn tax hike on workers to fund NHS and social care
https://twitter.com/singharj/status/1435651577633820681
Boris Johnson is committed to "low taxation" in the same way he's committed to "libertarianism".
They're things he cares about only as far as they directly affect himself.
https://twitter.com/AdamBienkov/status/1435657220491026438
MAtch point!2 -
The fairy tale continues!!!!1
-
Told you, balls of steel......30/30, maasive ace, match point, hits net, totally calm....2
-
On at 100s! Smug City doesn't cover it. 🙂DecrepiterJohnL said:
9/2 now which is too short imo. Someone tipped her at 20/1 recently on pb, I think. Same price for her to win the US Open!Philip_Thompson said:
I wouldn't rule out the possibility of her winning it if she wins the US Open.FrancisUrquhart said:
She won't win it regardless of what happens in the US Open, but she has something special....again crucial 30/30, smashes a perfect Ace.Philip_Thompson said:
How often in an Olympic year has SPOTY gone to a non-Olympian?FrancisUrquhart said:Raducanu, balls of steel that lass...Saves 3 break points by pulling out blazing shots like she is practising down the local park.
The best seem to get better when the pressure is being turned up.
The amount of affection and support she won from Wimbledon was incredible - and if she follows that up with a Grand Slam she'll be a champion too. She has a great PR machine behind her . . . I could definitely see her winning SPOTY if she wins the US Open.
For the US Open, I mean, not Spoty.2