Linked by Howard Fosdick on Sat 10th Nov 2012 07:28 UTC
Bugs & Viruses If you want to ensure you have adequate passwords but don't have the time or interest to study the topic, there's a useful basic article on how to devise strong passwords over at the NY Times. It summarizes key points in 9 simple rules of thumb. Also see the follow-up article for useful reader feedback. Stay safe!
Thread beginning with comment 542305
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[21]: make 'm long
by Laurence on Tue 13th Nov 2012 12:48 UTC in reply to "RE[20]: make 'm long"
Member since:

I probably should apologize for the crappy tone of me recent posts. But in all seriousness, the confusion is entirely at your end. You kept confusing the different stages of the process and raising hypothetical arguments of attacks (which you're somehow now blaming me for?)

If you did a little research into this you'd see the circular arguments you keep raising, and then when you started accusing me of the above, well it's no wonder I lost my temper.

I'm sure you've had similar arguments with people where they've failed to grasp basic concepts then accused you of switching contexts because they were incapable of wrapping their heads around the basic theory you were trying to outline.

You don't strike me as unintelligent, so this clearly isn't beyond you; however the arguments you raise made little sense. So I really do suggest you do a little reading up on security blogs (and I mean ones written by respected pen testers - there's a lot of idiots out there who publish grossly misleading (and often down right inaccurate) information). It's scary just how sophisticated some attacks are (which is why I'm a huge advocate of using key based systems to do away with passwords; and using automatic firewalling for the few systems that are dependent on password authentication).

Even just outside of my main job, I do some freelance consultancy and it's pretty alarming just how many servers are exposed to easy attacks due to the administrators running default config (eg no adaptive firewalling, chroot sandboxing, user separation, insecure daemon defaults (eg server tokens enabled in apache) and running local daemon listener on

Security is quite an in-depth and highly specific subject, so it grinds my gears when bad / outdated advice is given so publicly, or when good advice is ignored (particularly if it appears to be ignored purely out of pride).

Anyway, rant over ;)

Reply Parent Score: 2