Security quotes of the week [LWN.net]

So in my head there's a little Walter Sobchak beating on my conscience and shouting "This is what you get when you trust Facebook with your data, Will".

The reason is that I upload photos to Facebook using KDE's shared uploader and this has fallen victim to the whims of FB's purge of its app biosphere. Unless the original developer can convince them that the app is not spammy, offering a bad experience or having the wrong attitude, the app, my photos (all archived elsewhere of course), but most importantly, all the kind comments from my friends and contacts that represent FB's only value, get sent to the farm.

-- Will Stephenson

There's a Dirty Harry sort of network going after the perps at this point. But like the vigilante cops in the movie of the same name, the urban legend value of what LulzSec is doing is difficult to ignore. Law enforcement officials are sure to catch up with "the gang" soon. Or so it is thought. If I were them, and I'm not, I would have already piled up mounds of misleading pointers to random people to distract investigations from finding who I was. I'm guessing a lot of innocents get caught in the dragnet. More lulz for twisted minds. I smell a Hollywood screenplay in the making.

-- Tom Henderson

LulzSec wasn't an isolated or unique phenomenon. People with passionate beliefs have been using new technological tools to effect change out of a sense of powerlessness. In the last year, I've watched 38 Degrees using the strength of association online to change government policy, WikiLeaks force transparency on those who'd rather run from it, even the amorphous mass that is Anonymous taking a stand on whatever issue they feel deserves their attention.

-- Loz Kaye

(Log in to post comments)

Trusting Facebook with data

Posted Jun 30, 2011 13:31 UTC (Thu) by stevem (subscriber, #1512) [Link]

Why are people surprised when they use Facebook and things like this happen? Facebook's entire business model is about screwing their users...

Trusting Facebook with data

Posted Jul 4, 2011 22:54 UTC (Mon) by jospoortvliet (subscriber, #33164) [Link]

You're exaggerating. If Facebook didn't properly provide a valuable service, nobody would use it. Surely they could do better and surely they do make mistakes which anger users (like this one) but that doesn't mean it's all bad - you don't build a multi-billion company around nothing...

EC2 instances cracking the most secure passwords

Posted Jul 7, 2011 15:13 UTC (Thu) by robbe (guest, #16131) [Link]

Depending on what Henderson beliefs to be a "most secure" password, it is either trivially crackable with an EC2 GPU instance, or quite safe.

http://stacksmashing.net/2010/11/15/cracking-in-the-cloud...
gives about 3.5 billion NTLM hashes per second, lets assume something like that. A 12 character upper/lower/digits password has 64 bits of entropy. Your instance will chew 83 years on that on average. So lets buy 83 instances instead, and drive them a year. According to http://blog.bottomlessinc.com/tag/cuda/ that will cost you 83 times USD 12,112 -- a little bit over a million. Bribery is cheaper, if the access is even worth that kind of money.

Stolen credit cards, even if you have a few thousands, will not help much. They won't last long enough.

Eight character passwords of the makeup? Won't last a day with a single instance.

EC2 instances cracking the most secure passwords

Posted Jul 7, 2011 23:38 UTC (Thu) by dlang (✭ supporter ✭, #313) [Link]

you are missing the scale of EC2

you don't buy 83 instances to reduce your time to a year

you buy 83,000 instances to reduce your time to ~8 hours

EC2 instances cracking the most secure passwords

Posted Jul 8, 2011 1:00 UTC (Fri) by njs (guest, #40338) [Link]

EC2 isn't magic. They don't have 83,000 idle servers sitting around waiting for you to show up and start paying for them.

https://aws.amazon.com/ec2/faqs/#How_many_instances_can_I...