password advice

it's a shame this password advice always seems to fall on deaf ears. especially since memory aids are the only real way to stamp out password re-use - nothing that relies on the human brain scales enough to handle today's authentication demands.

passwords and sacred ... horses?

from XKCD

this has been discussed a lot recently in security circles because randall munroe gets a lot right here. unfortunately, for all his reasoned examination of password practices, he failed to question one of the most important sacred cows in password authentication - relying on human memory. when you take that out of the equation (ie. start storing passwords instead of trying to remember them) then the entire equation changes. no careful choosing of passwords, no reason to limit their size or contents, and no need to handle authentication like you're still in the stone age.

Y U NO HAVE BACKUPS

from here

maybe you've heard of malware that renders your data inaccessible and asks you for a ransom in order to get it back? yeah, if you simply have backup copies of that data then the ransomware is pretty much impotent.

mikko makes a funny

mikko hypponen (did i spell that right?) makes a joke about penetration testing.

now that i think of it, i bet outsiders probably think this exact way about pentesting when they hear that term.

security research documents

from here

if i may channel tyler durden for a moment, who wants some booger crayons? that "eeewww" you just heard in your head (or said out loud) is the same reaction i have when i go to look at some interesting bit of security research only to find out it's in the typhoid mary of file formats.

internet password book

we can thank @sanitybit for sharing this one on twitter.

in case you can't tell, that's a stack of post-it notes. you know, the same little bits of yellow sticky paper people are famous for writing their passwords on and then sticking onto their monitors - which, as far as security is concerned, is a joke.

there's a couple of ways the above could be interpreted - it could be a book for use in keeping track of internet passwords (ie. enabling the aforementioned bad security practice), or it could represent a compilation of existing attempts at keeping track of internet passwords (thus disabling the bad security practice by swiping people's password post-its). i'm hoping for the latter.

spam levels

from here (picture source)

the way spam is reported sometimes makes me wonder when it will reach the point that it's actually oozing out of our computers.

don't encourage them!

from virtual shackles

i can't help but think if people actually gave TSA agents tips for groping them it would encourage further erosion of our liberties. then again, considering how much legal hot water a person would likely find themselves in if they actually managed to have a "happy ending" to a TSA grope session, how much to tip would probably be the least of their concerns.

Y U NO CARE

from here

you really have to wonder about money mules (the people who receive the money stolen from victims and then forward it on to the actual thieves). has it never occurred to them that what they're doing is illegal or wrong or that they might be the next victim?

anti-spam merchandise

hey, want to help support some great anti-spam operations and get cool stuff out of the deal at the same time? well it turns out that both knujon (who help get the people sending you spam shut down) and spamgourmet (who help keep the spammers from ever getting your email address in the first place) have stores on cafe press (knujon's store and spamgourmet's store).

check them out, they've got a lot more available than what i'm showing here. i'm not one to indulge myself when it comes to material things, but my family always wants to know what to get me for christmas/birthdays so i'll be picking a couple things from those stores to add to the list.