Cheap GPUs render strong passwords useless

[loinburger]

There are probably at least a dozen modern art museums in the world that currently have toilets on display. However, their plumbing probably doesn't work, so it's unlikely that a plumber will ever work on an art piece.

[giblets]

The vast majority of people who hire plumbers are not looking for someone who can create beauty. They just want the toilet fixed.

[Hauldren Collider]

That's not what porn would have you know.

[notyoueither]

*sigh*

Perhaps I should ask you to elaborate on why you think it is not a good practice for developers to follow?

[Koyaanisqatsi]

For the same reason I already gave: it's generally a poorly implemented solution that assumes "private" information is actually private when it is easily discoverable. It's most often used as either a secondary authentication factor or for password recovery. Password recovery is the really bad part since it is essentially a proxy password that can be used to reset the real thing, turning easily discoverable information into information that is supposed to be private. All it does is add an attack vector.

As an authentication factor, there are a couple of problems. I already mentioned that it doesn't add much beyond a password since–even assuming we're only dealing with automated attacks–the answers to many questions are either minable now or will be soon. (The only reason this could be considered too sophisticated an attack or too much effort is all the other low-hanging fruit out there makes it unnecessary, but that's like the joke about not outrunning a bear, just outrunning your slowest friend.) The suggestion that people just fake their answers is fine for the users that understand what's going on, but if you think that's going to happen on a large scale there will be one of two results: either most people will ignore you and answer the questions honestly, or they'll try to follow the suggestion, promptly forget what their semi-related answer was, and end up calling support. Either way, not a good result for the majority of users who either gain very little protection or end up costing time and money to get squared away. Building a solution that requires users to follow unwritten instructions is just bad design.

There's also a bit of a security theater aspect to it. People feel more secure because those questions are there, but when the questions are trivial they're no more than a speed bump. But since they're there, users think their account is safe and developers aren't pressed to find a better solution. Yeah, SecurID was breached recently, but two-factor hardware authentication is one of the better solutions out there. Even NSTIC went in that direction, though I'm not exactly thrilled with a lot of their proposal. Despite this, non-techs look at these foolish little questions and think they're sufficient...there's even a court case right now that looks like it will rule them to be a reasonable security measure. Most of Europe already knows better, but because developers have pushed a half-assed solution we now have a US court that is about to declare it good enough.

[MikeH]

He's currently managing a team, across three continents and two planets, that is writing a programme that can auto-respond with pwnage. It will increase his productivity 327% (or thereabouts, the maths guys aren't available to explain it to him), giving him plenty of time to not write his own code.

ITYM "it will increase his productivity exponentially"!

Missed opportunity.

[Krill]

First class schools use something like this:

I graduated less than 2 years ago...and we had chalk boards?

[C0ckney]

That's not what porn would have you know.

[Asher]

I have a 30 minute 1 on 1 meeting with Bill Buxton this afternoon. Suck it, *****es!

If you don't know who he is, you don't care anyway.

I am excited.

One of his former pupils may have been one of Kuci's profs...

[Ben Kenobi]

Where is the math in steelwork and taxi driving?

Quite a bit of spatial reasoning. Knowing where you are and being able to calculate the fastest route from a to b? Most experienced drivers basically keep a city map inside their head. I know I did when I drove for years.

[Ben Kenobi]

However, their plumbing probably doesn't work, so it's unlikely that a plumber will ever work on an art piece.

That is just ****. Zero craftsmenship, just tossing stuff together and pissing all over everybody.

Ever try to design plumbing?

[Al B. Sure!]

Toilets are not objects of beauty. ****.

Ever heard of "Fountain" by Marcel Duchamp?

[loinburger]

Quite a bit of spatial reasoning. Knowing where you are and being able to calculate the fastest route from a to b? Most experienced drivers basically keep a city map inside their head. I know I did when I drove for years.

When did you come up with this "everything is either math or art" thing? Have you always believed it, or did you invent it for this thread?

[Barnabas]

BK OWNED YOU ALL

http://www.theartofplumbing.com/

[loinburger]