Well, by the time it hits anywhere that is relatively public, it's encrypted in some fashion. Since most places need to be able to do a password recovery, it has to be in something more open than md5. People get all pissy when they can't get their password back when they forget it.
I do agree with your spyware/keylogger statement. I don't log into anything important from Windows machines, and I'm fairly sure my *nix workstations are safe. No open services, behind a firewall, where I'm the only *nix user who has physical access.
Ahhh, Slashdot. The place where people don't read the whole article or post. You just find any flaw and bitch about it. You didn't even read the whole line, or you'd see me saying almost exactly what you said.
I do get shadow, both for the shadow password geek group, and for being a cool thing, like "the shadow knows..." Ya, old, but...
As for the others, I have no clue. I had tried to paste in about 200 of them, mostly for entertainment value, but Slashdot doesn't allow lists. It considers it junk. I couldn't manage to get around the junk filters.
I'm guessing on Maggie, is that in our demographic (err, guys between 18 and 80), there was a high ratio of women named Margaret to whom they were affectionally attached (married, dating, etc). I'd say the mother's name, but that kinda weirds me out.
I can guess they are single words from sexual phrases..
spank the monkey nut buster (like, bust a nut.) ass bandit (like, butt pirate?)
They're only guesses. I'm sure anyone who actually used those words in their password and read it here, is not only changing their password right now, but too embarassed why they used the password 'monkey' to say why.:)
Many devices in retail stores use the store's number as it's password. For example, we were in a large chain grocery store, and they had a Kodak photo-printing station. I was a bit drunk at the time (wheee), and bored with checking out. I was with a few roommates (it was croweded then), so I wandered over to the Kodak station. Oh look, a password prompt for admin.. What should I do? "admin", "password", "passwd", "1234", "12345". Ok, no real easy ones. Then my roommates were done. I looked on their receipt, and there was the store number. I punched that in, and had full access. I could change all kinds of fun things, but since my roommates were leaving, I logged out and left with them.
I'm not sure if it's good or bad that I can crack passwords while I'm good and drunk.. Actually, if I hadn't been, I wouldn't have bothered..:)
I knew a guy who wrote 'door' games for BBS's. He was the first person to tell me that "every" program out there has a back door somewhere in it, that will give the author free roam of the host system. He would put a keyword in somewhere, that would open up a command.com session that would let him do anything he wanted. Ya, this is way back..
Since then, I've written plenty of stuff. I can't think of anywhere I've ever put in a back door or hardcoded password. Very occasionally, I may do:
if ("$password" eq "mypassword"){
$auth = 1; };
But if I do, it's because I suspect the original author's password validation was completely broken, and I wanted a quick and dirty way around it. Statements like that never stay around for more than a minute or two, and never make it to a live site.
I suspect there may be people out there that *DO* put back doors in. I also know they are the ones who will be ripped a new one, when it shows up on the Internet, and the company is embarassed over it.
I am definately one of those people who doesn't like to be embarassed, nor ripped a new one, therefore nothing I ever put out there will ever have a hardcoded password nor backdoor in it.
Since I write in scripting languages, it's pretty freakin' easy for anyone who gets something from me to verify this.:)
You forgot to mention that your cat's name is "M13Kytt1K@t"
Translated out to spell
"Mie Kytti Kat"
or spoken
"My Kitty Cat":)
Don't forget though, crypt is (usually) only signficant to 8 characters, so it would only care about the last four of your social, and the first four of your cat's name.:)
> The locksmith just changed my locks! Did he keep a copy? Is he trustworthy? I don't know... Shit!
I always like this.. A good locksmith would know how to pick the lock. A smart locksmith would have noticed that you leave your downstairs window unlocked.
My father used to tell me, locks are for honest people. I agree.
Several times, in nicer office buildings, I've found myself locked out of offices where I should be allowed. They use a special 'security' key, which is one or two tumblers longer than a regular key. I've opened them in about 10 seconds with a car key and a credit card. Sometimes I've found it easier to just pop the drop ceiling out, and climb over the wall too, assuming there is no firewall between point A and point B. Usually inside offices don't have them.
But, when it comes down to it, if I wanted to get into your house badly enough, I'd just kick in the door. I have yet to find anyone who uses a New York deadbolt other than me.:)
I went to a "secure" facility a few weeks ago. I was inside a 'mantrap', waiting to be allowed through. I started laughing at the guard, after he took too long to let me through. The guard didn't understand why. Their "security" guard was behind 2 inch thick security glass. The frame around it was steel. The door had steel bars on it, and a pry guard. He pointed all of this out to me, and I laughed again.
Someone had swung the door open too far a few times, and knocked a grapefruit size hole in the drywall. I knocked on the wall right under the bullet proof window. It was just more drywall. I then asked "What would happen if I shot through here? What would happen if I knocked a hole in the wall, and put 12v to the door latch solinoid? I would be in, and no one would find you until shift change."
Ok, it could have been other voltages, I was just screwing with him.:)
Ya.. There aren't too many places that are really 'secure'. It's simply a matter of how much risk a person is willing to accept in the entry to said facility. In the above case, it was easier to ask "will you please open the door now?" He stopped giving me grief every time I came through. He already knew I was authorized.
Some sites allow users to select their username, some don't. Some set arbitrary passwords, some don't.
If you're real lucky, you may find a combination like "user:pass". But why should anyone think someone who has the username of "bullshit" has the password of "my_password", and everyone who's chosen the username of "bullshit" would select the same one.
We've had many users complain that their username was taken. It's always funny too, on common first names, or something simple like that. How many username "bob" can there be?;)
More than likely, he's finding multiple sites in the same 'family' of sites. I've seen that happen before. Buying a membership at one site will allow access to many, usually because they use the same password file on the same server.:) In those cases, obviously it will work.
The password sites do work though.
I've become very familar with passwordz sites over the years. We were hit pretty hard when we started doing one of the largest on the Internet. We have a bot who builds pretty interesting reports for us, and I had included the sites which we were linked on.
Most people are using something like 'AccessDiver'. Many sites now set firewall rules against IP's using those tools, start showing them a bogus valid login page, or any of a number of tricks to mess with them. I know some of the 'hackers' were using multiple proxies after a while, but really, when you have to do tens of thousands of attempts to even think you're getting one password, how many proxies could you possibly have at your disposal.
When we see x number of attempts come in from an IP, it gets blocked. If we see that a valid password was acquired in the attempes from that IP, we automatically change that password, and notify the user. We have a few other tricks too. I very rarely see our sites showing up any more, simply because by the time they get a password posted, it's no longer any good. It does the same thing to the casual 'hacker', so if you start scanning through multiple proxies and leave for a while, when you get back, you still won't have a good password.:)
I use hacker in quotes above, because they're not real hackers. They're barely crackers. I classify them with script kiddies. They found a tool, run it, and now they've accomplished something with no work. They don't know how it happened, they just know it did.
This is always a fun game. I won't say what site it's for, but it is adult. This is the top 20 from 600,000 expired accounts. Checking the top 1000 common passwords, I don't see a single strong one. I know, it shouldn't, since I'm grouping by count. I suspect this list will apply almost everywhere in very similar ratio's.
SELECT COUNT(pass) AS count, pass FROM `users` WHERE expired = 1 GROUP BY pass ORDER BY count DESC
When a site password is compromised, the system automagically sets a strong password, and notifies the user. They get rather upset about that. I tell them, "You should have used a good password to start with." We will let them change it back to something else, but we won't let them use anything easy.
There's a long explanation I was told about the impact of porn on the world.
The major reason that home video players, cameras, and cable TV exist are pornography. The reason the Internet is the scale that it is, is due to pornography. Of course, it goes much farther back than this, but we'll stick with modern examples.
Before home video players were available, people read their smut magazines, go to peep shows, or visit their local house of ill repute. When VCR's hit the market, there was no such thing as Blockbuster. VHS and/or Betamax porn was available by mail order, or shared between friends. Major motion picture companies got into the business, and it thrived, but every video store had it's "adult" section.
For Joe consumer, it's hard to explain that he had something in the home for the exclusive reason of watching porn. Now that major motion pictures were available, he could buy the video player, with the "reason" of buying it to entertain the kids. The real reason was so he could watch something which was much better than looking at still pictures in a magazine, and not need to visit a peep show or whore house.
The first DVD's I saw on the market were in adult video stores. This was not a small market either. It's a multi-billion dollar industry. Most homes had a DVD player on their computer before they had one for the living room.
The Internet itself is the size it is, because of pornography. Sending text messages and email are trivia and low bandwidth, but people digitized and shared their favorite pictures, and wanted to send them around. We'd still be operating on a collection of T1's if it weren't for the 'need' to send large pictures and movies around.
I was monitoring one of the major search engines for years, to see what keywords people were searching for. Most of the top 10 single words related to free porn. "free sex pic picture pictures". More of the top 10 were "a and the of warez".
Why do hosting companies have GigE and high end OC lines? Because the demand exists. If the demand for traffic didn't exist, the technology would have never been innovated. Streaming media is a great example of this. It showed up on porn sites first. It then started showing up on mainstream sites. You wouldn't be able to watch news clips on CNN if it weren't for the technology being developed by porn sites.
So, what have *I* personally done? I've contributed patches to several popular software packages and loaned out our high load servers to projects to test in high load environments. I've written some amazing software, and when the time was right, shared with indivduals who could use it. When I give out software and/or programming examples, I always tell the people I give them to "feel free to share this." I've seen plenty of my programming show up in other places.
The company I work for has contributed itself. We've paid out millions of dollars to our Tier 1 providers for bandwidth. We also communicate with them frequently regarding bandwidth problems. When we risk having a few million screaming customers, it's better for us to let the bandwidth provider know of existing problems. We've also spent a small fortune for hardware. When we put in an order for hardware, we usually shock the vendor. "Hey, I need 50 high end 1u servers". That's not a typical order for most companies. We do it rather frequently.
It's due to companies like ours that online credit card processing is at the state that it is now. We pass millions of dollars through online payment gateways. They know they must make the technology work well, if they expect to make their percentage of the sales. Even credit card companies have made a tremendous profit due to our work. It's no
You know, it's a job. I get up every morning, check a bunch of reports, and get into my administrative and programming tasks, just like a decent portion of the folks on here.
Before I worked here, I worked for a mainstream hosting company. 8 (or so) years ago, we had 30,000 customers. They sucked up a whopping 4Mb/s of bandwidth.. It was a good size hosting company.
When I switched over to working for an adult company, it was a complete shock. No, not the porn part, because I don't even look at that. Just the fact that any given site gets so much traffic. We had a single T3 at the time, which grew dramatically. I have 4 GigE circuits at my disposal, and will be adding more in soon. The growth is in the user base. More and more people are coming to the site, because that's what they want.
Look at it this way. Slashdot is ranked #849 on Alexa. Voyeurweb is ranked #319. Pick any of your favorite sites, and you'll find the majority have lower traffic? Do you know why? Because people view porn. The odd part about porn is that most people deny publically that they view it. You posted the safe response. "ooh, who cares", but judging by that response, you are a viewer. If not of our site, of another porn site. That, or you buy porn PPV on cable, or have an extensive magazine and/or DVD collection.
If people viewed mainstream sites more than porn, well, I'd be working at a mainstream company.
I agree completely. It's a bunch of BS. Porn will still show up on every domain that exists. The idea of trying to enforce it, while still theoretically feasable, means the almost certain death of every existing porn site. I'll use the site that pays my paycheck as an example. voyeurweb.com. According to Alexa, it's #319 of all web sites. With an average of close to 2 million unique visitors daily, or 9 million uniques weekly, it would be very hard to explain to them that there is a new name. Surely if we weren't in on the first minutes of the XXX registrations, people are going to be snagging up voyeurweb.xxx, right along with every slight variation of the name. There are hundreds of thousands of pages that link to some *.voyeurweb.com page. There are plenty of companies who are different with different TLD's on the same name, so it will be a huge name grab and years of threats and lawsuits before the dust settles.
Along with that, we have several pay sites. The biggest headache will be proadult.com, which is a hosting service. There are roughly 80,000 sites which use proadult.com for authentication. Those 80,000 sites are either under the *.redclouds.com domains, or under their own domains, the majority of which are also.com's. There will be literally hundreds of thousands of pages to fix to make it work. Most webmasters are almost as bad as regular users. They created their site once, and don't have the technical ability to update all of their pages. If they do, they recognize that it would take a long time to accomplish it.
Porn site users are your average user. Tell your average user to update their bookmarks, and they'll give you a technical blank stare. "How do I do that?" Judging by support emails, I'm surprised that most users can even get to a web page.
The logistics nightmare has little to do with this story though. The US government has millions or even billions in tax dollars at risk. I know just our companies pay out millions in taxes.
The move won't "kill" the adult industry, but it will sure make for headaches for some time. Every link on every site will need to be changed. All the search engine rankings will go away for a short time, which is probably a good thing considering the abuses so many webmasters have done over the years.
The control issue for the US is a biggie. The US Government loves to have the power to tell the world what to do. For the Bush administration, they love the power to say "put this on the back burner for a couple years". Back at the tax dollar issue, if it goes past this administration, the sudden drop in tax money will be the next administration's headache, and for a federal budget that's already screwed, they can blame the next administration for any headache's that it brings on itself.
We all know perfectly well that there will be plenty of.com sites running porn after any mandated change. We'd be more than happy to comply, and we'd ensure all of our hosted sites complied, but there will always be some winner who wants to stay with a.com for whatever reason. The biggest one I can think of right off is spam. When.com is now a "safe" TLD, spammers will get bigger returns by advertising a.com. Sure, they can lose the domain within a few days, but spammers work under that assumption now. They give themselves a window between 1 and 3 days, from when they start a spam campaign until they either have the site or their internet connection shut down. For us, if we receive a valid spam complaint, the webmaster will get their site shut down. Any provider in a major country who likes to keep in good terms with their provider does the same thing.
All in all, it will do very little to clean up the Internet. The best way to clean up the Internet is for **USERS** to do it. Don't spend money on sites that us
User stupidity is a huge factor. People are lazy, so they will do stupid things. If it's a voice confirmation, they'll just say "yes", rather than give updated addresses every time they move the device. If it's a web based utility, given the choice of hitting "yes, this is current", or keying in a new address, they'll hit yes.
While it's still their own dumb fault, it's not going to make E911 work any better.
I believe the first phase of E911 was to locate the caller to the nearest tower or CO. The second phase was to locate the caller to within 100 feet of their physical location. For cell providers, this is to be provided by the handset, which would indicate GPS coordinates. I had to look it up for this reply, so I'm fairly sure on the accuracy of this statement, even though I couldn't find the data spec listed on the FCC's site.
Since all the cell providers still aren't putting GPS receivers in their phones, the whole thing is still worthless.
I played with the GPS receiver in my Nextel phones (several models), and had very poor results. It would take several minutes for it to find my coordinates, and in a moving situation, the lag was so bad I was frequently miles from where it started listening for results.
You are correct about the telephony technology being way ahead of the E911 plan. Calls can be routed virtually anywhere through many different systems, which leaves the idea of dialing 911 and getting the right operator way off. I did business with an location in Los Angeles, where any outbound calls were run through their Florida location. Most people in the location didn't know it worked that way, and in an emergency, they would just hit an open line and dial 911.
I tried Asterisk once. It was too difficult to work, for the attention span that I had for it (about 30 seconds). I know other people that have it up and running fine. I'm sure if I had spent a full minute or two on it, I could make it do tricks.
I like Vonage, where you just plug it in, and it works. The best feature that it has, is the multi-phone ring. I have it ring my POTS line, and my cell phone, with phone numbers in several cities. Everyone that contacts me on a regular basis has a local number. I honestly haven't even plugged in the VoIP modem in two months, because my equipment has been rearranged several times. I will soon, my girlfriend wants the POTS line for herself. She's adopted my handsets, so I have to buy new phones for myself now.
I was really upset to find that out. I have a personal grudge against Sprint, so when Nextel merged, I refused to continue service with them. Yes, Cingular doesn't d GPS in their handsets, and won't for another year.
I got the top of the line Motorola phone from Verizon Wireless, which doesn't have E911 service either. So, no big deal. Hopefully they'll route me to the 911 call center that's closest to the tower. Otherwise, I'll get someone in India who won't know where I am.. They're proabably outsourcing 911 service now anyways.
Say there's an emergency. Someone in the house grabs what looks like a regular house phone, and dials 911. They get the wrong emergency operations operator, and have to be directed through to the correct one.
Of course, that happens anyways. I had a 3 year old who injested several pills. My call got transfered to law enforcement, who transfered to the fire department, who transfered to the paramedics, who transfered to poison control, I gave them the description of the pills we suspected he took (name, dosage, etc). He then told me "Get to the hospital as fast as you can. The first responder will probably be 20 minutes". That was the scariest drive of my life. I was blowing through red lights in a town I wasn't familiar with to get to the hospital. I was there in 10 minutes. And yes, he was fine.
You didn't check the URL in my profile, did you? Tin Foil Hat service is my speciality. I filter the crud from the truth, and try to educate people about what's happening around them. Sorry if I sounded like the Tin Foil Hat crowd with my first message. I sometimes forget that some people don't realize where I usually run stories at.
I'd put it at about 75% public safety, and 25% government influence. Probably that 25% is being really loud (behind closed doors, of course) about wanting it.
I've had a few occasions to dial 911. I have yet for them to know where I am. When they're asking, they're not asking for a confirmation of where I am. They're asking and I give the cross streets. Then they ask again, because they have no clue of where I'm explaining. That's been both with land lines, and E911 enabled cell phones.
If you research around a bit, you'll find that E911 is FAR from being universally implemented in the United States.
I've seen that occasionally. It usually has to do with poor internet service. Sometimes the CID wouldn't come through, and usually the call sucks at that point. Since I love my statistics, I graph almost everything, and can usually see poor throughput on the internet connection when that happens.
I lived in a hotel (site work) for two months. I had a wireless bridge, making my AP talk to the hotel's wireless connection. I then had two machines and my VoIP set up. Their service was up and down all the time. I'd only go complain if it was down for more than 30 minutes.. Every time I got to the front desk when their service was down, they'd tell me before I told them. "Ya, we know our service is down. It should be back by morning."
I believe part of the wireless argument was that they needed to get newer handsets out to their users, with GPS capability. Without that, they had nothing.
VoIP can be on virtually any hardware, and worse, they are used almost exclusively indoors, so GPS won't work. They don't have a solid solution for tracking where the caller is, other than the caller being honest and giving a good address for them to find the user at.
At very best, they could request that every IP holder give a physical address to where the IP is being used at.. That would mean a central database for all IP usage. No, such a thing doesn't exist. I have several/24's, in several different places. I'm playing with setting up a VPN server in each location, so any of our trusted users (i.e., me) can set up their laptop or PC, and connect to the closest VPN server. Since I, as the SysAdmin of a small company, would need to report the physical address of each user as they connect. Not freakin' likely. On top of that, if say I, as the mobile user, decided to do something bad, I would obviously report a wrong address.
I'm a Vonage user, and have been for several months now.
They've requested every user to provide a street address to their Vonage service.
Unfortunately, this doesn't address the obvious problem with that. I, as a Vonage user, can plug my modem in anywhere. If I go to a friends house in another state or country, my phone numbers go with me.
I, being technically adept, know that 911 won't work properly. I won't dial 911 from that phone.
I like to have a phone number that isn't associated with a physical address, for various reasons. If I decide to sit down at a hotel in Moscow, and set up a VPN to make myself look like I'm in another country (say Canada), now I'll have an IP in Canada, with a phone number in America, but I'm sitting in Russia. The whole reason for doing this 911 thing isn't totally so emergency response can show up in case of emergency, while that is a nice feature. It's so the government can show up, should they have a phone number associated with someone doing something they don't like. I've noticed they've left the magic work "Terrorist" off this issue entirely.
With POTS lines, they obviously go to an address, or somewhere very close. (cordless phone, or max wire length from that location).
With Cell phones, E911 service reports the GPS coordinates. They are also traceable by cell towers and triangulation.
With VoIP, at most they may get an IP, but at worst, you can make phone calls from anywhere, pretending to be anywhere else. That doesn't make the government very happy.
I had BBS's, and FidoNet (along with a few more obscure ones).
We had fairly established, while unregulated networks. I won't say communication was fast, but it was there. I don't really need to review the wonderful capabilities of BBS's. Probably 25% of the folks who read here were users when BBS's were big.
Could the internet be reinvented? Sure. But, like any large platform, it started small. The next Intranet is being built by a half dozen teenage kids in their darkend bedrooms around the world. It isn't anything now, but will be the biggest thing the world has seen.
It's not perpetual motion. It always needs a power source.
It would use electricity generated by the engine's alternator/generator to split the water. The hydrogen and oxygen would then be fed into the engines intake. The engine would burn that, and poof, magic smoke.
100% emissions reduction and 10% to 40% improvement in fuel consumption?? How much energy do you think is in a gallon of water??
It won't work though. I've been reading about the same idea for years. I believe the first thing I read on this was a text document, back in the 1980's. There are kits and how-to's on the subject. This guys idea is nothing new. He just put it in a metal box and is offering it for $7,500/ea.
The whole concept is pretty simple.
If you put an electrical charge to water, hydrogen will come off of one electrode, and oxygen will come off of the other one. Trap that, and put it into the intake somewhere in the sealed part of the system (after the air filter somewhere).
The car engine is the source of the electricity to make this happen. The water must be supplied independently, or captured from somewhere like the air conditioning system. Most of the plans I've seen all have a gallon bottle of distilled water.
The best one I saw was a guy with an old 4WD truck, who claimed over 100mpg, where he typically got 15mpg before the "conversion".
I thought of doing it on my car, just for laughs. It's an interesting idea, but for the amount of hydrogen and oxygen you could produce, it wouldn't be worth while.
It ***COULD*** work, but he clearly indicates that his method isn't that way. If you were able to split enough water to run the engine on, that would be great. But countries who have *REALLY* been doing hydrogen vehicle conversions on *REAL* vehicles can't produce enough hydrogen on the fly to make it happen. Right now, you just can't do it. And with a refill every 80 hours (note he says hours not miles), that's worthless.
Think.. 80 hours.. 60mph. We're talking a distance of roughly 4800 miles. I say 60mph, because that's my average speed on the highway during long distance drives (like coast to coast). I don't know how much water he's suggesting to use. In my TransAm, I get 26mpg (gas) on the highway. I would need 184 gallons of premium gasoline to achieve his 4800 mile refueling status. What ratio of gas to water is he suggesting? Obviously not even 10 gallons, if he expects it to fit in your average street car without some serious sacrifices.
I've seen race cars (much lower class than you'd usually see on TV), with multiple gearshifts. For external linkage transmissions, you could have one shift lever where each shifter linkage attaches. On a 4 speed transmission, you'd have 3 linkages (1-2, 3-4, R)
At that point, a racer putting in the extra shifters, as primitive as they may be, has redesigned his UI to give him that more finite control.
But, how to you explain to someone else driving the car:
To shift into first, adjust the levers up, center, center. To shift from second to third, adjust the levers from down, center, center, to center, up, center.
Most of the racers I knew skipped the 1-2 lever all together, and just started rolling in 3rd.
Some people can't even manage that. They're the ones that stick with automatics.
And....
I had a badly worn shifter in a higher end street car once. Occasionally, shifting from 2nd to 3rd would push both the forward linkages, and somehow pop into both 1st and 3rd at the same time. I've never been much of a transmission person, so I have no clue why it didn't destroy the transmission. Once it got into that position, it took a hammer and pry bar to get it back out. It did that twice, before I gave in and bought a new shifter.
Slashdot Mirror
Well, by the time it hits anywhere that is relatively public, it's encrypted in some fashion. Since most places need to be able to do a password recovery, it has to be in something more open than md5. People get all pissy when they can't get their password back when they forget it.
I do agree with your spyware/keylogger statement. I don't log into anything important from Windows machines, and I'm fairly sure my *nix workstations are safe. No open services, behind a firewall, where I'm the only *nix user who has physical access.
Ahhh, Slashdot. The place where people don't read the whole article or post. You just find any flaw and bitch about it. You didn't even read the whole line, or you'd see me saying almost exactly what you said.
I do get shadow, both for the shadow password geek group, and for being a cool thing, like "the shadow knows..." Ya, old, but...
As for the others, I have no clue. I had tried to paste in about 200 of them, mostly for entertainment value, but Slashdot doesn't allow lists. It considers it junk. I couldn't manage to get around the junk filters.
I'm guessing on Maggie, is that in our demographic (err, guys between 18 and 80), there was a high ratio of women named Margaret to whom they were affectionally attached (married, dating, etc). I'd say the mother's name, but that kinda weirds me out.
I can guess they are single words from sexual phrases..
spank the monkey
nut buster (like, bust a nut.)
ass bandit (like, butt pirate?)
They're only guesses. I'm sure anyone who actually used those words in their password and read it here, is not only changing their password right now, but too embarassed why they used the password 'monkey' to say why.
Some are pretty freakin' obvious.
:)
Many devices in retail stores use the store's number as it's password. For example, we were in a large chain grocery store, and they had a Kodak photo-printing station. I was a bit drunk at the time (wheee), and bored with checking out. I was with a few roommates (it was croweded then), so I wandered over to the Kodak station. Oh look, a password prompt for admin.. What should I do? "admin", "password", "passwd", "1234", "12345". Ok, no real easy ones. Then my roommates were done. I looked on their receipt, and there was the store number. I punched that in, and had full access. I could change all kinds of fun things, but since my roommates were leaving, I logged out and left with them.
I'm not sure if it's good or bad that I can crack passwords while I'm good and drunk.. Actually, if I hadn't been, I wouldn't have bothered..
I knew a guy who wrote 'door' games for BBS's. He was the first person to tell me that "every" program out there has a back door somewhere in it, that will give the author free roam of the host system. He would put a keyword in somewhere, that would open up a command.com session that would let him do anything he wanted. Ya, this is way back..
Since then, I've written plenty of stuff. I can't think of anywhere I've ever put in a back door or hardcoded password. Very occasionally, I may do:
if ("$password" eq "mypassword"){
$auth = 1;
};
But if I do, it's because I suspect the original author's password validation was completely broken, and I wanted a quick and dirty way around it. Statements like that never stay around for more than a minute or two, and never make it to a live site.
I suspect there may be people out there that *DO* put back doors in. I also know they are the ones who will be ripped a new one, when it shows up on the Internet, and the company is embarassed over it.
I am definately one of those people who doesn't like to be embarassed, nor ripped a new one, therefore nothing I ever put out there will ever have a hardcoded password nor backdoor in it.
Since I write in scripting languages, it's pretty freakin' easy for anyone who gets something from me to verify this.
You forgot to mention that your cat's name is "M13Kytt1K@t"
Translated out to spell
"Mie Kytti Kat"
or spoken
"My Kitty Cat"
Don't forget though, crypt is (usually) only signficant to 8 characters, so it would only care about the last four of your social, and the first four of your cat's name.
> The locksmith just changed my locks! Did he keep a copy? Is he trustworthy? I don't know... Shit!
:)
:)
I always like this.. A good locksmith would know how to pick the lock. A smart locksmith would have noticed that you leave your downstairs window unlocked.
My father used to tell me, locks are for honest people. I agree.
Several times, in nicer office buildings, I've found myself locked out of offices where I should be allowed. They use a special 'security' key, which is one or two tumblers longer than a regular key. I've opened them in about 10 seconds with a car key and a credit card. Sometimes I've found it easier to just pop the drop ceiling out, and climb over the wall too, assuming there is no firewall between point A and point B. Usually inside offices don't have them.
But, when it comes down to it, if I wanted to get into your house badly enough, I'd just kick in the door. I have yet to find anyone who uses a New York deadbolt other than me.
I went to a "secure" facility a few weeks ago. I was inside a 'mantrap', waiting to be allowed through. I started laughing at the guard, after he took too long to let me through. The guard didn't understand why. Their "security" guard was behind 2 inch thick security glass. The frame around it was steel. The door had steel bars on it, and a pry guard. He pointed all of this out to me, and I laughed again.
Someone had swung the door open too far a few times, and knocked a grapefruit size hole in the drywall. I knocked on the wall right under the bullet proof window. It was just more drywall. I then asked "What would happen if I shot through here? What would happen if I knocked a hole in the wall, and put 12v to the door latch solinoid? I would be in, and no one would find you until shift change."
Ok, it could have been other voltages, I was just screwing with him.
Ya.. There aren't too many places that are really 'secure'. It's simply a matter of how much risk a person is willing to accept in the entry to said facility. In the above case, it was easier to ask "will you please open the door now?" He stopped giving me grief every time I came through. He already knew I was authorized.
Your friend was full of shit. Well, mostly.
;)
:) In those cases, obviously it will work.
:)
Some sites allow users to select their username, some don't. Some set arbitrary passwords, some don't.
If you're real lucky, you may find a combination like "user:pass". But why should anyone think someone who has the username of "bullshit" has the password of "my_password", and everyone who's chosen the username of "bullshit" would select the same one.
We've had many users complain that their username was taken. It's always funny too, on common first names, or something simple like that. How many username "bob" can there be?
More than likely, he's finding multiple sites in the same 'family' of sites. I've seen that happen before. Buying a membership at one site will allow access to many, usually because they use the same password file on the same server.
The password sites do work though.
I've become very familar with passwordz sites over the years. We were hit pretty hard when we started doing one of the largest on the Internet. We have a bot who builds pretty interesting reports for us, and I had included the sites which we were linked on.
Most people are using something like 'AccessDiver'. Many sites now set firewall rules against IP's using those tools, start showing them a bogus valid login page, or any of a number of tricks to mess with them. I know some of the 'hackers' were using multiple proxies after a while, but really, when you have to do tens of thousands of attempts to even think you're getting one password, how many proxies could you possibly have at your disposal.
When we see x number of attempts come in from an IP, it gets blocked. If we see that a valid password was acquired in the attempes from that IP, we automatically change that password, and notify the user. We have a few other tricks too. I very rarely see our sites showing up any more, simply because by the time they get a password posted, it's no longer any good. It does the same thing to the casual 'hacker', so if you start scanning through multiple proxies and leave for a while, when you get back, you still won't have a good password.
I use hacker in quotes above, because they're not real hackers. They're barely crackers. I classify them with script kiddies. They found a tool, run it, and now they've accomplished something with no work. They don't know how it happened, they just know it did.
This is always a fun game. I won't say what site it's for, but it is adult. This is the top 20 from 600,000 expired accounts. Checking the top 1000 common passwords, I don't see a single strong one. I know, it shouldn't, since I'm grouping by count. I suspect this list will apply almost everywhere in very similar ratio's.
SELECT COUNT(pass) AS count, pass
FROM `users`
WHERE expired = 1
GROUP BY pass
ORDER BY count DESC
| count | PASSWORD |
| 1322 | password |
| 994 | 123456 |
| 824 | 12345 |
| 569 | harley |
| 536 | 696969 |
| 434 | mustang |
| 385 | qwerty |
| 355 | baseball |
| 307 | football |
| 305 | hunter |
| 305 | letmein |
| 296 | shadow |
| 294 | pussy |
| 279 | maggie |
| 276 | monkey |
| 265 | golfer |
| 260 | buster |
| 260 | 12345678 |
| 255 | bandit |
| 241 | nascar |
When a site password is compromised, the system automagically sets a strong password, and notifies the user. They get rather upset about that. I tell them, "You should have used a good password to start with." We will let them change it back to something else, but we won't let them use anything easy.
My impact on the world. Hmmmmm....
There's a long explanation I was told about the impact of porn on the world.
The major reason that home video players, cameras, and cable TV exist are pornography. The reason the Internet is the scale that it is, is due to pornography. Of course, it goes much farther back than this, but we'll stick with modern examples.
Before home video players were available, people read their smut magazines, go to peep shows, or visit their local house of ill repute. When VCR's hit the market, there was no such thing as Blockbuster. VHS and/or Betamax porn was available by mail order, or shared between friends. Major motion picture companies got into the business, and it thrived, but every video store had it's "adult" section.
For Joe consumer, it's hard to explain that he had something in the home for the exclusive reason of watching porn. Now that major motion pictures were available, he could buy the video player, with the "reason" of buying it to entertain the kids. The real reason was so he could watch something which was much better than looking at still pictures in a magazine, and not need to visit a peep show or whore house.
The first DVD's I saw on the market were in adult video stores. This was not a small market either. It's a multi-billion dollar industry. Most homes had a DVD player on their computer before they had one for the living room.
The Internet itself is the size it is, because of pornography. Sending text messages and email are trivia and low bandwidth, but people digitized and shared their favorite pictures, and wanted to send them around. We'd still be operating on a collection of T1's if it weren't for the 'need' to send large pictures and movies around.
I was monitoring one of the major search engines for years, to see what keywords people were searching for. Most of the top 10 single words related to free porn. "free sex pic picture pictures". More of the top 10 were "a and the of warez".
Why do hosting companies have GigE and high end OC lines? Because the demand exists. If the demand for traffic didn't exist, the technology would have never been innovated. Streaming media is a great example of this. It showed up on porn sites first. It then started showing up on mainstream sites. You wouldn't be able to watch news clips on CNN if it weren't for the technology being developed by porn sites.
So, what have *I* personally done? I've contributed patches to several popular software packages and loaned out our high load servers to projects to test in high load environments. I've written some amazing software, and when the time was right, shared with indivduals who could use it. When I give out software and/or programming examples, I always tell the people I give them to "feel free to share this." I've seen plenty of my programming show up in other places.
The company I work for has contributed itself. We've paid out millions of dollars to our Tier 1 providers for bandwidth. We also communicate with them frequently regarding bandwidth problems. When we risk having a few million screaming customers, it's better for us to let the bandwidth provider know of existing problems. We've also spent a small fortune for hardware. When we put in an order for hardware, we usually shock the vendor. "Hey, I need 50 high end 1u servers". That's not a typical order for most companies. We do it rather frequently.
It's due to companies like ours that online credit card processing is at the state that it is now. We pass millions of dollars through online payment gateways. They know they must make the technology work well, if they expect to make their percentage of the sales. Even credit card companies have made a tremendous profit due to our work. It's no
You know, it's a job. I get up every morning, check a bunch of reports, and get into my administrative and programming tasks, just like a decent portion of the folks on here.
Before I worked here, I worked for a mainstream hosting company. 8 (or so) years ago, we had 30,000 customers. They sucked up a whopping 4Mb/s of bandwidth.. It was a good size hosting company.
When I switched over to working for an adult company, it was a complete shock. No, not the porn part, because I don't even look at that. Just the fact that any given site gets so much traffic. We had a single T3 at the time, which grew dramatically. I have 4 GigE circuits at my disposal, and will be adding more in soon. The growth is in the user base. More and more people are coming to the site, because that's what they want.
Look at it this way. Slashdot is ranked #849 on Alexa. Voyeurweb is ranked #319. Pick any of your favorite sites, and you'll find the majority have lower traffic? Do you know why? Because people view porn. The odd part about porn is that most people deny publically that they view it. You posted the safe response. "ooh, who cares", but judging by that response, you are a viewer. If not of our site, of another porn site. That, or you buy porn PPV on cable, or have an extensive magazine and/or DVD collection.
If people viewed mainstream sites more than porn, well, I'd be working at a mainstream company.
I agree completely. It's a bunch of BS. Porn will still show up on every domain that exists. The idea of trying to enforce it, while still theoretically feasable, means the almost certain death of every existing porn site. I'll use the site that pays my paycheck as an example. voyeurweb.com. According to Alexa, it's #319 of all web sites. With an average of close to 2 million unique visitors daily, or 9 million uniques weekly, it would be very hard to explain to them that there is a new name. Surely if we weren't in on the first minutes of the XXX registrations, people are going to be snagging up voyeurweb.xxx, right along with every slight variation of the name. There are hundreds of thousands of pages that link to some *.voyeurweb.com page. There are plenty of companies who are different with different TLD's on the same name, so it will be a huge name grab and years of threats and lawsuits before the dust settles.
.com's. There will be literally hundreds of thousands of pages to fix to make it work. Most webmasters are almost as bad as regular users. They created their site once, and don't have the technical ability to update all of their pages. If they do, they recognize that it would take a long time to accomplish it.
.com sites running porn after any mandated change. We'd be more than happy to comply, and we'd ensure all of our hosted sites complied, but there will always be some winner who wants to stay with a .com for whatever reason. The biggest one I can think of right off is spam. When .com is now a "safe" TLD, spammers will get bigger returns by advertising a .com. Sure, they can lose the domain within a few days, but spammers work under that assumption now. They give themselves a window between 1 and 3 days, from when they start a spam campaign until they either have the site or their internet connection shut down. For us, if we receive a valid spam complaint, the webmaster will get their site shut down. Any provider in a major country who likes to keep in good terms with their provider does the same thing.
Along with that, we have several pay sites. The biggest headache will be proadult.com, which is a hosting service. There are roughly 80,000 sites which use proadult.com for authentication. Those 80,000 sites are either under the *.redclouds.com domains, or under their own domains, the majority of which are also
Porn site users are your average user. Tell your average user to update their bookmarks, and they'll give you a technical blank stare. "How do I do that?" Judging by support emails, I'm surprised that most users can even get to a web page.
The logistics nightmare has little to do with this story though. The US government has millions or even billions in tax dollars at risk. I know just our companies pay out millions in taxes.
The move won't "kill" the adult industry, but it will sure make for headaches for some time. Every link on every site will need to be changed. All the search engine rankings will go away for a short time, which is probably a good thing considering the abuses so many webmasters have done over the years.
The control issue for the US is a biggie. The US Government loves to have the power to tell the world what to do. For the Bush administration, they love the power to say "put this on the back burner for a couple years". Back at the tax dollar issue, if it goes past this administration, the sudden drop in tax money will be the next administration's headache, and for a federal budget that's already screwed, they can blame the next administration for any headache's that it brings on itself.
We all know perfectly well that there will be plenty of
All in all, it will do very little to clean up the Internet. The best way to clean up the Internet is for **USERS** to do it. Don't spend money on sites that us
User stupidity is a huge factor. People are lazy, so they will do stupid things. If it's a voice confirmation, they'll just say "yes", rather than give updated addresses every time they move the device. If it's a web based utility, given the choice of hitting "yes, this is current", or keying in a new address, they'll hit yes.
While it's still their own dumb fault, it's not going to make E911 work any better.
I believe the first phase of E911 was to locate the caller to the nearest tower or CO. The second phase was to locate the caller to within 100 feet of their physical location. For cell providers, this is to be provided by the handset, which would indicate GPS coordinates. I had to look it up for this reply, so I'm fairly sure on the accuracy of this statement, even though I couldn't find the data spec listed on the FCC's site.
Since all the cell providers still aren't putting GPS receivers in their phones, the whole thing is still worthless.
I played with the GPS receiver in my Nextel phones (several models), and had very poor results. It would take several minutes for it to find my coordinates, and in a moving situation, the lag was so bad I was frequently miles from where it started listening for results.
You are correct about the telephony technology being way ahead of the E911 plan. Calls can be routed virtually anywhere through many different systems, which leaves the idea of dialing 911 and getting the right operator way off. I did business with an location in Los Angeles, where any outbound calls were run through their Florida location. Most people in the location didn't know it worked that way, and in an emergency, they would just hit an open line and dial 911.
I tried Asterisk once. It was too difficult to work, for the attention span that I had for it (about 30 seconds). I know other people that have it up and running fine. I'm sure if I had spent a full minute or two on it, I could make it do tricks.
I like Vonage, where you just plug it in, and it works. The best feature that it has, is the multi-phone ring. I have it ring my POTS line, and my cell phone, with phone numbers in several cities. Everyone that contacts me on a regular basis has a local number. I honestly haven't even plugged in the VoIP modem in two months, because my equipment has been rearranged several times. I will soon, my girlfriend wants the POTS line for herself. She's adopted my handsets, so I have to buy new phones for myself now.
I was really upset to find that out. I have a personal grudge against Sprint, so when Nextel merged, I refused to continue service with them. Yes, Cingular doesn't d GPS in their handsets, and won't for another year.
I got the top of the line Motorola phone from Verizon Wireless, which doesn't have E911 service either. So, no big deal. Hopefully they'll route me to the 911 call center that's closest to the tower. Otherwise, I'll get someone in India who won't know where I am.. They're proabably outsourcing 911 service now anyways.
I understand this argument.
Say there's an emergency. Someone in the house grabs what looks like a regular house phone, and dials 911. They get the wrong emergency operations operator, and have to be directed through to the correct one.
Of course, that happens anyways. I had a 3 year old who injested several pills. My call got transfered to law enforcement, who transfered to the fire department, who transfered to the paramedics, who transfered to poison control, I gave them the description of the pills we suspected he took (name, dosage, etc). He then told me "Get to the hospital as fast as you can. The first responder will probably be 20 minutes". That was the scariest drive of my life. I was blowing through red lights in a town I wasn't familiar with to get to the hospital. I was there in 10 minutes. And yes, he was fine.
You didn't check the URL in my profile, did you? Tin Foil Hat service is my speciality. I filter the crud from the truth, and try to educate people about what's happening around them. Sorry if I sounded like the Tin Foil Hat crowd with my first message. I sometimes forget that some people don't realize where I usually run stories at.
I'd put it at about 75% public safety, and 25% government influence. Probably that 25% is being really loud (behind closed doors, of course) about wanting it.
I've had a few occasions to dial 911. I have yet for them to know where I am. When they're asking, they're not asking for a confirmation of where I am. They're asking and I give the cross streets. Then they ask again, because they have no clue of where I'm explaining. That's been both with land lines, and E911 enabled cell phones.
If you research around a bit, you'll find that E911 is FAR from being universally implemented in the United States.
You have to use other numbers to make up for it. Try 5 and 6. (5+6=11).
Disclaimer: The above is a freakin' joke.
I've seen that occasionally. It usually has to do with poor internet service. Sometimes the CID wouldn't come through, and usually the call sucks at that point. Since I love my statistics, I graph almost everything, and can usually see poor throughput on the internet connection when that happens.
I lived in a hotel (site work) for two months. I had a wireless bridge, making my AP talk to the hotel's wireless connection. I then had two machines and my VoIP set up. Their service was up and down all the time. I'd only go complain if it was down for more than 30 minutes.. Every time I got to the front desk when their service was down, they'd tell me before I told them. "Ya, we know our service is down. It should be back by morning."
I believe part of the wireless argument was that they needed to get newer handsets out to their users, with GPS capability. Without that, they had nothing.
VoIP can be on virtually any hardware, and worse, they are used almost exclusively indoors, so GPS won't work. They don't have a solid solution for tracking where the caller is, other than the caller being honest and giving a good address for them to find the user at.
At very best, they could request that every IP holder give a physical address to where the IP is being used at.. That would mean a central database for all IP usage. No, such a thing doesn't exist. I have several
I'm a Vonage user, and have been for several months now.
They've requested every user to provide a street address to their Vonage service.
Unfortunately, this doesn't address the obvious problem with that. I, as a Vonage user, can plug my modem in anywhere. If I go to a friends house in another state or country, my phone numbers go with me.
I, being technically adept, know that 911 won't work properly. I won't dial 911 from that phone.
I like to have a phone number that isn't associated with a physical address, for various reasons. If I decide to sit down at a hotel in Moscow, and set up a VPN to make myself look like I'm in another country (say Canada), now I'll have an IP in Canada, with a phone number in America, but I'm sitting in Russia. The whole reason for doing this 911 thing isn't totally so emergency response can show up in case of emergency, while that is a nice feature. It's so the government can show up, should they have a phone number associated with someone doing something they don't like. I've noticed they've left the magic work "Terrorist" off this issue entirely.
With POTS lines, they obviously go to an address, or somewhere very close. (cordless phone, or max wire length from that location).
With Cell phones, E911 service reports the GPS coordinates. They are also traceable by cell towers and triangulation.
With VoIP, at most they may get an IP, but at worst, you can make phone calls from anywhere, pretending to be anywhere else. That doesn't make the government very happy.
I had BBS's, and FidoNet (along with a few more obscure ones).
We had fairly established, while unregulated networks. I won't say communication was fast, but it was there. I don't really need to review the wonderful capabilities of BBS's. Probably 25% of the folks who read here were users when BBS's were big.
Could the internet be reinvented? Sure. But, like any large platform, it started small. The next Intranet is being built by a half dozen teenage kids in their darkend bedrooms around the world. It isn't anything now, but will be the biggest thing the world has seen.
It's not perpetual motion. It always needs a power source.
It would use electricity generated by the engine's alternator/generator to split the water. The hydrogen and oxygen would then be fed into the engines intake. The engine would burn that, and poof, magic smoke.
100% emissions reduction and 10% to 40% improvement in fuel consumption?? How much energy do you think is in a gallon of water??
It won't work though. I've been reading about the same idea for years. I believe the first thing I read on this was a text document, back in the 1980's. There are kits and how-to's on the subject. This guys idea is nothing new. He just put it in a metal box and is offering it for $7,500/ea.
The whole concept is pretty simple.
If you put an electrical charge to water, hydrogen will come off of one electrode, and oxygen will come off of the other one. Trap that, and put it into the intake somewhere in the sealed part of the system (after the air filter somewhere).
The car engine is the source of the electricity to make this happen. The water must be supplied independently, or captured from somewhere like the air conditioning system. Most of the plans I've seen all have a gallon bottle of distilled water.
The best one I saw was a guy with an old 4WD truck, who claimed over 100mpg, where he typically got 15mpg before the "conversion".
I thought of doing it on my car, just for laughs. It's an interesting idea, but for the amount of hydrogen and oxygen you could produce, it wouldn't be worth while.
It ***COULD*** work, but he clearly indicates that his method isn't that way. If you were able to split enough water to run the engine on, that would be great. But countries who have *REALLY* been doing hydrogen vehicle conversions on *REAL* vehicles can't produce enough hydrogen on the fly to make it happen. Right now, you just can't do it. And with a refill every 80 hours (note he says hours not miles), that's worthless.
Think.. 80 hours.. 60mph. We're talking a distance of roughly 4800 miles. I say 60mph, because that's my average speed on the highway during long distance drives (like coast to coast). I don't know how much water he's suggesting to use. In my TransAm, I get 26mpg (gas) on the highway. I would need 184 gallons of premium gasoline to achieve his 4800 mile refueling status. What ratio of gas to water is he suggesting? Obviously not even 10 gallons, if he expects it to fit in your average street car without some serious sacrifices.
Not to be completely off-topic, but...
I've seen race cars (much lower class than you'd usually see on TV), with multiple gearshifts. For external linkage transmissions, you could have one shift lever where each shifter linkage attaches. On a 4 speed transmission, you'd have 3 linkages (1-2, 3-4, R)
At that point, a racer putting in the extra shifters, as primitive as they may be, has redesigned his UI to give him that more finite control.
But, how to you explain to someone else driving the car:
To shift into first, adjust the levers up, center, center. To shift from second to third, adjust the levers from down, center, center, to center, up, center.
Most of the racers I knew skipped the 1-2 lever all together, and just started rolling in 3rd.
Some people can't even manage that. They're the ones that stick with automatics.
And....
I had a badly worn shifter in a higher end street car once. Occasionally, shifting from 2nd to 3rd would push both the forward linkages, and somehow pop into both 1st and 3rd at the same time. I've never been much of a transmission person, so I have no clue why it didn't destroy the transmission. Once it got into that position, it took a hammer and pry bar to get it back out. It did that twice, before I gave in and bought a new shifter.