owenfromcanada

joined 1 month ago
[–] [email protected] 1 points 1 week ago

I dunno about that, probably more like 99.98%.

[–] [email protected] 2 points 1 week ago
  1. Aquire password database (it's properly hashed and salted)
  2. Create an account and access the password reset form
  3. Dig into the front-end code to find whatever is doing the hash calculations
  4. Brute-force a list of common passwords and look for matches

It would still take significant time, but it's still a vulnerability, especially as technology evolves. You're right that best practices are different for a reset form, but there are some things that are common (like don't do hashes in the front end).

[–] [email protected] 3 points 1 week ago

Yep, that's what I meant. Pretty sure my company does this, because they can detect this, and I know enough of our IT to believe they're not storing passwords in plaintext.

[–] [email protected] 47 points 1 week ago (1 children)

Storing in plaintext? That's a paddlin'.

Not salting your hashes? That's a paddlin'.

Sending hashes to the front-end? That's a paddlin'.

[–] [email protected] 26 points 1 week ago (11 children)

I can imagine one legitimate case: when you create a password, they save the hash for the full password as well as the hash for the password without the last character. So if you attempt to change only the last character, they can detect it. They'd need to salt the two separately though.

In theory, they could do the same for every character, but they'd have to save 20+ combinations for that (plus all the salt), so I doubt anyone is doing that.

[–] [email protected] 5 points 2 weeks ago

Agreed. We have our own drama over immigrants, but I don't see Canadians turning away asylum seekers any time soon. My wife and I have already offered "extended visitation" offers to our LGBTQ+ friends in the states.

[–] [email protected] 4 points 2 weeks ago (1 children)

Not even Donald.

[–] [email protected] 2 points 2 weeks ago

Yeah, the defacto Arch packages are only compiled for v1, but CachyOS has compiled a lot of the core libraries for v3/v4 (including Wine), which is where I think I'm seeing some improvements. I'm sure the performance would be more optimized by compiling myself, but I don't have the time or patience for it right now.

[–] [email protected] 2 points 2 weeks ago (2 children)

No worries, I'm here for it!

It's a noticeable improvement to me, but probably only marginal to the layperson. I haven't gotten around to more thorough profiling yet (the included btop++ profiler actually caused my games to crash), but I get the impression my PC is utilizing a lot more of its capabilities (based on performance, fan noise, etc), though maybe I'm just confirming my own biases.

I'm guessing you might get similar gains by compiling manually, but the nice thing with CachyOS is that it's already compiled (likely with other optimizations as well, I haven't looked too far into it). I have the technical skills to compile manually, but not the time or energy, so it's a great solution for me.

[–] [email protected] 69 points 2 weeks ago (4 children)

Maybe this year we post the pride flag upside-down?

[–] [email protected] 2 points 2 weeks ago (4 children)

Yeah, they were common to Arch. Specifically, Steam would cause the entire system to stutter for a good 30 seconds when starting it up. Found a tip online about it doing something with some extra config files, followed the tip and now it's working fine.

Even using the CachyOS versions of Proton and Wine libraries (which have the same kind of optimizations applied as the rest of the OS) has worked flawlessly, and my games are smoother than they've ever been. Pretty impressed with it overall.

[–] [email protected] 5 points 2 weeks ago

Don't get me wrong, Mint is great for everyone. I was using it primarily for ages, and I've been using Linux for decades as well.

view more: ‹ prev next ›