I have a gpg encrypted file on a server that I manage manually - made slightly easier by the gpg plugin for vim. Not found a password manager with a UI that I get on with yet.
I don't see a problem with using a regex to validate email, unless you get false negatives. Rejecting anything that could be a valid e-mail address is bad and will cause frustration for someone at some point.
I don't think allowing validly formed e-mail addresses that don't have corresponding accounts (or even domains - consider a web app working in offline mode) is a bad thing, especially when taken with point 1, as surely the point of client side validation is a heads up to the user that the data is wrong, rather than actual validation?
My wife has a horrible time with HSBC, and I always get a bit aggitated when I see people recommend them, so I'm glad to see other people sharing their horror stories about them.
Her situation is that she visits family in Canada once a year. They won't make a note of her being out of the country if she calls them beforehand. The fraud people then call her if she needs to use her card at unsociable (for Canada) hours and never leave answerphone messages. When they do get her, they require her to answer security questions without identifying themselves first. If she calls them, the person she speaks to has no way of knowning if anyone has been trying to call her for any reason.
You get called by a computer that asks you to identify yourself by picking a piece of personal information from a list. It might ask for the month and date of your birth, for example, and give you 5 options.
Because there are 365 possible month + date combinations, and yours appears in the list, you know they already have this information so you're safe to confirm it, and they also get to confirm that you are (likely) who they're intending to talk to.
I like the Barclays mobile app. You authenticate it once using a pin sentry device, and give it a pass code, and from then on you can just use that pass code to get your balance using the app. The app also acts as a pin sentry when you want to access your account using a computer.
HSBC are also (or at least were very recently) in the habit of calling customers and launching immediately into security questions without even identifying themselves first, which is wrong for all sorts of reasons.
Is it just me, or doesn't this sound very similar to SQL injection, only as applied to an ORM instead?
That is, if my understanding is correct, they're taking user posted data and trivially turning it into a command to update data.
This doesn't sound like a problem with Rails, in the same way that if I turn data I receive from the user straight into an SQL statement, the fact that people can abuse it isn't a problem with SQL.
You don't have to worry about memory management, pointers and the like, and can just focus on the algorithms.
All that stuff it super important to also know, but probably easier to learn about them separately.