Here's an openbsd VM with tor and a bunch of web browsers preinstalled. There's packet filter rules so even if the vagrant user gets owned, it cannot transmit traffic on the outboard network interface. https://github.com/WIZARDISHUNGRY/openbsd-hiddenfortress
A little bit of googling makes it seem like auth tokens are not sent it plaintext over HTTPS but are authenticated using challenge response – http://forums.dropbox.com/topic.php?id=47952 The WWW site may differ.
Obviously that would work, but not if you're using Challenge-response authentication. In general, I don't think people bother with now that when using https.
That seems like a perfectly good solution to me. Storing a hash of each signature is say 256 bytes and supposing an upper limit of 10,000 signatures, the database file is pretty small. (Better hope they sign the signature database though)
He convinces the FCC to require right-wing channels to link to left-wing channels, Christian channels to link to Muslim channels, vegetarian channels to link to meat-eating channels.
"The [linking] icon itself would not require anyone to read anything," Sunstein writes. "It would merely provide a signal, to the viewer, where a different point of view might be consulted." The FCC approves Sunstein's plan for a "Fairness Doctrine" for the online world, and the FCC sets up a new Bureau of Links to enforce the practice.
You wouldn't need 4096 if the choice of the salt was non-random; some versions of Unix used the first 2 characters of the username. What's the space requirement for a single rainbow table?
Does anyone have any more specific information on whether they just called crypt(key,salt) or actually used a larger salt with a call to encrypt()? The crypt() function only takes a 12 bit salt which is marginally helpful against rainbow tables.
Does anyone have any information on changing all their account passwords at once? I don't use the same password for any sites, but unimportant sites like blogs, etc. I use fairly similar passwords on.
Generally, you're only required to provide changes if you are distributing your modified program. This may have been partially addressed in GPLv3 in the form of an "application service provider" clause, but I don't recall