benhirashima

Some of these tactics are contradictory. Tactic 2 says to add cents for a "rational" purchase, i.e. 19.86 verus 19. This contradicts tactic 3 which says to use fewer syllables, i.e. 19 versus 19.86. How do you prioritize these tactics?

Neat. How many letters per minute?

i think it's ridiculous that in order to get a prescription for a simple low-risk medication, i have to call my doctor, make an appointment, wait 45 minutes past when my appointment was supposed to be, and have a physical meeting with the doctor that consists of nothing but talking and takes all of 5 minutes. oh, and i have to pay way too much for it too. i should be able to do this over the phone or internet, and for less money.

your site doesn't load at all if javascript is disabled. i recommend fixing this. otherwise, good looking site.

i found this collection of photos surprisingly illuminating. i feel like i have a better understanding of north korea just from seeing them.

"There are relatively effective checks on large scale corruption through independent layers of law enforcement agencies and a separate judicial system."

...unless you have money. then you're untouchable. i.e. the financial industry.

unbelievable. some people.

good looking website. one small typo: at the bottom, it says "be one of 250 proud member". should be members.

thanks for the link. it was a good read. however, i see nothing in there that suggests that using a pepper is necessarily a bad thing.

i think the answer from rory mcclune puts it well: "Another add-on I've seen to this is to also add in what was called a pepper value. This was just another random string but was the same for all users and stored with the application code as opposed to in the database. the theory here is that in some circumstances the database may be compromised but the application code is not, and in those cases this could improve the security. It does, however, introduce problems if there are multiple applications using the same password database."

one strategy that has occurred to me is to use a secret "master" salt, in addition to random public salts for each password. that way, an attacker would have to obtain the secret salt, as well as the public salts. the secret salt would be stored in the program that does the hashing, and not in the database. this requires an attacker to gain access to the filesystem where the program lives, as well as the database. of course, this offers no guarantees, but does make it harder for the attacker.

from wikipedia: "A public salt makes it more time-consuming to crack a list of passwords. However, it does not make dictionary attacks harder when cracking a single password. The attacker has access to both the encrypted password and the salt, so when running the dictionary attack, the attacker can simply use the known salt when attempting to crack the password."