eksith

  If a woman blogged unkind and sexist behavior at a tech company, but 
  hid her name to avoid the backlash (like Michael), that would be 
  unethical. I guess she'd be an "asshat", right? Same thing for a 
  journalist using an anonymous source?

Did you just compare a woman blogging about a legitimate grievance that makes her work environment intolerable to someone suggesting "Fair game" practices a la Scientology for criticizing his company?

That was a fantastic article! Thanks for linking that. It certainly gave me a lot of food for thought.

My honest hope when I first heard of Uber was that it would give a huge wakeup call to the industry. Let's face it, America is a service industry and many of its services suck. The attitude is marginal at best, horrifying at worst. I hoped this level of customer scrutiny on performance would bring it up to the same level as in Japan.

I'm still hoping someone will make it happen. Or rather, perhaps an entire army of services will make it happen as we've seen, a de facto monopoly, yields terrible results.

This is why PBKDF2 would have made more sense then. They can centrally authenticate, derive a secondary token from the original pass while specifying the max limit for each of those services. Best of all, this means the mail, UNIX login etc... need not have the same login token.

  The McGill Password length has also been increased from exactly eight 
  characters to a variable length of eight to 18 characters.

So they're not using bcrypt (usable length 72). Even PBKDF2 would have been acceptable, but my guess is that they were sold a "layer over" on their stack with this. I can already tell this is a hacky patch.

  Every year, about 1,200 to 1,500 McGill accounts are compromised in 
  one way or another.

Phishing + guessing. I know someone who gets about 2-3 emails a week asking to enter their login info into some site in Brazil or the Czech Republic.

If every site properly salted and hashed passwords, reuse isn't even a problem. But as we know :

  - Most people choose crappy passwords.
  - Most sites use crappy hashing schemes (if they hash at all)

When other sites are compromised, there's an easy list of ready passwords to try against other potential targets.

McGill's problem isn't Heartbleed.

If the popularity of GoDaddy has taught me anything, it's that people use what they know; not what's good. The list of companies that should have gone out of business is as long as the number of years since commerce began.

The fact that they still stay means (and this is relevant to the EFF project as well), creating alternatives is just as hard as making enough people know and care about them.

The registrar check per domain is probably the biggest plus in having it act as CA. Of course, that adds overhead to the registrar which they may not be willing to accept (margins and all that).

The registrar issuing cert solution would certainly speed up HTTPS adoption; you're dealing with one less org to secure your site. The down-side is that if you decide to move registrars, that still complicates things. What if the new registrar refuses to issue a new cert without a hefty fee? Or what about revoking the previous cert? Now the registrar is functioning as a de facto CA so it doesn't completely eliminate the middle-man factor.

I'm hoping the EFF project will smooth over these hiccups, which is why I'm looking forward to it.

  Privatoria.net is a service which provides secure communication, anonymous 
  surf and secure file sharing for individuals and business. All security 
  services are united together in Privatoria. It includes Secure VPN and 
  Anonymous Proxy, that enable surf anonymously, change IP, unblock sites, 
  Anonymous E-mail, Secure Chat, Secure Call, Secure Video Chat for secure 
  communications and Secure file sharing via FTP and Secure Data Storage.

No conflict of interest there at all in your badmouthing of Tor, with no corroborating evidence at all to boot.

That's extreme. This is just a swing toward turning internet access into utilities like electricity and water which are available without being tied to your residence. You still have public street lights and public water fountains outside your home. Likewise, internet is slowly moving away form this "thing" you always have to pay for to stay connected.

Verizon, TWC, Optimum, Comcast et al require that you have an account with them to use their hotspots. But you don't need an account with ConEd to be able to read your newspaper or book out on the street. This is where internet is headed.

> You can view something like 20 stories a month

10 stories a month. Also, even though you may only post one or two as you say from these sites, others do the same adding to that total E.G. wsj.com Which doesn't allow viewing at all unless you browse in from a search engine or subscribe.

There are many reasons not to freely give out your address, or name for that matter. The validity of ideas need not be tied to an identity. If an idea can stand on its own, then so be it. If not, you can just move on.

"...being accountable for an opinion is probably bad for them in this case." Same for you as well, it seems.