kevjiang

>> Are you doing these changes on the user's computer or in the cloud?

I'm surprised this wasn't covered in the blog or FAQ. Seems like an important detail that security-minded customers would care about.

Were any HNers ever able to reproduce what RiskIQ reported? Namely seeing jquery.com include the script from the malicious jquery-cdn[.]com domain?

In fact, an attacker doesn't even need to steal the private key.. Heartbeats can be sent before certificate authentication takes place.

You should probably assume that they have your password too. Since Adobe encrypted the passwords instead of hashing them, all of these passwords will be known once the encryption key is discovered. Someone could possibly use the method in the article to guess your password as well.

So if you use the same password on any other websites, better change it.

I came to this comments page just to check if quarterto's law was still holding up :)

Rental prices are based on supply and demand, except for in a few cases (for example, rent control). That's why he suggests using rental prices as a way to check how reasonable a house price is.

>> LinkedIn leaked 8 million users' passwords less than a year ago, because they were storing them in the database in plain text.

The password leak from last year was really a leak of the password hashes. I'm pretty sure they didn't store passwords in plaintext.

I think the backlash was because they didn't salt the hashes and only used one iteration of SHA1 instead of a more appropriate hash function.

That being said, this doesn't really change the OP's point. Which was, "secure my ass"

Doesn't seem like it.

Code:

  var common_url = '&pagesize=100&order=desc&site=stackoverflow&todate=1363473554';

SO /questions api:

  todate – Unix timestamp of the maximum creation date on a returned item