« first day (2765 days earlier)      last day (1046 days later) » 

12:23 AM
 
 
4 hours later…
4:28 AM
What does mean? Why do we have a tag for it?
 
5:11 AM
@oguzismail complete speculation, based on the sibling tag which has a description ... an Apple UI interface class for a specific type of IOS gestures, apparently truncated because the tag became too long (I'm guessing Stack Overflow imposes a length limit?)
 
@tripleee that's.. ugly. there already is a tag, there's no point in having one for each gesture. sigh
 
I can't say I disagree
 
5:44 AM
@tripleee 35 chars today, used to be 25.
 
so it could be redirected to a synonym by someone with enough rep
would it be acceptable to propose a synonym on meta just to reach someone who can do that?
 
Rep isn't quite enough, as the synonym system is broken. But you can propose a synonym on Meta so that a mod can do it.
 
@CodyGray .. in 6-8 months, years
 
Meh.
Synonym requests are easy; they're not like burnination requests. A mod can handle them in a couple of minutes.
The only challenge is marshalling enough evidence to prove that the synonym is correct/appropriate.
Trivial if the mod you encounter happens to know the subject matter. Harder if they are completely alien to it. Then, you need to find at least one other user who is also an expert (judged by rep, because what better proxy?) who agrees with you. Then, we'll probably just take your word for it.
 
6:01 AM
Not all cases are like that. One proposal I made last month, paginate->pagination, is an obvious case.
And it's still sitting there.
 
opinions and downvotes please: meta.stackoverflow.com/questions/408435/…
I posted twice on meta yesterday and the immediate "welcome" message was two rapid downvotes in both cases, though my posts then recovered nicely
 
@oguzismail I wasn't paying attention last month. :-)
 
Yeah you weren't around for some time. A vacation perhaps?
 
Work Overflow.
No vacation, alas.
 
:D How long till retirement? Seems like that's your only way out
 
6:13 AM
Let's see, I'm pretty much 30, so... 50 years?
I need a new/different job.
@tripleee Interesting. A known downvote whiner was complaining about the immediate reception on Meta being 2 downvotes. I dismissed this because, as I may have mentioned, it was a known downvote whiner, and I tend to be very dismissive of downvote whining.
But I thought both of your questions yesterday were on-face good ideas, even if the edit exemption one turns out to be more complicated after giving it some thought.
 
maybe it's a time zone thing, yesterday's posts were in the afternoon my time (so early PM UTC I guess) but now it's all roses (currently +4/-0)
 
@CodyGray Welcome back to SOCVR :)
 
@JeanneDark Thank you. Have you managed to get any flags declined while I was away?
 
but then I guess this is not easily a very controversial topic either; my interpretation was that the downvotes might mean "no, let's not spend time on developing things (or things other than this one really <blink>important</blink> thing", whatever then that might be)
 
No, I didn't
 
6:18 AM
@tripleee some cast downvotes just for spite, you're ignoring that
 
sure, I think I can guess one or two of them
 
Hey, I already said I thought they were good ideas! I didn't downvote these.
 
in fact I was thinking of somebody else, this time (-:
 
I don't get the point in holding grudges for people on the internet, it's not worth, we'll all die anyway
 
(all Youtube links look like rickrolling to me)
 
6:22 AM
@oguzismail Couldn't that equally be a reason to hold grudges against everyone?
My primary issue with it is that I just don't have the short-term memory capacity to remember everyone and whether they're on the "good" list or the "bad" list.
Heh. I wonder if they've also discovered the === operator within the last 5 years.
Ah, they discovered it shortly after asking the question, apparently by reading the documentation.
 
@CodyGray I do have that but meh, it doesn't lead anywhere good
 
6:44 AM
"hot meta posts", really?
 
yeah, I'm not complaining, just stunned that five upvotes (and/or 31 views) seems to be what it takes
 
7:12 AM
@tripleee Not much competition at the moment.
The "preemptive reopen vote" and "the auto-hide the code" proposals didn't gain much support.
One of those apparently got deleted since I last looked.
 
7:44 AM
"You may only flag a post every 5 seconds."
 
 
 
1 hour later…
9:02 AM
What to do with this? The new answer is just a "thank you" post, but the accepted self-answer has the code as an image.
 
@JeanneDark I propose closing the question as extremely unlikely to ever help anyone again
 
.. and then deleting it
 
Thanks
 
9:53 AM
@MrUpsidown I flagged and crossed fingers ;)
 
Flagged for?
 
That is trolling in my opinion
 
Is there a shamanism flag?
... should be.
 
@AdrianMole Meantime we could create the shamanism tag
 
hehe
 
10:02 AM
Entrepreneur and shamanism in the same sentence sounds quite weird indeed...
 
actually I'd expect most people in that "industry" to be jumping between gigs, "entrepreneur" is probably just an euphemism for "gig worker"
 
@MrUpsidown Anyway, one more delete vote will see it off...
 
If you say you have a "gig" here I assume you're some artist / musician that is heading to the stage give a performance ...
 
@rene merriam-webster.com/dictionary/gig the word does have an "entertainment industry" connotation in isolation, but "gig economy" refers to basically any work where you jump between employers
I would have thought it was related to "engagement" but Webster says origin unknown
 
10:10 AM
@tripleee see! Shows my age ... again ...
 
@MrUpsidown Isn't shamanism the classic entrepreneurism?
Creating a market where none existed before...
 
Hmmm
 
@rene I assume you went to Texas A&M ;-)
 
10:28 AM
 
Guys, I know it is not by the rules, but a user is acting - IMHO - not fair. I am talking about Regex, find a scientific number in a line. Tim posted an unhelpful answer, I closed the question as a duplicate of two posts that fully address the issue
(this and this, see my comment), and Tim reopened the question. Could you please advise what to do?
 
@WiktorStribiżew sounds like exactly something for meta
 
@WiktorStribiżew I think the Room Owners here decided, long ago, that we don't get involved at all in close/reopen wars.
 
Downvote and move on
3
You can't be the janitor for every question
 
I see, thank you all.
 
10:34 AM
If another user makes a decision you don't agree with then you can take it up on meta, but most of the time it's easier to just move on
 
@Dharman The problem (for me) is that it is not the first, second and even third time that user reopens such questions after providing a "non-working" answer. Ok, if the user goes on like this, I will just let moderators know.
 
yeah, but this is a sing that there's something wrong with user level moderation in general
Some people believe that duplicates need to be identical, some people believe that the answer has to be the same
who's right?
 
Neither :)
 
Both?
 
If we were to wage a war against everybody with whom with disagree then there would be a mess
 
10:40 AM
This is a "sing"?
 
Duplicates need to be semantically the same question.
 
You took an action you thought was right and another user did the same.
 
FWIW, the OP found a duplicate of their own, the question is closed again, and Tim's answer is deleted
 
Please just don't ask a moderator to arbitrate which one of you was right. How are we supposed to know?
 
Wait. There's stuff what mods don't know?
 
10:42 AM
Allz I know is that I'm always right. But when I don't have an opinion... I'm utterly lost.
 
You must not be married
 
@HovercraftFullOfEels I am not. :-)
 
The wife is always right, period, end of story
4
 
If I were, I could try asking my wife to decide which of the regex people are correct. I'm not sure that would help, though.
2
 
10:45 AM
To be fair, it's hard to be sure, knowing the type of people I'd be likely to marry.
 
All regex questions are special, like my mom said. So none is duplicate.
 
11:11 AM
oh finally a downvote; it is not quite yet noon in UTC
 
Don't be a goon! A downvote each afternoon is not something to lampoon; we all commune in our saloon at a time most opportune to impugn, not merely once in a blue moon.
9
 
@CodyGray sniff that's ... moving
 
11:45 AM
didnt we have a good reason for customer support type close stackoverflow.com/q/68018428/1841839 Cant remember what it was.
 
@DaImTo custom reason and link to meta.stackoverflow.com/questions/255745/…
 
12:02 PM
Morning
 
12:22 PM
"I guess that writing all this is more in line with Code of Conduct than just downvoting."
 
12:45 PM
^ Should that be edited, or just red-flagged?
... The Glorfin-Bot decided to edit.
 
@AdrianMole I guess a red flag would have been declined
 
So, how much abusive language is the limit of what should be edited-out? At what point does the whole post become inherently rude?
 
A red flag is for unsalvageable posts that cannot be edited and need to be deleted.
 
@AdrianMole It's a judgement call. IMO, if the offensive language expresses frustration over the problem the OP is facing, it's fine. If the offensive language is directed at other people (users, creators of the product, etc), then it's not.
 
An exception is an otherwise okay post that contains insults directed at a specific user and which should be custom flagged.
@cigien It's not really a judgement call. A R/A post contains nothing of value whatsoever. It's something like gibberish or just abuse directed at SO or something. Not a post with some expletives in between.
 
12:54 PM
@JeanneDark Well, I've come across posts that lie somewhere in between, i.e. there's a fair amount of profanity, but there's also a valid question in there. On some of those posts I can definitely see people reasonably disagreeing over whether it should be edited, or deleted, and that's what I meant by it being a judgement call.
 
And the mods agreed with your R/A flags?
A question without body?
 
there were a few odd Unicode characters there in the FIRE preview
 
@tripleee Thanks! Strange that that's allowed
 
@AdrianMole My rule of thumb is that rudeness directed at nobody in particular that can be removed to leave a passable question is not a good candidate for deletion
 
1:14 PM
@JeanneDark Sorry, just saw this. I'm not sure I understand the question. I don't think I've had flags on offensive content declined, if that's what you're asking (maybe I have on a non-English post, before I knew not to do that).
 
@cigien I mean when you come across a post in which "there's a fair amount of profanity, but there's also a valid question in there" as you wrote and flag it as R/A, your flags are marked helpful?
 
@JeanneDark Ah, I see. Personally, I tend to favor editing, so no, I haven't had that happen (the R/A flags I raise tend to be obviously not repairable). But I wouldn't be surprised if the other way around has, i.e. I've edited a post that a mod has later decided is R/A.
 
@JeanneDark The risk with flagging that as R/A is that someone edits it into shape and a mod misses the edit
We get a LOT of bad red flags
 
@Machavity But if it was possible to edit into shape, a mod would still mark it helpful?
 
@JeanneDark If the post is still in rude shape, it's possible the mod will just delete it. That would mark it helpful without applying a -100 penalty
 
1:26 PM
I only flag posts as R/A that are really unsalvageable, with no attempt at or intention to post something suitable for SO. If it contained rudeness directed at someone specific, I would custom flag. Else, if it's editable, I leave it to 2k+ users.
 
@Machavity I guess it all depends on how big your **** thumbs are. ;)
 
eyyy, my top answer has a score of 420, nice
cue elon musk-esque memes
 
So, that's the Ultimate Answer, 10 times over?
 
@AdrianMole indeed
 
1:41 PM
TylerH is funding a mission to Mars with his upvotes. You can apply over at tylerhmars.test
 
@Machavity great, now I have to go purchase that domain name...
 
This is sad, majority of the questions have nothing to do with Qt :D
 
@oguzismail I keep an eye on that tag, and remove the tag in the most new regex questions
 
1:57 PM
@WiktorStribiżew Good, thank you. and are also abused similarly, if you have time.
 
@oguzismail I treat nsregularexpression tag the same as qregularexpression. As for regular-language, I prefer not to touch it as it usually appears with tags like automata, finite-automata, computation-theory, dfa, formal-languages that I also prefer to shy away from.
 
2:13 PM
@AdrianMole That url has apparently been spamvertised before: metasmoke.erwaysoftware.com/domains/79514
 
2:46 PM
@AdrianMole Probably targeted because it uses the word "cryptocurrency"
 
On youtube anything that says that gets spammed hard.
 
cryptocurrency needs to be outlawed
4
 
All cryptoproperty is cryptotheft.
 
IMHO cryptocurrency is the new pyramid scheme.
 
2:49 PM
If you want to get rid of your cryptocurrency I can take it an dispose of it for you
 
Can you convert it to cryptoreputation?
 
@oguzismail aren't and the same thing?
 
We actually found someone selling bounties on Fiverr...
 
@Machavity nice
was it Madara this time :-P
 
Ohh yeah, there's a number of such ads on the internet
 
3:00 PM
@EJoshuaS-ReinstateMonica I wouldn't say that's harassing, but it is unfriendly. The username is also inappropriate
 
@TylerH yep, flagged that when post first appeared
 
looks like both have already been taken care of
@TylerH cc @WiktorStribiżew maybe you know as well
 
I remember a case of bounty-selling raised here (by Dharman, IIRC) some time ago. I think Cody was hanging about and said he'd handle it. I was going to suggest that I went to the website to purchase some of that bounty using the Stack Overflow VISA voucher I had recently 'earned' by taking the interview for the new Review UI. That could have been interesting...
 
@TylerH It's covered in the tag wiki: "Note: This class is new in Qt 5. Qt also offers an older, slightly less capable regex implementation though the QRegExp class."
 
@Nick Ah, I should have clicked through. The wiki excerpt doesn't mention the difference but probably should
and the comments under the accepted answer really make me wish I could see deleted comments, lol
 
3:04 PM
Agree, probably should, I know I use regex[p] as shorthand and would probably use the wrong one if I didn't read the wiki
 
@TylerH and are different as QRegExp is about the Qt4 and older. Its regex syntax is limited. QRegularExpression is about Qt5+, it supports PCRE regex syntax.
 
@WiktorStribiżew would you mind updating the wiki excerpts for one or both to mention they are version specific?
vast majority of readers/potential users probably wouldn't get past the excerpt, is the reason I think it's a good idea
even though we would hope those asking about them would know to use the right thing, there's plenty of evidence in all tags that that's... not the case :-)
 
Not sure Wiki excerpts even enter the universe of the vast majority of users. Look at how many recent Qs there are with the [api] tag, even though the excerpt says DO NOT USE THIS TAG.
 
@TylerH I will check a bit later, I will be offline for some hour or hour and a half now.
 
3:21 PM
@AdrianMole I mean, yeah, a large number of people don't read excerpts even, but there is a group of people who also read excerpts but not full wikis
since the full wiki is on another page entirely
 
... agreed. A decent Wiki excerpt can't do any harm and will potentially be useful. I use them a lot when reviewing suggested edits that have changed tags.
 
3:56 PM
@rene can any of the native English speakers confirm if the hyphen should be removed from this title: Why can't I ask customer service-related questions?
 
It should be removed
IMO :p, you'll get opinion based answers
 
Nah, usually someone knowledgeable finds an english.stackexchange thread.
 
There is a thread, but they all related to single words before ("computer", in the example I found), not two words like "customer service"
It does however say: "when there can only be one meaning, hyphens may be omitted", so, whichever author prefers /shrug
 
@bad_coder I'm sure the native English speakers can. I'll keep my mouth shut ...
 
4:08 PM
@bad_coder it should not be
 
See, opinion based :p
 
whether it belongs is a matter of what style guide you adhere to
but it is a legal usage
so removing it would be a stylistic decision, thus should not be done by someone other than OP
In this case it is a FAQ so there isn't really an "OP" to speak of, so we should go based off of what makes the title more clear
 
This answer actually covers (a very similar) case, and would suggest: "customer-service-related"
 
I'd argue that removing the hyphen doesn't add an clarity to the phrase, personally
@Nick now that's just ugly
 
That, I agree with you on :p
 
4:12 PM
If anything we could just remove the "-related" bit altogether, and just say "Why can't I ask customer service questions?"
that IMHO is clear and concise enough and avoids the quandary altogether
 
There's always the original title: "Why we're not customer support for [your favorite company]"
 
@TylerH The entire banking system is dependent on cryptographic methods to secure money transactions. So, yes, banking needs to be outlawed.
 
@Braiam that's not what cryptocurrency refers to
 
Conceptually it's the same thing. Which is why the blanket statement is blanket ;)
Banks have ledgers, secured by crypto.
 
Cryptocurrency refers to currencies that are based on a blockchain that involve either proof of work claims or proof of stake claims for valuation.
Has nothing to do with cryptographic security of other digital data
 
4:25 PM
See, and this is why being a economist is hard.
For us, there's no difference between a ledger kept at a bank and one kept in a blockchain.
 
"I don't know the difference between two things therefore they are the same" is not a very smart position
9
 
4:38 PM
@TylerH Oh, but we know the definition, we just don't agree that is accurate.
Again, conceptually, for an economist there's no difference.
Superficially, yeah, as different as sun vs my glass of water. But both are objects which includes stars and what I'm chugging.
Set theory is something that should be taken into account.
 
@Steve Maybe even R/A? But you can have my del vote.
 
Yes, just something to remove asap
 
5:30 PM
 
5:59 PM
Which password is more secure? kgZ{J.P0WO#r or Mindyourbus1ness ?
 
@Dharman what are the constraints on the password field that are publicly known?
 
That's a good thing to ask, but you are not allowed to ask that. You are an average Joe
:)
 
If none are known, then the longer one is more secure for a few reasons
 
I agree
But it was one of the questions and I failed
How can shorter password be more secure?
 
The asker is probably assuming constraints are known that include "can/must include special characters"
 
6:01 PM
Then such a constraint would make a weaker password
 
Yes, for sure, and lots of sites/services include constraint that actually make for weaker passwords
 
If I know what characeters the password must have as an attacker, then I have more chances of getting it right
 
If we know that special characters can be used, then the shorter one is more secure because there are more potential options for each bit
 
But, it's easier to brute force
 
Not true because each position has a higher number of possible values
 
6:03 PM
@Dharman Neither, it's permanently stored on the interwebs and used in the dictionaries of passwords.
 
Also that ^ :-P
 
a password consisting entirely of dictionary words with minor conventional alterations is sure to be cracked
 
Random characters and 20 characters is the minimum.
 
@tripleee any password is sure to be cracked if you give it enough time
 
Which characters don't matter as long as it's most of them.
 
6:04 PM
Consider a rule: "The password must be 3 characters long and contain 1 digit, 1 uppercase and 1 special character" vs "The password must be 3 characters long and can contain any character imaginable"
 
@Dharman The password must be 12 characters long and not in the list of known passwords.
That ^ is how I apply in my applications.
 
@Braiam Yeah, that is a sane requirement
 
that's a straw man, we are talking a few minutes with John the Ripper vs proper bute forcing
 
Enforcing certain character groups makes the password weaker
 
Also gives information to the attacker of which characters it always have.
 
6:06 PM
Also, is racist towards people with different keyboards
 
Wowowowow, lets not touch that.
 
According to howsecureismypassword.net the Mindyourbus1ness password is stronger
and I agree
 
Except that it's 3000^4
Which is weaker than 27^16
 
sites like that just tend to compare entropy, it doesn't factor in what's in common dictionary attacks and rainbow tables
some of the top 100 passwords which are sure to be tested within seconds are technically "secure" in that they don't contain dictionary words or common patterns; but just the fact that they have been used hundreds of thousands of times makes them insecure
 
I wonder how much time I would need using the newer version rainbow table to guess that password
How it's called, Hello Baby or something like that?
 
6:10 PM
@Braiam how big is the list of known passwords
 
@tripleee This site does consider dictonary
 
I see several SO results for the most efficient way to check but none of the answers, somewhat frustratingly, give an estimate of how long it would actually take in real time
 
@TylerH 80Gigs like 10 years ago.
 
@tripleee yeah, looking at correcthorsebatterystaple for sure
 
6:11 PM
@Braiam how long do your apps take to check that an attempted password is in that list?
 
estimates like that would be unreliable anyway unless they are a recent estimate based on GPU rigs
 
@tripleee aha, a loophole! We know they can't possibly have those estimates because no one has recent GPUs for hacking, only for cryptocurrencies
see, think of the hackers, and ban cryptocurrencies, Braiam :-)
 
no I mean if you find a site which reports that three years ago they would estimate this many hours on this type of CPU the numbers are no longer relevant because modern cracking rigs use a different architecture
 
@TylerH That takes few ms on a real machine
 
@TylerH Both are very profitable
 
6:13 PM
I use that in my project
 
If you preprocess/hash it, it takes less time
That's why salt has to be random and large.
 
It takes 139ms for the full request-response to the server
 
<1 second seems acceptably quick
 
You only check it on log in and on password change
 
@Dharman you mean registration and password change?
 
6:18 PM
@Nick This post is really good and explains it thoroughly, (cc @TylerH) unless "costumer service-related" is a thing by itself I'd also opt for removing the adjective by rephrasing.
 
139ms for a password change
on dev machine
Oh I see. No, I meant log in, registration, and password change
 
Why would you need to check it on log in?
 
In case the password they are using got leaked
People reuse passwords and I have no control over that
 
Ah, I see. Good idea
 
The application then resets the password, forcing the user to come up with a new one
Slightly annoying but happens very rarely and offers more security for users
 
6:21 PM
Ideally, you should only test if it's a known leaked password on password change/registration, rather than login.
 
Depending on the industry I think it might be better to just alert the user (and security team that the account is using a compromised password) so that the team can follow up with them in a couple days
 
Policing the password of the user on every login sounds like too much.
 
Depends on the application
But you can reset or warn the user when they use leaked password
 
If you do that, you may as well just do it once, when a new password is added to the leaked password database.
 
@sideshowbarker has since been edited, see if request still applies.
 
6:23 PM
@Braiam But how would I know the passwords they use? I only know the password at the log in
 
You take your list of password, pass it through the hash function and compare it against what you have stored.
Basically, do a challenge against the password column
 
which is also how you should be checking on each login, don't compare plaintext password values against a plaintext list...
 
@TylerH Yeah, that gets expensive in a hurry
You have to salt and hash all the passwords on every login.
 
@Braiam But I stored salted hashes of passwords
It's impossible for me to take a list of passwords my users use, if I never store them
 
Suppose you have a function checkPassword(userid, password) that do the magic.
For every userid, feed every password on the list of known password.
 
6:27 PM
Yeah, this can't possible ever work
Think about it
 
Because I'm thinking about it, I know it works ;)
 
I only have the list of leaked passwords, but not the passwords of my users
The only time when I know the password of the user is when they log in
 
checkPassword hashes the password and check against what is stored in the database for the specific user id.
 
But it's going to be a different hash each time
 
Of course, for every known password.
 
6:29 PM
Even the same password will each time generate a different hash
 
How would your users login then?
If the hash doesn't match.
 
I'd have to use the salt
 
Well, use the salt.
 
Do you realize how computationally expensive this would get?
 
@Braiam I think you're talking past one another. You store the hash type, conditions and salt. But for secure hashing you make a new salt every time
 
6:30 PM
The whole idea of hash and salt is to prevent that
 
@Machavity I know that.
Your password checking function shouldn't need to be fed the salt.
The salt, along with the hash should be stored on the same column.
 
I'm confused what your point is then
 
And I know that db fans would say that that's not clean, but think about it: without the salt, the hash is useless.
 
Let's say I have 100 million leaked passwords and 1000 users. I need to generate a new hash each time. This means I do bcrypt or argon2i or some other secure hash, 100,000,000,000 times
 
@Dharman But you only have to do it once.
 
6:33 PM
even if a single hash takes only 50ms, this would take around 15 years
I don't get you
 
You have a magic function called checkPassword(), which returns a bool. It only accepts the password and a user id. This function reads the stored password for the given userid, takes the salt there, and hashes the password for that. If the resulting salt+hash matches the one stored, returns true, else false.
Instead of feeding said function with the password that the user have, you feed it the list you have.
It takes forever to do it the first time, but afterwards, you only need to do it for every password change.
 
Let's keep the political discussions to a minimum. To say that issue is a powder keg would be an understatement
 
@Braiam So you are transmitting passwords in plaintext with this magic function?
 
@TylerH No.
 
or does this function generate the hash on the client side
 
6:39 PM
Password never leaves the application hashed or otherwise.
I think openldap has something that does this.
 
@Machavity come on, it was a joke
 
like this?
bool checkPassword(userId, password){
saltAndHashOfUser = getHashFromDB(userid)
newHash = passwordHash(password, salt)
return newHash == saltAndHashOfUser
}
 
@Dharman Yep.
 
@oguzismail I get that, but you need to be aware that issue is super sensitive in some corners right now. We don't need to poke the bear. I'm not saying you can't talk about it anywhere, just not in here please
 
Go on, explain how you could precompile a list of hashes
 
6:42 PM
Okay, okay. Got it
 
@oguzismail But you are correct that passwordless logins are more secure
 
@Dharman Huh, how?
 
passwords can get leaked
 
@Dharman You don't compile the list of hashes.
You just feed that function with the list of leaked passwords.
 
@Braiam Right, for every user
 
6:44 PM
It's O(n) with n being the number of users.
@Dharman Well, at least the user wouldn't notice ;)
Because you where going to do that at login.
 
But this is exactly what I calculated above would take 15 years
for(user in userList)
for(password in knownPasswords)
checkPassword(user, password)
 
"don't compare plaintext password values against a plaintext list..."
As tyler said, you kinda need to ^
At least with my method, it's asynchronous to login.
 
I'll stick with my method. I prefer 150ms response time than 15 year long batch job
 
@Dharman But they are feasible. Wikipedia says the private key is kept on a user’s device and can only be accessed when a biometric signature, hardware token or other passwordless factor is introduced. Sounds expensive
 
Also, where the heck did you get a list with 100 million passwords?
 
@Dharman Eh, I get you.
You don't store the database of known password.
I was thinking that you got openwall word list or something openwall.com/wordlists
 
@oguzismail A lot of modern smartphones do that already. It's not expensive, but support for this is wonky
If I remember correctly I don't have a password set up for Stack Overflow
 
Me neither, I login through Google, for which I have a password set up. My phone has a fingerprint scanner on its back but I stopped using it because it fails to recognize my finger 4 out of 5 times.
 
7:05 PM
I hate myself. Openldap can check against hibp... (scratch that, it was a selfservice helper)
 
7:19 PM
@Dharman I'm not a fan of exclusively password-less access either
if I'm asleep, someone could open my eyelid or press my finger against a reader, hold the phone up to my face, etc.
someone could lift my fingerprint too, or record my voice
It's probably a good idea to use in concert with "something you know" but until we invent mind reading technology, MFA should always include "something you know"
IMHO
 
Every passwordless services that is easy to use and publicly available has a password somewhere.
Also, I got burned once by lastpass being down for a while, so I don't like that my access is predicated on someone services.
 
 
1 hour later…
8:32 PM
 
 
2 hours later…
10:17 PM
@rene I think now I understand why you asked @Glorfindel about 5-3-2...
@WiktorStribiżew why does the question lack details and clarity? Seems like a clear input/ouput example. (I don't understand much about RegEx, so even if there is a reason to close I not able to vote on this specific post).
 
 
1 hour later…
11:29 PM
Would this answer qualify as NAA? Technically it's an answer, as it's saying "Call the function", but that should be a comment. What's the correct thing to do here? stackoverflow.com/review/low-quality-posts/29217681
 

« first day (2765 days earlier)      last day (1046 days later) »