You can run at 90, but I think 60 -> 120 will be the common strategy given easier development and ultimately better refresh rate

This is mostly correct. The games actually get a choice about how they want to render Most games will choose to render at 60fps, the game reports this to the OS and then the headset will know to reproject between each frame, so the game gets plenty of time to get the next actual frame ready.

Some games will do 120fps though, not sure who will pull that off voluntarily though!!!

I believe reprojection is always active on the PSVR, whether you're rendering at 60, 90 or 120 fps.

Not available in UK apparently, clearly shows a UK plug too. :'(

I don't think this is a good idea, even if the database is just listening to localhost. Say a malicious script gets uploaded to the machine, it will be able to dump the entire database without any need to seek out credentials.

Agree... it's better to still have credentials, but ALSO only listen locally. At least that way the credentials need to be found first!

You can't see it when you login either, think this is for select beta testers.

MD5 hashes of emails is very common practice for Gravatar etc. - although it's fairly sucky, I'm assuming this is in the API specifically for things like showing Gravatar images.

I reported a username -> plaintext email vuln to Disqus earlier this year and they were very prompt in patching it, I wouldn't criticize them for this at all as this a very common issue across most blog comment systems.

Would be nice to change how Gravatar works, but it's fairly fundamental. I think if you want your email to be private you should probably be registering temporary ones or using the + aliases like gmail offers to avoid these kinds of hash-cracking attacks.

Another solution would be for these services to use something with a greater work factor than MD5. When a typical user can brute force MD5s at a rate of 8.5 billion per second with AMD HD7970 graphics card then it's time to use a different hashing algorithm. Something like scrypt or bcrypt with a larger work factor would make these attacks much harder and more expensive, while leaving the fundamentals of the system the same.

http://hashcat.net/oclhashcat/ https://www.tarsnap.com/scrypt.html https://en.wikipedia.org/wiki/Bcrypt

What he said. Old, commonly known and previously exploited. Here is how you disable autocomplete on your website: https://developer.mozilla.org/en-US/docs/How_to_Turn_Off_For...

Disabling autocomplete just forces people to write the password manually, which can still be copied. How is that any better?

the cherry here is autofill. no user involved

If you get xss-ed the last thing you should care about is limiting autocomplete.