So I saw this in our security mailing list: Gmail acct w/ 2FA hacked because of crappy phone security

It's pretty common in the industry to assume that your phone number is a reasonable second factor token. But.... that would require the phone companies to exercise even a modicum of caution when doing things like forwarding your number to someone else's

So we're all f*cked

What's with the obsession over short screen names? I think I heard something similar from a guy who had a one-letter handle awhile back.

lol

@RoryAlsop Damnit, why'd you have to bring up Lemmings? As if KSP isn't sucking enough of my life away these days.

Cause its special.

Then again, I go for longer screen names for the same reason ;)

Phew. Not on Steam or GOG.com. I think I'm safe, for now.

@tylerl This is basically the answer to everything.

BTW: Anyone who doesn't have Watch_Dogs yet - Steam's got it 40% off this weekend.

The Witcher 2 for $4? No way I'm passing that up.

Crap. All the games I'm probably about to buy, and get in trouble over, I blame @RoryAlsop for now. :-P

lol

I know that feeling

Hahahahahaha

@Iszi that was mat honan.

@tylerl No, someone else. I think his handle was @n or something like that.

supposedly something similar goes on with xbox gamer tags (hotmail account names)

@Iszi On Twitter? Dayum.

lots of social engineering to get desired names for "hacker cred" or whatever.

I want @ayrx on Twitter. :(

The interesting thing is that Twitter actually allows this. Mat went to them after his got hacked and twitter was like "nope, you lost it. sux for you."

looks like he got it back after he wrote up the story on wired.

@tylerl Oh btw, really loving Inbox after using it for a week. :)

@TerryChia It's my primary on my work phone. Doesn't work w/ G.Apps, so it's not on my personal one.

@tylerl Ah right, I only have my @gmail so that's not a problem for me. :)

Will be cool to have it available for g apps though.

yeah....

What the fuck, Netflix?! techblog.netflix.com/2014/10/…

@Thomas You might find this interesting

Oh, and I bet @Terry would as well

They Dave'ed the shit out of SSL

Here's a fun bit github.com/Netflix/msl/blob/…

public boolean verify(...){
   ...
   return Arrays.equals(hmac, envelope.getSignature());
}

Yaay! My first contribution to a project on GitHub github.com/Netflix/msl/pull/8

DON'T F'IN ROLL YOUR OWN CRYPTO!!!

I just responded to someone sending by email to me his latest and greatest creation of an encryption algorithm -- that turns out to be Caesar's cipher.

They didn't just roll their own crypto, they did things far beyond that

@ThomasPornin BAHAHAHAHAHAHAHAHAHA

Meanwhile, I received a spam promising:

"Dude, a dead guy in a toga could crack this shiz"

> Get 30% rebate on your solar system

Even spammers have understood the scale of my ambition.

@Adnan This comparison is not a problem in encrypt-then-MAC. I have not looked at their protocol but if it is encrypt-then-MAC, then they don't have to fear timing issues related to MAC (which is one of the reasons why encrypt-then-MAC is better than MAC-then-encrypt).

@ThomasPornin Oh, okay. So it's like when timing attack doesn't really matter with time-variable comparison in bcrypt-based password storage.

It actually makes sense

@ThomasPornin and yes, they are doing encrypt-then-MAC

@ThomasPornin Investment hint: Beta Pictoris. Buy at 30% off then earn by collecting royalties for all the pics they're taking of it lately :)

So true

@ManishEarth But but but.. you see.. problems with HTTPS!!

@Adnan :o :o :o

Btw, anyone from SecSE live in/near Portland?

@Adnan Yep, had a quick glance at it earlier. :)

Good afternoon

Good evening?