The DMZ

Gilles

12:07 AM

By the way @RoryAlsop ICBC is bigger than BoC (but still about 400k employees, not 9M)

David Freitag

12:20 AM

I have a oneplus one invite if anyone is interested.

It expires in 12 hours

Xander

1:12 AM

0

Q: how to find a cryptography scheme (either authentication or encryption) for which some formal analysis of security has not been done yet

I have a project in Cryptography where I have to discuss the provable security of any proposed scheme (encryption or authentication) which has not been discussed yet. Any pointers on how and where to start? I tried researching some schemes but I could not find any scheme for which any security ...

cryptography

This guy needs that chess algorithm, that supposedly had an S-box based on the movement patterns of the knight.

Found it! skcjju256.com

Thomas Pornin

1:33 AM

@Xander Say that to Microsoft.

I am using .NET. .NET relies on CryptoAPI (and completely ignores CNG).

Also, CNG has no support for CMS (PKCS#7).

Xander

2:01 AM

@ThomasPornin Microsoft does have a managed library on top of CNG: clrsecurity.codeplex.com The lack of PKCS7 support, I cannot help you with.

KDEx

2:35 AM

Was browsing 99designs and saw the the url naturally was 99designs.com/logo-design/…

(hover and see the full link) Any ideas why this would be a normal link?

Simon

3:07 AM

@RоryMcCune That is actually my gf. She's pretty isn't she?

ManishEarth

5:08 AM

Anyone here know a good way to test HTTPS support without an internet connection?

Preferably a pythony library that lets me set up simple web pages with https

with various certificates

Lucas Kauffman

7:59 AM

@Simon if she makes you happy, that's all what matters!

CodesInChaos

9:17 AM

@ThomasPornin In a couple of places it does. AFAIR there are three SHA512 implementations, CSP, CNG and Managed.

BouncyCastle may have PKCS#7 support.

Rоry McCune

9:55 AM

Morning All

@Simon so she's quite animated then </dadjoke>

Nicolas Raoul

I have found a vulnerability in a website of an airline company (credit card number sent over HTTP). They don't seem to care. Should I just forget about them?

Rоry McCune

@NicolasRaoul shame that they don't care as that's a flat PCI breach, but realistically there's probably not a lot you can do. You might be able to report it to your data protection commisioner (if the country you're in has such a thing ico.org.uk is the UK one) or tweet about it which sometimes has an impact but past that apart from avoiding using that company, probably not a lot you could do.

Nicolas Raoul

10:16 AM

@RoryAlsop The airline is based in non-democratic country X, do you suggest looking for commissioners in that country, or my own country Y, or all countries that have such commissioners (in the limit of my available time)? In case of a tweet, should I worry that bad people might use it, or that it could somehow backfire on me?

Tinned_Tuna

@NicolasRaoul there's no point in using a different country's judicial system. More than likely, they simply won't have jurisdiction over the company in question. Although, I am not a lawyer, so consider this with a large helping of salt.

Terry Chia

@ManishEarth If you want to test client support you can simply use OpenSSL's cli to set up the server.

CodesInChaos

Don't Mastercard/Visa have some contacts where you can report PCI violations?

ManishEarth

@TerryChia oo nice

@TerryChia linky link?

@RоryMcCune Setting a getter is even better :p

Terry Chia

@ManishEarth On mobile so a link isn't convenient. Should be pretty easy to Google for though.

Rоry McCune

10:20 AM

@CodesInChaos good question, I'm not aware of them, but you'd think it would make sense...

really it's the acquiring bank that's responsible for PCI compliance, but there's no real way (that I'm aware of) to tie a specific merchant to an acquiring bank...

Tinned_Tuna

@CodesInChaos ah yes, I think they can revoke a companies right to take payments if you're flouting PCI-DSS

@RоryMcCune I thought merchants had to be PCI-DSS compliant too?

Terry Chia

So I'm starting to get recruiters reaching out on LinkedIn. That's annoying.

Rоry McCune

@Tinned_Tuna they do, but it's their bank that enforces it rather than visa/mastercard directly

Journeyman Geek

lol

ManishEarth

@TerryChia yeah, found it :)

Rоry McCune

10:22 AM

@TerryChia looking for mercs?

Tinned_Tuna

@RоryMcCune ah fairy 'nuff.

Terry Chia

@RоryMcCune Heh.

CodesInChaos

Sounds like there isn't anywhere to report it. security.stackexchange.com/questions/17835/…

Journeyman Geek

@TerryChia: How long before ORD?

Barry Carlyon

I'm a Merchant and our bank requires us to be PCI DSS Compliant.

Terry Chia

10:24 AM

@JourneymanGeek Pfft, I just started.

Journeyman Geek

ow

so 2 years

Barry Carlyon

s/I'm/The place that I work

Journeyman Geek

(was 2 1/2 in my day ><)

On the bright side, its impossible to fail BMT now ;p

Terry Chia

Yup. My recruit phase ends next week though, so I'll have much more time.

Journeyman Geek

Depends on your vocation

Being off that stinking island is nice tho ;p

Terry Chia

10:26 AM

I'm PES C and I'm SCDF.

Journeyman Geek

Oh

Terry Chia

So probably a clerk.

Journeyman Geek

then yeah, lots of free time ;p

Terry Chia

Hehe.

Rоry McCune

@TerryChia what's that stand for?

Journeyman Geek

10:27 AM

SCDF = fire/emergency

Terry Chia

SCDF? Singapore Civil Defence Force.

Journeyman Geek

You can also get posted to police, or one of the military branches.

Rоry McCune

@TerryChia and what's PES C ? (in my world PES is Pre-Employment screening )

Journeyman Geek

Physical something status

Physical Employment Status (PES)

Its a military/conscription thing that determines what job they can post you to.

Rоry McCune

Ah I C

ManishEarth

11:05 AM

@TerryChia all works, thanks!

The irony is, I self-signed a *.com cert and added it to firefox (most browsers don't like * certs). Then I ran it from localhost, so it doesn't work anyway :p I have the key to the world and I'm foiled by a combination lock

Transcript for