« first day (1467 days earlier)      last day (3405 days later) » 

1:37 AM
0
Q: Good password hashing algorithm compatible with PHP and Linux apps

LonelyPixelI'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that plain or salted MD5 and SHA-1 are not a good solution. I hear that sha256crypt and sha512crypt sh...

This is clearly not a dup. I tried to make that clear by changing the title. Did the last two people people that closed this even read the comments, to say nothing of the title? The OP disputes that bcrypt is an option, due to differences in the names used for the hashes. Still looking for an answer...
 
 
4 hours later…
5:46 AM
@nealmcb User is throwing out options not because they're unworkable, but because the user either simply doesn't want to use them or doesn't know how.
Either the question is "how do I pick a good hashing algorithm" and it's a dupe, or it's "tell me which algorithm I think I'll want" and it's off-topic.
I see no other interpretations
 
 
4 hours later…
9:28 AM
Morning All
 
@RоryMcCune Morning.
 
9:53 AM
'morning folks
sunny and slow morning, as a matter of fact
 
morning morning
 
Wish I could go and fly... Alas: I'm on support suty
duty
 
@Stephane not so much up here, it's warm for the time of year, but pretty rainy
@Stephane heh, I'm report writing today :o/
 
@RоryMcCune Sorry to hear that.
Good luck
 
@Stephane it's Scotland we kind of expect wet :)
 
9:55 AM
I'm daydreaming seeing people fly on the nearby montain... Wish I were there
lol
At least, you have good beer to compensate
 
@Stephane and whisky !
 
@RоryMcCune Can't stand the stuff myself but, if that's your thing, I guess you're in the right place
 
@Stephane weirdly I didn't used to like it at all, then moved to the highlands and tried some for the first time in ages, now I really quite like it..
 
@RоryMcCune True that: some things can only be appreciated in their native land... I feel the same about Pastis
Can't drink it except in south of France
 
@Stephane good point, I'm not a fan of guinness apart from in Dublin
 
10:00 AM
That's my favorite brew anywhere :) Ah well, life is more interesting when people have different tastes :)
 
@Stephane pasties?
like, what Miley Cyrus wears?
 
Pastis (French pronunciation: ​[pa.stis] ; UK /ˈpæstɪs/ or US /pæˈstiːs/) is an anise-flavored spirit and apéritif from France, typically containing up to 100 g/l sugar and 40–45% ABV (alcohol by volume), although alcohol-free varieties exist. == Origins == Pastis was first commercialized by Paul Ricard in 1932 and enjoys substantial popularity in France, especially in the southern regions of the country. Pastis emerged some 17 years after the ban on absinthe, during a time when the French nation was still apprehensive of high-proof anise drinks in the wake of the absinthe debacle. The popularity...
 
@RоryMcCune you prefer IPA, dont you? ofc you wont like guinness
@Stephane interesting
never heard of it. sounds not too different from arak
just (hopefully) better tasting
 
@AviD It's not that different
Try it if you ever go to south of France. It's worth trying it at least once.
 
@Stephane dunno... I really dislike arak...
 
10:04 AM
At least, it's more interesting than Vodka or Akvavit...
 
@AviD well beer-wise it depends, lagers sometimes (Moretti, peroni) but belgian beers like leffe or duval for preference
 
@Stephane dont disagree, I never get drinking vodka straight. its for mixing.
@RоryMcCune I prefer a thick, dark stout. so guiness is in the right category, just not great.
 
Well, I think I have to live with the fact that I'm not into spirits...
my sin is beers...
Well, alcool-wise anyway...
 
@Stephane my sin is avarice
 
@Tinned_Tuna Luckily, I overgrew that one :)
 
10:07 AM
I would say that my sin is pride, but I dont think it counts if I'm really that much better than the rest of you.
 
@Tinned_Tuna don't you work in academia?
or is my memory failing me again
 
@RоryMcCune currently, yes
 
this wouldn't be a huge surprise
@Tinned_Tuna just saying you may be in the wrong arena for avarice :op
@AviD apart from the bear
 
@RоryMcCune well, obviously
 
@RоryMcCune hah :-)
 
10:11 AM
@AviD I've never heard anyone say they like it except Finnish tourists visiting Turkey. Reminds them of salmiakki.
 
@Kisunminttu afraid to ask what salmiakki is... sounds like some kind of fermented fish.
but lots of mideasterners love it.
as I'm sure @Adnan can tell you...
the more "eastern" part of the mideasterners.
 
@AviD It's basically liquorice with anise flavoring or ammonium chloride (sometimes both). We leave the fermented fish for the Swedes (surströmming), but we do love pickled herring!
Mmm... pickled herring with pickled onions and carrots...
 
@Kisunminttu Oh god, someone had me try that stuff at a party recently
 
@Kisunminttu eww. herring should be smoked. ;-)
 
@Kisunminttu I <3 ansie and that lot... but whatthebabbybejebuswhereyoulotthinking
 
10:22 AM
@RоryMcCune BOOM, it is ON
 
@Tinned_Tuna Nom nom nom.
 
@tylerl sure, and CodingHorror blog's captcha used to be "orange" for years. but any non-dumb spam can bypass that easily.
though from the little I've looked, reCAPTCHA's new No-CAPTCHA actually looks good.
and btw @tylerl, from that perspective, there is nothing wrong with the Troy's implementation there, either. it will have at least as much effect.
 
@AviD I prefer smoked fish to any other sort. We also have a tradition of rolling gutted vendaces in egg + flour and then frying them on the pan
 
@AviD hey it wasn't me saying that CAPTCHA are useful, I just said you missed his point :op
@Kisunminttu what's a vendace?
 
Coregonus albula, known as the vendace or as the European cisco, is a species of freshwater whitefish in the family Salmonidae. It is found in lakes in northern Europe, especially Finland, Sweden, Russia and Estonia, and in some lakes of the United Kingdom, northern Germany and Poland. It is also found in diluted brackish water in the Gulfs of Finland and Bothnia, both of which are in the Baltic Sea. The length of an adult is normally about 25 cm (10 in). The maximum age reached by this fish is about ten years. The vendace is traditionally the most important target of freshwater fisheries in parts...
 
10:27 AM
@RоryMcCune no, I didnt miss his point, my point was that HE was missing it.
hey, its not often I get to school Troy Hunt, right?
@Kisunminttu oh whew. it sounded like something gross, I was afraid to google it.
 
@AviD yarr, but he asked question A you then answered question B I just pointed out you didn't answer the right question :op
 
@AviD Well, the kinds of fish we've been discussing here are kinda gross...
 
@Kisunminttu who knew, we even have them in the UK
 
hey everybody, whats wrong with my butter?
Everybody: it's not spread thickly enough!
Me: uhh, you put the butter on a live eel.
2
 
@RоryMcCune I was surprised by that fact!
 
10:30 AM
@AviD indeed you didn't answer the question but wanted to talk about a larger issue :op didn't say you were wrong just that that wasn't the question
 
@RоryMcCune sometimes its okay to answer the not right question.
again, my point is that if you want CATCHA at all - that captcha is almost as good as any.
8 mins ago, by AviD
@tylerl sure, and CodingHorror blog's captcha used to be "orange" for years. but any non-dumb spam can bypass that easily.
YES YES I HATE CAPTCHAS PLEASE JUST LET THEM ALL DIE
 
@AviD well yeah but a CAPTCHA with selectable text isn't actually a CAPTCHA, (or at least not the intended test)
 
@RоryMcCune every captcha is not really a captcha.
 
@AviD sorry I'm a bit unclear, are you not a total convert to the usage of CAPTCHAs then?
 
nor is captcha what captcha is intended for
@RоryMcCune hehe
@RоryMcCune only to protect against SQL injection.
yes, I have seen that suggested. True story.
 
10:33 AM
Hah, someone I know has just come up with "Theresa 'Complete Disarray' May."
 
@AviD Arak?
I used to like it back in the day. Not a big fan anymore
 
and I'm sure you know/knew plenty of people who do
 
My grandpa used to make it from figs
@AviD Yup. I'd say at least 40% of my friends
It's a the drink to have while eating BBQ
Some people call it "The milk of the mood"
Because it becomes white when you mix it with water
One of the very few times in my life that I got drunk was because of arak.
Well, it was because I was stupid
but arak was involved
 
@Adnan I'd have loved to be a fly on the ceiling then
Unless something unpleasant happened. In that case no.
 
@Kisunminttu Whoa! That's @Lighty-grade creepiness
2
 
10:44 AM
@Adnan I got the creepies, man. That time of the month.
@Adnan "I'll see you this evening, but you might not see me"
 
I am so cold
 
@Kisunminttu No no, you don't get it. Netanyahu drew a silly cartoonish picture about how creepy that was and asked the US to bomb it
 
I thought arak was made from aniseed.
 
@Adnan That's brilliant
 
10:46 AM
@JourneymanGeek It's one of the components. It's an aniseed-flavoured drink
 
Yeah, its the aniseed that makes it opaque
(I don't drink. Oddly I find the process of making booze fascinating ;p)
 
@JourneymanGeek And it gives it its signature taste
 
@JourneymanGeek Well.. that's 70% true
@Kisunminttu Reference:
 
@Adnan :D
 
What ?!? No XKCD ?
3
 
10:48 AM
@JourneymanGeek Well, then you've come to the right place. Making alcoholic beverages is my thing. Mainly wine, though.
 
As long as it ain't pruno.
 
@JourneymanGeek When my wine tastes like a 10-EUR bottle, I throw it down the toilet
 
High standards and stuff
 
@Adnan How many times have you had to do that?
 
10:50 AM
@Kisunminttu More than I care to admit
@JourneymanGeek My speciality is making wine with high percentage (above 15%) that tastes like it's below 7%
 
@Adnan I had no idea!
 
This explains a lot.
 
Oh, enlighten me
@Kisunminttu Yeah, love. It used to happen a lot more often than now
It took me a while to get used to grapes and fruits you get in Finland
 
@Adnan Aww :(
 
If I had my chem test kit, I'd have probably done much better. But you know, coming from Syria with a bunch of chemicals and chemistry equipments.. Not a Good Thing
 
10:55 AM
@Adnan "It's for making wine, I swear!"
2
 
11:38 AM
good boredomday
 
@kalina it's Christmas week, how can you be bored!
 
Got a surprising bunch of rep from my hat whoring question.
 
12:06 PM
@TerryChia smeg, does this mean I have to start answering questions again to avoid sliding down the charts?
 
@RоryMcCune Nah, I won't gain 2k rep before hats are gone.
It's only because of hats I started answering again.
 
@TerryChia yeah even I answered some stuff, haven't in a while... I'd say they should do hats more often, but it'd lose the novelty value after a bit...
 
@RоryMcCune They don't have to call them hats. ;)
 
@TerryChia I tell you if they offered a bit of schwag for specific goals or competitions I bet it would increase activity quite a bit
 
@RоryMcCune I'm still sad I don't have a t shirt.
 
12:10 PM
@TerryChia yeah I got lucky when the elder rory acquired a con. swag pack
 
raz
12:57 PM
0
Q: Negotiate n-bits key with Diffie-Hellman protocol (or other key exchange protocol)

Ty221I've got ASCII message. I convert it to binary - then I've got 8*(ASCII message length) bits - let us assume this value will be called n. I have to negotiate key, which length (after conversion to binary) will be equal to n. Is there any possibilty to do that? Do I have to choose specific random ...

"Do I have to choose a specific random number?" You keep using this word random. I don't think it means what you think it means.
 
F*ck
really?!
I was online that day -.-
there goes my useless badge );
 
@Lighty What constitutes "online activity" for StackExchange is not public knowledge. We know that browsing the main page is not sufficient.
 
raz
@ThomasPornin I generally at least upvote a question.
 
@ThomasPornin Or reviewing, or being online in chat, or reading questions
 
raz
That seems to be enough
Chat definitely doesn't count.
I missed the 13th this month because I was distracted by my new TV.
 
1:08 PM
yeah, you have to be on the Site, I was as far as that, but seriously, I had almost 100 days, and I browse questions, and review every day, trying to learn something too
;~;
 
raz
@Lighty I was at 92. I'm sure I'll get that useless badge eventually. I'm not that broken up over it.
 
@raz I'm an Achievement hunter, it's one of those things that kepe me busy, pretty cool
nto for fame, but for completion and discovery xD
 
raz
I do it for the chicks
Just like Jesus
 
Good morning sunshines.
 
@Simon afternoon doughnut
 
1:20 PM
@RoryAlsop See how hard it is to spell it that way?
^_^
 
@Lighty talking of that...anyone want to give me a downvote for this:
3
A: What benefits are there for security architecture being a separate discipline to enterprise architecture?

Rory AlsopTo post a contrary view to AJ's excellent answer: At a large corporation, architecture may end up being the responsibility of multiple teams in different departments, countries, regions etc. in order to be performant for each region, whereas enterprise security is likely to be managed from a glo...

Not all at once, obviously
As then if someone else gives me an upvote I'll be back level with Terry
:-)
 
upvotes both
>:D
 
raz
I should downvote out of spite.
 
@raz I think I need a down vote to get the hat
 
I voted yesterday and didn't get the Solstice hat.
Therefore, I am out of this glitchy race.
 
1:23 PM
@Simon ahh -when? I got mine on Saturday
 
I even voted the day before when some people claimed they got the hat anyway.
Yeah I voted on Saturday too.
 
@Simon solstice was not for voting - it was for posting or commenting
 
NOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO
GOD DAMN IT LEARN TO READ FRENCHY
 
@Simon lol
@raz please do :-)
 
1:34 PM
Is it because of his shitty choice of subdomains?
 
raz
@RoryAlsop I will do neither. I will do nothing to encourage the use of hats.
 
Now let's call every fucking successful injection an XSS attack
 
@RoryAlsop What do you need, an upvote or downvote?
 
XSS has nothing to do with SSI
They might seem similar
Uggghhhh..
I need to be less angry. Help me, @Simon
Share your wisdom
 
@Adnan My wisdom? Hang on.
Watch it all and you will be fine after.
 
1:36 PM
@Adnan @Simon? Wisdom? hahahahahaha!
 
There's Mr. Negativity, everyone! Hide your happiness.
 
@TerryChia Ahh.. I see your point
 
@adnan that article gave me many lols.
at least they linked to OWASP so their readers can actually have something useful
 
@Ohnana I know, right?!
 
@adnan they also didn't drop a netcat executable on the server to set up a listener. 0/10 system shell, would not ls
 
1:45 PM
@Adnan they're writing about SSI in 2014......
 
@RоryMcCune But but but.. you see... it's through XSS :|
 
@Adnan 'cause < > == XSS right?
 
@RоryMcCune What? Aren't we all writing webapps in C using CGI?
 
@RоryMcCune Oh my god YES!
I already emailed the dickface
Telling him that his app can be vulnerable to XSS and SSI injection at the same time
 
1:47 PM
 
@TerryChia :D
 
@TerryChia Something you never said, eh?
 
@Simon that's a burn
 
Holy shit, I need to do the "How does X vulnerability" affect me type of post more often.
+20/-1 on the question, +24 on the answer.
 
@TerryChia hey I thought you weren't going to turn back into a rep ho..
 
1:58 PM
@RоryMcCune Kicking you from the third row is tempting though. :)
 
@TerryChia thank you soo much, don't you have a tank to polish or something
 
@RоryMcCune Psssh.
3
Q: Why shouldn't I use ECB encryption?

RogueI'm using Java to generate encrypted strings, and I get this warning at build time: ECB encryption mode should not be used So I'm wondering why I shouldn't use ECB and what I can use instead?

 
@Simon a down please :-)
 
Very interesting information in that question.
 
@TerryChia I like that Java is giving him this warning
 
2:03 PM
Tank Polisher :-)
 
@Adnan Looks like it's the IDE.
 
Oh yeah, Android Studio
Well, let's email the developer and agree to send him a beer
Oh, looks like it's by Google
 
@Adnan Android Studio is from Google IIRC.
 
Hey, @tylerl. Want some beer?
 
They based it on JetBrain's IntelliJ.
 
2:05 PM
@Adnan I hope it stays a warning though.
 
@tylerl I agree that it is messy question, but there seems to be something indeed confusing and poorly documented there about the bcrypt algorithm naming, so I want someone who understands that to give an answer. Evidently someone is trying hard to do the right thing, and the fact that they're confused means we can offer clarity. I see three votes now to reopen. security.stackexchange.com/questions/76538/…
 
Last week I had to reimplement DES (and 3DES) because .NET's implementation refuses to use an all-zero key.
 
According to a Google search
 
(This was to run a challenge-response protocol with a smartcard. The all-zero key is the default factory key, so I must be able to compute 3DES with that key.)
 
> Warning: ECB encryption mode should not be used
@ThomasPornin How did you get around it?
 
2:06 PM
@ThomasPornin um... why.. what... all-zero key? What? I am so confused, why do you want that?
ahh
 
@nealmcb I think I'll reopen (I know cheating using my 2 votes)
 
@RoryAlsop HAT ME!
 
@Adnan Opened FIPS 46-3. Reimplemented DES in C#. Took me 90 minutes.
 
@ThomasPornin Yeah, I totally know what you mean.
(the 90 minutes part)
 
@RoryAlsop Thanks :)
 
2:07 PM
@RoryAlsop Done, I will also be leaving a comment explaining how you can improve your answer.
 
and the other parts as well :D
 
@nealmcb - it had 4 votes already so didn't need to use mod powers
@Simon lol thanks
 
@RoryAlsop Woot, thanks for Breaking Bad hat.
 
Does that mean you are still ahead? :-)
 
@RoryAlsop Yup. :)
 
raz
2:45 PM
Anyone have Win8.1 dual booted with Linux?
 
@raz I spent a night trying to set it up with UEFI and gave up.
 
raz
@Simon Right!? I can't effing get it to boot from the USB drive.
 
@raz Yeah it's a damn nightmare.
I had the exact same issue.
 
@raz Are you starting with windows first or linux first?
 
I dooooo
 
raz
2:47 PM
@DavidFreitag Windows
 
@DavidFreitag I'll bet Windows.
I WIN MY BET
 
@raz that's good because that's how I did it
 
Good, because otherwise bad things happen.
 
1. turn off secure boot. 2. install ubuntu. You'll be locked out of windows
 
raz
Yeah I've done it before with Win7
 
2:49 PM
@Ohnana Grub should detect windows and setup a chainload for you. Or at least ask.
 
raz
@RoryMcCune This is why Win8.1 is terrible and NOT just an "improved" Win7
 
you actually need a package called secure-boot to make it work
install that, grub-update, and then presto grub should be able to boot it
 
raz
@Ohnana So I've turned off secure boot, but my problem is getting the system to boot to the USB.
 
Then mess up everything and cry.
 
@raz What utility did you use to make your bootable usb drive?
 
raz
2:50 PM
@DavidFreitag I think it depends on if you installed Linux to the EFI partition or not.
 
@raz eh? try keeping in the usb between reboots. it takes a bit to get it to recognize
@simon that's typically the last step
 
raz
@DavidFreitag I tried RUFUS and Universal USB Installer
 
@raz I tried multiple too.
And multiple keys.
 
raz
@Simon I only have the one, but I know the USB key is good because Win8.1 recognizes it when I plug it in.
 
@raz do you have a cd drive? at this point i'd white flag and make a cd
 
2:52 PM
@raz hmm I've never seen windows as being happy being dual-booted, back in the day you always had to do windows first then linux, or windows would blow away the boot loader, 'cause it assumed it would be the only OS :)
 
The laptop I had didn't have a drive.
 
raz
@RоryMcCune Well yeah but at least I could boot from USB, and you know... manage my system reasonably.
 
@RоryMcCune On Windows 7 it's a joke to dual-boot.
On 8, it's a joke to try to dual-boot.
 
@raz is that not an EFI thing rather than an OS thing?
 
raz
@Ohnana Yeah I might have to throw up the flag. It's stupid, but maybe I have to.
@RоryMcCune Windows mechanisms for rebooting using an EFI device is insane. Ctrl + I to bring up the settings menu. Change PC Settings > General > Recovery > Advanced Startup > EFI Devices.
 
2:54 PM
@raz silly you, thinking you have complete control over your computer
4
 
@raz Just curious, how have you tried booting from the flash drive? I assume you have tried everything eg. boot from uefi, from the F10 menu and by setting it higher than the primary disk drive?
 
raz
Because that's straightforward, and instuitive.
@DavidFreitag Well... with UEFI that doesn't really exist. I've tried going to Legacy Support. And from there I can choose which device to boot from. But then the whole laptop hangs when I choose USB.
So maybe that's more my USB image is wrong, but I've also read that turning on Legacy Support will break everything depending on how the manufacturer supports UEFI.
 
@raz That might indicate an issue with the disk
 
@raz IIRC, if you choose Legacy Support it'll work but you will have a hard time booting back on Windows.
@DavidFreitag No, I had the exact same issue on my laptop.
 
@raz Who is that manufacturer for the mobo?
 
raz
2:58 PM
@DavidFreitag It's a Lenovo laptop... friggin' Chinese.
 
huh, mine's a lenovo too. the Carbon x1
 
raz
Never again, I hate this damn thing.
 
@raz I haven't encountered the Lenovo uefi, mostly just ASRock, ASUS, and Biostar.
 
raz
Mines the Y512P
 
@simon I have legacy support. It doesn't bork things. it just makes the boot splash kindaa ugly
 
2:59 PM
@Ohnana Then that might be the way to go.
 
raz
@Ohnana Maybe I just need to go in fresh. Reformat the pendrive separately
 

« first day (1467 days earlier)      last day (3405 days later) »