The DMZ

@DavidFreitag Morning

dovid, stop it with your fucked up sleeping schedule pls

Q: Hashing passwords and dealing with duplicates

Oh, dear. This guy's post screams "I don't get security" and his profile links to his website. Should something be done about this?

6

Currently my project still uses MD5 hashing to encrypt passwords. Yeah, I know. I'm planning to update the password system to use the newer password_hash and password_verify functions in PHP, which will improve the security of the users' passwords. However, my moderator team has voiced a concer...

passwords

@ThomasPornin (and indeed any other mathy types) anyone know a good answer for... "A Web app uses a cryptographically secure RNG with 12 bits entropy for session IDs. There might be up to 100 authenticated sessions from legitimate users, active simultaneously. Assuming an attacker can generate 10 requests per second, how long will it take them to guess a valid session with 50% probability?"

Currently my project still uses MD5 hashing to encrypt passwords.

I projectile vomited as soon as I saw that

6:12 PM

@Iszi What a shitty way to test if 2 accounts were made by the same person.

my (non-mathy) searching leads me to birthday attacks on Crypto.SE and crypto.stackexchange.com/tags/birthday-attack/info

One such way that they have used is to check if the MD5 hashes are the same on the two suspect accounts

vomiting blood wtf

If he's making this kind of mistake, I wonder what other mistakes he's made...

Not that I would try anything to the site. cough

@RоryMcCune Wouldn't the general probability of hitting a valid ID be 100/(2^12)? After that, I'd think the maths should be simple - though I can never remember how it's supposed to go.

He's not making the mistake, he's the developer.

@MarkHulkalo Precisely my point.

6:14 PM

He has to deal with that the "admins" request.

Oh, he made mistakes alright.

1. MD5
2. Unsalted Hashes
3. Giving end-users (moderators) access to password data.

@Iszi well the birthday attack page says 1.2(√k) where k is the number of options, so that would be a collision expected in 76 guesses

@Iszi I'm willing to bet that he knows those are bad practices.

@RоryMcCune I like the browser-fingerprinting suggestion.

but I wasn't sure what it meant in probability terms by "expected" also that doesn't factor for there being 100 right answers instead of one

6:16 PM

@Simon He's admitted to #1, but he's still trying to allow 2 & 3.

@MarkHulkalo yeah it can range from the OK to the really creepy (I have seen a company use the really creepy) but it's better than what they're doing now (would be hard to be worse!

windows-server-2008-r2 group-policy audit

Need some DC help

0

Q: Server 2008 R2 & Auditing

Having an issue with auditing a network for logins. I am looking for Event 4740 but the logs are not showing them. Neither on the local machines either. I have verified that Account Management Auditing has been enabled and is set to Success And Failure and I have checked the Logon/Logoff policy ...

@RоryMcCune Randomize browser vars :D

SecretAgent defeats it pretty quickly

@JukEboX ya know that serverfault has a chat room that goes with it, and you may have better luck there :)

I get a new browser fingerprint every time I refresh

6:18 PM

@RоryMcCune If there's only 2^12 possible session IDs, and an attacker can do 10 requests per second, I wouldn't worry about the time required to hit one with 50% probability. I'd be more worried that it would only take less than 7 minutes to hit all with 100% probability.

@RоryMcCune I don't know if I have ability into it. What is it called?

@MarkHulkalo oh yeah it totally doesn't work against a user actively trying to bypass it, but then 99.99% of users don't do that

@Iszi When your boss tells you that he wants to have access to those things, you give him access.

@Iszi sure but that wasn't the quiz question I got posed :op

He's probably trying to find the most secure way to solve his shitty practice.

6:18 PM

@RоryMcCune Agreed, yeah. Nobody's gonna go through the time and effort to do that... but what if it were enabled by default? That would make advertisers cry. :P

@Simon Agreed, but fortunately I don't work for idiots that would request something like that.

@Simon To an app developer, "moderators" < "boss".

@JukEboX chat.stackexchange.com/rooms/127/the-comms-room @Iszi and @jrg hang out there it seems :) I've never been until now

@RоryMcCune Recently discovered that's a ghost town.

@Iszi yeah

@Iszi True.

6:20 PM

@Iszi yeah how weird, did the denizens migrate somewhere else I wonder?

Plus @RоryMcCune when you type R Tab @RoryAlsop comes up first in there

@JukEboX that's the goal of my username :)

@RоryMcCune A private Slack instance.

@Iszi ahh weird

We should do that.

TildalWave

6:21 PM

@RоryMcCune funny how its description is exactly the opposite to what you proposed it be used for :)

^

@RоryMcCune I guess they were getting too rowdy, and got tired of all the dirty laundry on the field that they couldn't control. So they went to a platform they could have more ownership of.

@TildalWave well yeah but to be fair to me I didn't know that till I went looking for it

and as I don't usually go there ...

@RоryMcCune Explain your creepy browser fingerprinting thingy. I want to know more!

@MarkHulkalo panopticlick.eff.org

has the lowdown

basically your browser gives up a lot of info, which can be used to effectively fingerprint you in a lot of cases, things like installed fonts

6:23 PM

Yeah, I mean I want to know about the company that used it in a really creepy way.

And what they did with it

@MarkHulkalo well all I know is that they had it loading on their site and were collecting the data, it was a loans site IIRC (many years ago) no idea what they did with it after that :)

I was doing a web app. test so obviously spotted the odd behaviour

Creepy

Might've been used to try and prevent multiple fake loan submissions, though

@RоryMcCune Using installed fonts? What does it do, try to load them in decreasing order of rarity and log which ones get loaded until it matches a fingerprint?

We need to start working on an authentication scheme on the Web through your DNA.

@Iszi No Flash or Java fonts detected was the result I got for that bit of the test, so looks like it was/is a Java/Flash thing

I don't run with either in my browser, so ain't getting me that way :)

from my results, looks like the main thing they detect on it browser plugins

6:28 PM

@Iszi It works like this: JavaScript/Flash can detect the fonts you have installed, so if the website can detect those, it will add it to the list of potential fingerprints. You either have to disable this, which would add more uniqueness to your fingerprint since almost nobody does that, OR randomize it.

Er, let me rephrase. The more unique features about your fingerprint, the more unique you are.

Screen resolution, color depth, fonts, plugins

You're a screen resolution.

I don't run flash, but it still got my plugin list since I'm not actively trying to hide it right now

Plugins can also simply give you a unique install number, and install itself with a unique key/number

So when you look for the plugin details, it could show something like... pluginname v1.0 - 55297810

That EFF site is cool, but it does little to put your results into proper perspective. Approximately how many "millions" of visitors have they had? What's the average "bits of information" conveyed by a visitor's browser, and how does that affect your uniqueness or lack thereof? What's how big is the user base of the most/least common fingerprints? Maybe I need to read the linked article.

Apparently nearly 7 million visitors, it says when you try it out

Ohnana

> Within our dataset of several million visitors, only one in 3,060,294 browsers have the same fingerprint as yours.

6:34 PM

@MarkHulkalo "Several" does not at all imply "seven".

Your browser fingerprint appears to be unique among the 6,120,600 tested so far.

Okay, so 6.1 :p

I thought I read 6.85

@MarkHulkalo Ah, I didn't have a unique fingerprint. So it just said something like what @Ohnana had.

But yeah, good question. I'd like to see the data

Herringbone_Cat

Your browser fingerprint appears to be unique among the 6,120,604 tested so far.

Great. I guess a lot of people are running Chromium on Antergos Linux with weird fonts.