The DMZ

Thomas Pornin

12:48 AM

lci.tf1.fr/france/faits-divers/…

For non-French speakers: a French hunter was accidentally shot... by his dog.

Gilles

@ThomasPornin le bon chien de chasse, il voit un truc... ben il tire

AviD

hey @ThomasPornin, a question for ya... following on the Dell fiasco...

@jeremiahg which begs the question... should UAs still report instances where local certs override?

Tweeted by Paul_Reviews on November 23, 2015 at 11:54 PM in reply to jeremiahg

referring to local cert overriding HPKP pinning...

Thomas Pornin

@AviD I have not followed that story. What is this about ?

AviD

in short - Dell factory installed a self-signed root cert on a whole mess of new systems... with the private key available (weak password too, but whatever)... and its the same cert on all machines.

i.e. not too far off from SuperFish.

full writeup here... arstechnica.com/security/2015/11/…

@ThomasPornin obv. this isnt specific to Dell, just that this situation is becoming commonplace...

Thomas Pornin

Ah, I see

They were actually doing a full-grown MitM to plant ads

So of course the adware on the machine had all the power to generate fake certificates accepted by the machine. And since it is the same certificate/key on all systems, one can say that the biological waste is in an impact course with the air flowing device.

AviD

1:03 AM

heh, nice turn of phrase.

though thats whgat was with superfish, it was less malicious in this case (and seemingly more incompetence).

no malware installed, just the root cert (and private key, ofc).

supposedly it was for signing dell sw, but I still havent understoof WHY that would be being done on the endpoint in the first place....

regardless of WHY it was there, it is... and this is obviously not the first, nor the last time something like this happens.

as that tweet mentioned, HPKP cert pinning doesnt help, because browsers allow local certs to override that. so the question is, should the browser report these...?

Thomas Pornin

@AviD If browsers go at war against operating systems, I can predict a grim outcome in the medium term.

AviD

heh.

I dont think that is anyones intention...

I think it was more a TLS question, hence the request for TLS pros.

Thomas Pornin

Nobody really wanted to kill 38 millions of people in World War I -- and yet they did.

Anyway

AviD

maybe I should just have them ask on the site... get a qualified bear answer.

Mark Hulkalo

2:06 AM

@ThomasPornin

Do you mind taking a look at one of my answers?

I'm pretty confident I've massacred this guy's homebrew encryption, but if I missed anything, feel free to point it out

David Freitag

@MarkHulkalo You gonna link it or... what?

Mark Hulkalo

Sorry, got distracted

1

A: Is my developer's home-brew password security right or wrong, and why?

I'm going to try a different approach to answering this. I'm not going to tell you something is bad, and not explain why. I'll explain exactly why it's bad, step-by-step, and show you how to break it. Here's why your developer's hash is incorrect: because it just introduces a few factors that c...

David Freitag

Dude you dug up a 3 year old post?

Mark Hulkalo

Yeah

Lol

The accepted answer was basically "dude, don't do this. here's a bunch of links why. dude, my head hurts"

And I... necro'd it

David Freitag

Right....

Mark Hulkalo

2:16 AM

Basically, after figuring out his little technique, it comes down to a sha1 brute force, and it's game over

David Freitag

Can't help but thinking your answer is basically the same as this one:

71

A: Is my developer's home-brew password security right or wrong, and why?

To be fair to Dave, in terms of homebrew password security this is one of the better cases as all it just a little obsfuscation (and really not much) masking hash = SHA1(salt + MD5'(Password)) where MD5' does a reversible swap of the order of the bytes of the MD5 hash. Now the username/time/ran...

Mark Hulkalo

Don't know, didn't see it

Let me check

Nope. And that's too mathy for a dave.

David Freitag

Yes but the takeaway is the same, even if you completely forget about the maths

It's probably going to be nuked with hate-fueled downboops because you necro'd it. Just saying.

Austin Hartzheim

@MarkHulkalo Maybe Dave needs to realize that math is involved. It is easy to sidestep some of the arguments/assumptions in your own answer, which a Dave might be liable to do.

David Freitag

Also this ^

If Dave is trying to implement his own Crypto and he can't math then WHY THE FUCK IS HE IMPLEMENTING CRYPTO?

Mark Hulkalo

2:21 AM

@DavidFreitag Probably :(

Oh well, I tried my quarter-best.

David Freitag

Then delete it until you can try 120% of your best.

Mark Hulkalo

No.

Because I wrote a program that breaks this

As proof-of-concept

I'll probably post it later

David Freitag

Then add it to the question...

Mark Hulkalo

Right now, getting ready for the plane

David Freitag

@MarkHulkalo Where you off to?

Mark Hulkalo

2:29 AM

Vegas

David Freitag

@MarkHulkalo Oooh get a table dance for me will ya?

Mark Hulkalo

Might go to Cali too

Nah, I don't gamble/visit strippers or hookers

David Freitag

@MarkHulkalo Oooh smoke some weed for me will ya?

Mark Hulkalo

Never touched the stuff. Ever. :P

<= 100% clean

David Freitag

I did once, I nearly died

Mark Hulkalo

2:30 AM

Yeah, they found a pot needle in my friend's arm.

David Freitag

That's the day I found out I have asthma

It ended with me in the hospital with an oxygen hookup next to a very angry mom

Journeyman Geek

"pot needle"

whaaaaat?

Mark Hulkalo

Pot kills more than 150,000 per year

David Freitag

@JourneymanGeek It's a joke, man. I bet he did soooo many beers too

Journeyman Geek

(also, contact high is a thing. And I'll never do pot since I hate being mellower than I am ;p)

Mark Hulkalo

2:33 AM

David Freitag

lol

@MarkHulkalo Also, it won't be you getting a table dance, it will be me getting one via skype.

TildalWave

why would you look so depressed on weed? :O

Mark Hulkalo

I posted that on facebook for laughs, and a pot apologist flipped his shit

He argued with me for 30 minutes, and he was so sure of himself

Then I posted this:

And he blocked me

David Freitag

@TildalWave You're super hungry but all out of pizza bites

Mark Hulkalo

David, we need an alternative to hip chat. Got steam?

TildalWave

2:35 AM

@DavidFreitag sure but you just eat the cardboard box then

Mark Hulkalo

Or anything else

David Freitag

@TildalWave No but duude you don't understand, PIZZA BITES, man

TildalWave

dude there's a reason I didn't say PIZZA BOX

oh great now I'm hungry

Mark Hulkalo

Me too

Wife's getting the real Chinese food ready.

David Freitag

3:13 AM

@TildalWave I haven't eaten in 10 hours

Mark Hulkalo

3:24 AM

@DavidFreitag At the risk of sounding like an old Chinese grandmother, you really, really have to eat.

David Freitag

@MarkHulkalo I never eat

Mark Hulkalo

Why not?

Are you like povertlining it?

David Freitag

I get a decent meal once or twice a week

@MarkHulkalo I sleep like the dead

Mark Hulkalo

What the heck

David Freitag

No less than 12 hours at a go

Mark Hulkalo

3:25 AM

Do you have like Corprus or something?

David Freitag

I get to work at 10:30 and I don't get hungry 'till noon and it's lunch anyway, then I go to like 22-23:00 until I get food after work

Which is usually a small plate of rice a bit of chicken and a massive pile of broccoli

And a cup of tea

Well actually, usually I get to work at like 13:00 cause I can't get out of bed but shhh....

Mark Hulkalo

3:46 AM

Are you like bone thin?

David Freitag

3:58 AM

@MarkHulkalo Uhhh no, last I checked I weighed 320lbs

But that was... almost a year ago

Mark Hulkalo

4:23 AM

ANd now?

David Freitag

I have no idea

But my clothes are starting to not fit so well

Mark Hulkalo

Ha

Well, see you next week... after tomorrow or so

Rоry McCune

8:38 AM

Mornin' all

M'vy

Morning boys & girls, animals and variations thereupon

kalina

who are you calling variations

@DavidFreitag I wish I could sleep, the darkness messes with my body clock, I keep thinking it's night

ding time to awaken... oh no, it's the morning?!

Arperum

Morning all.

AviD

@M'vy that's very cisgenderist.

or was the "variations thereupon" referring also to the "boys&girls"?

also, you ignored plant-based lifeforms, and minerals. Like @Simon.

M'vy

8:54 AM

@AviD it's refering to whatever you want in fact. Boys, girls, animals, things maybe

AviD

"things" is not a variation of the previous items.

M'vy

Oh com'on you are ruining my effort of trying to be thorough

Gilles

@AviD And there you go again excluding people. I'm neither an animal, nor a plant, nor a mineral.

kalina

have you ever had that thought where you've concluded that the simple thing you were trying to achieve is actually just too much effort?

@Gilles nobody has come up with a name for what you are

AviD

@Gilles he already included those.

well, most of those. The cis-gendered ones anyway.

kalina

8:56 AM

(well, they have, it's just not suitable for this environment)

AviD

@M'vy thats the worst, unthorough attempts at thoroughness.

@kalina "mushroom"

thats actually a kind of fungus, no? so not quite plant either.

M'vy

ah man.

@kalina of course it is. That's the beauty of it :)

AviD

@M'vy look, if you're gonna be thorough, you have to go all the way. Really commit to it.

kalina

you should never go full thorough

Rоry McCune

nice to see we're starting the day as on-topic as usual :op

AviD

8:58 AM

Otherwise, just accept the lack of precision, and explicitly call that out.

Gilles

@AviD not quite. I'm part of a mushroom's reproductory apparatus.

kalina

everybody thought it

AviD

and somebody had to say it

tbf I regretted it long before I hit enter

did it anyway, #yolo #simon

Gilles

:25652007 No, I'm gills

kalina

I thought we were over yolo

that's a little disappointing

AviD

9:00 AM

@kalina that's me, I'm all about disappointing you ahead of time.

kalina

I knew that

I need coffee if I'm not going to return to sleep

AviD

see, my coffee would not disappoint.

Journeyman Geek

Got my transparent lock

Managed to pick it twice so far. Few more times and I might try the old padlock I was mucking with the last time.

Rоry McCune

@AviD are you trying to lure @kalina round for coffee, tut tut tut, you're a married man!

kalina

that and I have standards

AviD

9:06 AM

@RоryMcCune pfft, coffee is not an aphrodisiac.

and, she has standards.

and, I know there is less than zero chance she would take me up on it. So I'm safe.

Rоry McCune

@AviD pls "come in for a coffee" is a well known euphamism even outside the DMZ

AviD

and, if you'll notice I did not actually invite her.

I'm kidding, @kalina, of course you are invited.

for coffee.

kalina

@AviD what was that? near tel aviv?

AviD

if you ever happen to be in the neighborhood.

kalina

I'll need like 8 hours

AviD

9:08 AM

@RоryMcCune dammit, is it? like netflix and chill?

coffee and sweetener?

Rоry McCune

@AviD yeah it's like the #Fogey netflix and chill

AviD

@kalina near-ish.

kalina

if I'm ever asked if I want to divert away from going home to "come in for a coffee" I assume it's a precursor to wanting sex

AviD

@RоryMcCune I wouldnt know, I stopped using those lines when they became cool.

Rоry McCune

@AviD that would be hillarious "Hello Mrs Avid is @AviD home, he invited me round for coffee"

2

kalina

9:09 AM

or any other reason for that matter

AviD

@kalina ah wait, thats different. meeting for coffee is innocent, "come up for coffee" after a date is an obvious excuse.

@RоryMcCune this happens.

kalina

@RоryMcCune "hello I have been requested to this place for a secret meeting to do things with the stuff"

Rоry McCune

@kalina if you do that, please record it on video, I would find it extremely amusing

AviD

actually more often the Mrs. Me has somebody over for coffee, "wait is @Avi home? I'd rather HE make the coffee..."

@kalina I have had that too.

kalina

shifty face

AviD

9:10 AM

it's all good, what happens in my lair stays in lair.

3

kalina

you're right

basically zero chance

AviD

its not like my regular work is much less suspicious.

@kalina pffft

FTR I was talking about coffee.

I have a fresh batch of Nicaraguan.

kalina

nobody believes you, might as well give up

AviD

quite yummy.

ooh! all y'all coffee addicts - just had an interesting tip, it is... interesting: put a pinch of salt in with the coffee grinds when you brew. It is... interesting. /cc @Xander @ScottPack @Kisunminttu

Rory Alsop

morning all

@AviD and ewwwww

Rоry McCune

9:16 AM

@RoryAlsop Watcha'

AviD

@RoryAlsop that was my thought. but not so much.

the salt barely leaves a taste, it gets brewed/filtered away. But it makes the coffee a bit, umm... livelier?

Rоry McCune

@RoryAlsop see NCC have bought another company, Fox-IT in the netherlands for £95m

AviD

-1

Q: Rate The Viability Of My Phish-Proof System

I have recently finished building my first (and so far only) phish-proof login system and I would like the experts to test it. The system is hosted at http://www.daera.net/noph/nophlogin.htm How much difficult (or easy) is it to make a phish copy of my login system as compared to Facebook or Goo...

phishing

free flags / VtC's

Rory Alsop

@RоryMcCune wow - have heard of Fox-IT in a few places

@AviD I rate it - terrible :-)

Rоry McCune

@RoryAlsop yeah they do good forensics / cybercrime write-ups

AviD

9:21 AM

@RoryAlsop meh, I was hoping somebody would write out a custom close reason and save me the trouble :-)

Rory Alsop

@AviD I would, but was waiting for community close votes/flags before diving in headfirst

On the coffee front - I have decided that for Christmas I will mostly be drinking mocha lattes... to slightly reduce my calorie intake

AviD

@RoryAlsop same :-)

M'vy

custom reason ? OP is a moron and can't read simple rules ?

2

AviD

though without even looking, just from the comments it looks clueless.

as we always say, a security newb should never try to invent a new security system.

M'vy

because security not newb should ?

AviD

9:25 AM

@M'vy well, no, but they dont need to be told :-)

Rory Alsop

@M'vy Yoda, M'vy is

AviD

and yes, sometimes it is okay for a subject matter expert to iterate and try to find a new solution to an unsolved problem.

M'vy

@RoryAlsop uhm uhm uhm

AviD

I am hoping @dr01's answer to that question will get a reversal badge.

@RoryAlsop heh, it took me a couple re-readings.

M'vy

@AviD good answer

AviD

9:38 AM

any of y'all interested in an expenses-paid for trip to Gothenburg? Owasp chapter there is looking for another workshop... owasp.org/index.php/OWASP_Gothenburg_Day_2015 /cc @RоryMcCune?

Rоry McCune

@AviD heh, too short notice for me, I'm afraid, think my schedule is full till Christmas now...

AviD

@RоryMcCune does the name Ben Rothke mean anything to you?

sounds very familiar to me, but I cant place the connection. Face too.

Rоry McCune

@AviD name rings a bell but could just be I've read an article by him...

AviD

9:53 AM

k, tq

kalina

10:11 AM

personal best is now 14 days

apparently this is a rep train falling off a cliff into a bottomless pit

rep graph looks interesting though

AviD

@kalina or worst, depending on how you look at it.

kalina

"Guess when I started using Arqade again"

AviD

yes, I always have something to say.

@kalina FO4?

kalina

entirely

AviD

but yeh, thats impressive.

kalina

10:13 AM

I like the year of nothing just before the several weeks

although you can clearly see when hatdash occurs on a year to year basis from looking at my rep graph

AviD

ohh nooes, are we gonna hafta have dem stoopid hats here again?

time to quit the site for a month.

Rory Alsop

@AviD heh heh heh heh

actually, they normally come around asking if we want it by now, don't they?

Rоry McCune

@AviD cool all the more hats for the rest of us

@RoryAlsop which apart from Mr Grinchy Tigger we do

kalina

I'm still debating if I'm bothering with hatdash this year

Rory Alsop

@RоryMcCune lol @ grinchy tigger

AviD

10:16 AM

@RoryAlsop wouldnt that be grinchger?

kalina

most of me says no but a tiny little bit wants to turn up for 6 weeks of the year and be the #1 user on arqade for the year

AviD

or tiggrinch?

Rory Alsop

@AviD Tigchy

Rоry McCune

@kalina that would be amusing

Rory Alsop

@kalina hahahaha - do eeeet

kalina

10:16 AM

@RоryMcCune I'm already third

700 rep left until I'm #1

AviD

why the hell is there a library and books in FO4??

kalina

@AviD things to collect

Rory Alsop

@AviD gamers love completion - hint of OCD, mebbe

kalina

all about the collectibles

if you can double your play time by collecting books then so be it

what's the prize at the end? oh, medkits are more effective

gotta do them then, it's basically required content

wait, you mean you can collect magazines as well?

now I've got two things to collect

AND you can spend hours organizing all of the magazines you've collected in a stand?!

fantastic

o wait I spent real money on purchasing an action rpg and then spent a week of my time collecting books in it

do you even story?

Rоry McCune

10:33 AM

@kalina bro?

kalina

nope

AviD

saw a tweet the other day, something like "my father is such a geek, he is playing GTA all day. He's not very good though, he just wanders around looking for where he left his car."

M'vy

10:49 AM

@AviD police deception ?

Can't be that guy, he stopped at the red light!

Rоry McCune

Magic Leap Demo

►

^So d'ya reckon these magic leap guys will be able to pull this off

they're now talking about raising $1Billion before even launching a product

if they can get unobtrusive full field of vision AR I could see that being worth some cash...

Rory Alsop

I have seen an earlier demo - it is awesome in the flesh

Rоry McCune

well sounds like 2016 could be a very packed year for VR/AR stuff

Rory Alsop

the cool thing about ML is the way objects don't just go behind stuff, they can be in front of things, and be opaque!

Rоry McCune

@RoryAlsop yeah that's going to take some processing, to project enough light to obscure objects "behind" the virtual object.... would make AR gaming fun for sure :)

AviD

11:01 AM

@RoryAlsop can it make real world things become transparent?

seems like that would be more profitable ;-)

hey @RоryMcCune quick hipster q' for you, what databases are common in node.js apps? besides mysql and express...

Rory Alsop

@AviD pffft

AviD

(and I mean "databases", not nosql datapiles...)

Rоry McCune

@AviD well I was going to say, a lot just use noSQL. Other SQL databases you'd expect to find would definitely include PostgreSQL and maybe for small stuff sqlite

AviD

ah right, pgsql.

though isnt sqlite usually on like client side, or devices?

Rоry McCune

@AviD well there's nothing to stop you using it server-side, just it doesn't necessarily scale that well

I'd only expect it for small stuff though

AviD

11:08 AM

@RоryMcCune please, scale? we're talking about node.js.

you use shards and it scales right up.

that's its magic sauce.

Rоry McCune