The DMZ

@AdamShostack Yeah, /dev/urandom is on the low side of the "true randomness" scale. It's probably good enough since it tries to keep its output restricted to how much true entropy it has, but that mechanism can fail. My favorite method is quantum randomness. — PyRulez 8 mins ago

Sigh When will people stop being idiots about randomness? That will be the day I will be happy.

kalina

when will people stop being random about randomness! Oh the random!

Xander

@kalina Ha ha, that's a funner way to put it.

kalina

I wish there was a more efficient method of consuming YouTube

Xander

@kalina Like a YouTube breakfast cereal?

David Freitag

@Xander Perhaps a fruity YouTube smoothie

Ohnana

1:49 AM

@Xander wtf am i reading

kalina

@Ohnana A comment from the Stack Exchange website

Xander

@Ohnana Nonsense.

Mark Buffalo

@Xander Is /dev/urandom truly random?

kalina

Posted against a question titled "What is a good way to generate a one time pad, and is this a good way?"

Xander

@MarkBuffalo No. Not even close.

Mark Buffalo

1:50 AM

@kalina You're a one-time pad

Ohnana

people discussing crypto on the internet is like listening to a kindergarten teacher and a thousand coked up toddlers

Mark Buffalo

<3

@Xander didn't think so

@Ohnana Not when @ThomasPornin is here

Xander

@Ohnana Yes.

kalina

@MarkBuffalo you're a little bit Simon

Xander

@MarkBuffalo This is why crypto.SE is nice. It knows what it's talking about, practically all of the time.

Mark Buffalo

1:51 AM

@Xander Agreed

@kalina :{

kalina

I don't know anything about the current subject being discussed

Xander

@Ohnana What's hilaribad, is that this holds true even for pseudo-professional-crypto forums, like CFRG and the the TLS working group.

Thomas Pornin

@MarkBuffalo The good question is: what do you call "truly random" ?

Mark Buffalo

@ThomasPornin @Simon

AviD

@ThomasPornin @simon.

dammit! ninjad!

Thomas Pornin

1:56 AM

@AviD Proof enough that @Simon is not random.

AviD

@ThomasPornin lol

Thomas Pornin

He is the inevitable butt of the joke.

Mark Buffalo

@ThomasPornin But in all seriousness, not something generated on a computer, unless it has video-access to a wall, and moves around in various light-detection settings or something

AviD

predictably random.

@ThomasPornin why is CRNG not good enough?

Thomas Pornin

@MarkBuffalo If you declare that what is "truly" random is what is unpredictable, then /dev/urandom is as truly random as you can wish.

@AviD CRNG makes me CRiNGe.

AviD

1:58 AM

groan

Thomas Pornin

What do you mean by that acronym ?

kalina

oh gosh

AviD

@ThomasPornin what do you mean by it?

kalina

@ThomasPornin showed up to talk about random

2

AviD

I mean e.g. /dev/urandom

kalina

1:59 AM

now we're all in trouble

AviD

derp

okay bedtime

Thomas Pornin

@AviD Ok, you mean CSPRNG.

"CS" means "cryptographically secure".

AviD

@ThomasPornin yes exactly that.

Mark Buffalo

@ThomasPornin You're cryptographically secure

kalina

Counter Strike: Pseudorandom Next Globaloffensive?

Thomas Pornin

2:00 AM

It so happens that being cryptographically secure is sufficient to be, indeed, cryptographically secure.

So yes, that's fine for cryptographic purposes.

kalina

may I ask what you mean by "cryptographic purposes"?

AviD

@ThomasPornin so @Xander's argument re /dev/urandom for OTP, while correct, is irrelevant?

Thomas Pornin

And it equates with unpredictability (by adversaries).

Mark Buffalo

@ThomasPornin Is it practical to predict /dev/urandom's results?

AviD

no

Thomas Pornin

2:01 AM

@AviD I have not read the past discussion but now that you say "OTP" I understand what you have been ranting about.

kalina

@MarkBuffalo yes but you have to be really random

AviD

@ThomasPornin not I, I came in when you did.

kalina

@AviD came when @ThomasPornin arrived

Xander

It has nothing to do with practicality, it has everything to do with mathematics.

AviD

@ThomasPornin basically: "for OTP you must use true random, like urandom". @Xander: "urandom is not true random!"

@kalina lol

kalina

2:03 AM

I'm random, are urandom?

Mark Buffalo

Looks like we have a fight here boys

Thomas Pornin

If you use /dev/urandom to produce a long stream of bytes that you XOR with the data to encrypt, you made a strong encryption system (but cumbersome to use). It is not an OTP (depending on the flavour you put in the term) but hey, that's not necessarily bad.

Mark Buffalo

looks like nerd's back on the menu, boys

kalina

what does OTP mean

AviD

@ThomasPornin (one time pad)

Mark Buffalo

2:03 AM

One Time Pad

Xander

Emphasis on the "It is not a OTP"

kalina

what's one time pad

AviD

@Xander you guys werent arguing it wasnt a one time pad, you were arguing its not a true random - and that you need a true random.

Xander

@kalina A pad that you only use once. And it has to be true random. Or else.

Mark Buffalo

@kalina ...you're a one-time... pad

Sorry :(

kalina

2:04 AM

is that like a tablet that you write lol on before dropping it out of a fifth floor window on top of your unsuspecting victim?

AviD

@ThomasPornin is saying that CSPRNG is good enough.

Thomas Pornin

@Xander There are two meanings for OTP. One is for a system where you XOR (or add or whatever similar combination) the data with some bytes (the "pad") that you use only once for such usage (hence "one-time").

Under that definition, the system with /dev/urandom is an OTP.

kalina

On Top Position?

Thomas Pornin

However,

kalina

the entire room sits in suspense

Xander

2:05 AM

@ThomasPornin That is not a OTP as Shannon described.

AviD

ahh, @Thomas's "however". The opening for both enlightenment, and insanity.

Thomas Pornin

the term "OTP" has also been used to described an encryption system with information-theoretic security, and in that role /dev/urandom cannot be a real "OTP".

AviD

@Xander but it is the common use.

Xander

@ThomasPornin Yes. This.

Thomas Pornin

Now, since there are two meanings for the same term, Internet dudes can battle on it forever.

2

kalina

2:07 AM

what about internet dudettes

AviD

heh. hehe. hehehehe.

Xander

A CSPRNG is good enough for a sematically secure stream cipher. Not for a OTP with information-theoretic security.

@ThomasPornin Well, that is fun.

Thomas Pornin

@kalina If the Internet dudettes go duding for hours about OTP, then they should give back their second X chromosome.

6

kalina

I still don't know what OTP is

AviD

@Xander except now that @ThomasPornin has clarified, I think it is clear that the OP there actually meant the first, semi-practical form of OTP.

Mark Buffalo

2:09 AM

@kalina en.wikipedia.org/wiki/One-time_pad

Xander

@kalina It's a way to make it so that people can't read your texts.

kalina

aren't there many other methods of achieving that already

Xander

@AviD I don't care what the OP meant. I haven't actually read the question. Only the subject, and the answer I didn't like.

AviD

@Xander the answer mixed between both types of OTP.

thats why it was bad.

choose one, and stick with it, or answer for both independently.

Xander

@AviD Yes. It should be clear what is being answered, and what the implications are.

If it had been, it may have caused me to at least be curious enough to read the question.

kalina

2:11 AM

@MarkBuffalo this article is sending me to sleep

Thomas Pornin

@Xander Since the OP is actually contemplating using an OTP, it is clear that he did not think through the implications.

Mark Buffalo

@kalina Just what you needed? :]

Xander

@ThomasPornin Nobody who is contemplating using an OTP ever has.

kalina

well I should go to sleep but I'm not ready to

AviD

@ThomasPornin I was actually thinking exactly that - but I'm too sleepy to bother with a comment

Thomas Pornin

2:13 AM

The real value in OTP is that it can provide very decent security for encryption without computers, and, maybe more importantly, there are edible OTP.

Journeyman Geek

o0

AviD

@ThomasPornin oooo

the implications are staggering.

gnite

Xander

@ThomasPornin Yes. OTP with hand-written messages is a very reasonable scheme, in the scheme of things.

kalina

@AviD you're not allowed to leave

don't randomly start a random conversation about randomness and then randomly up and leave randomly

Xander

@kalina He didn't randomly start it, I did. Quit trying to redirect credit from me.

kalina

2:17 AM

sorry for some random reason I randomly confused you and the other random one

must be because you're both blue

Xander

Well, this has been a livelier night than usual.

kalina

I blame the random

Thomas Pornin

@AviD Ah, I found where I had read that.

derkeiler.com/Newsgroups/sci.crypt/2006-12/msg00341.html

Some guy had sold a few on Ebay, in 2006, and made some announce on sci.crypt.

Xander

@ThomasPornin Ha ha, awesome! Unfortunately for me, EBay says the listing has been removed or is no longer available. :-(

Thomas Pornin

@Xander I suppose they would have gone stale anyway, after a decade...

Mark Buffalo

2:24 AM

@ThomasPornin That level of tinfoil hattery hasn't been seen since times long forgotten

Xander

@ThomasPornin Yeah, perhaps. Paper-based products seem to be ok for a long while though. The oldest book I own was printed in 1789. It still looks fairly edible.

Thomas Pornin

@Xander Paper is not edible.

kalina

yes it is

I eat paper all the time

Mark Buffalo

Paper is high in fiber.

Xander

@ThomasPornin It is, in the sense that it passes through the digestive tract without either a) making one significantly ill or b) still being readable after having passed.

Thomas Pornin

2:26 AM

Mmh, I would have to dig the details, but I think there was a spy back in Napoleonic times, who was captured by Russians and, to avoid talking, committed suicide by eating paper.

Xander

@ThomasPornin Well, everything in moderation. You can commit suicide with water too, if you like.

Thomas Pornin

If you eat enough (and that's not a great deal of paper), it clogs your digestive tract and you die (with immense suffering).

Xander

In several ways, come to think of it.

Mark Buffalo

@ThomasPornin ...something tells me you've seen this happen before, maybe even fed someone paper

Xander

So, the moral of the story is, don't eat a OTP that is more than a few pages long, then?

kalina

2:28 AM

I find eating OTP leads to weight gain

Thomas Pornin

For death by potomania (i.e. drinking too much water), you have to drink something like 20 litres of the stuff in a relatively short time (you break open the stomach -- that, too, is said to be very painful).

kalina

mmm death by water

Xander

@ThomasPornin No, you merely reduce the levels of potassium and sodium in the brain to fatally low levels, IIRC.

Thomas Pornin

@kalina Yeah, nasty stuff.

@Xander It's a race condition (a race between causes of death).

The timing matters.

kalina

water intoxication

Xander

2:30 AM

@ThomasPornin True. Yes, found it. Water intoxication. "Water intoxication, also known as water poisoning is a potentially fatal disturbance in brain functions that results when the normal balance of electrolytes in the body is pushed outside safe limits by overhydration."

@kalina Beat me.

kalina

what do I say to that?

I could say "no"

or "I usually charge"

or "eww"

Xander

@kalina Or...None of the above?

kalina

probably

I still have 4000000000000000000000000000 videos to watch on youtube

Xander

@kalina You need a better hobby.

kalina

it's not a hobby

Thomas Pornin

2:35 AM

As an unrelated note, you can be theoretically killed by eating 35 millions of bananas.

kalina

it requires 35 million?

dammit I'm never going to be radioactive

Xander

@kalina That many YouTube videos? I dunno. Sounds like a hobby to me.

@ThomasPornin That is a fun fact.

Simon

@ThomasPornin WOT

Thomas Pornin

@kalina Yup. Only 358mg of potassium per 100g of bananas, and 0.0117% of that potassium is K-40, which is a very feeble beta+ emitter.

Xander

@kalina I saw a TV show where a guy got a tour of Chernobyl. You could try that.

kalina

2:38 AM

@ThomasPornin sigh

@Xander no I don't want to do that

Thomas Pornin

@Xander A complicating factor is that your body actually excretes excess potassium, so you have to eat the 35 millions in a short time.

Xander

@kalina Ok, just trying to help.

kalina

I'm 99% sure that if I were to make a 35 million banana smoothie that my stomach would not have the capacity to consume it

Xander

@ThomasPornin That would be a challenge. You might need to be one of those professional competitive eaters.

Simon

You guys are weird.

kalina

2:39 AM

says @Simon

Thomas Pornin

@Simon Spoken by a connoisseur !

Simon

Exactly.

Xander

@ThomasPornin Like Molly Schuyler.

I'll bet she could eat 35 million bananas in no time flat. I'd just have to learn her secret.

Simon

Women and their bananas ( ͡° ͜ʖ ͡°)

kalina

their*

scrub

Xander

2:43 AM

Sigh

Simon

? That's what I typed?

giggles

kalina

edit history, liar

Simon

soz I can't undertand I've got a banana in my ear.

ok you can go back at being weird, bye

kalina

leave then

Thomas Pornin

@Simon back TO being weird

kalina

2:45 AM

you're stalling the progression of the conversation

Thomas Pornin

"Going back at being weird" means being mean to weirdness.

But we embrace weirdness.

kalina

well, you guys do

I just sit and watch as the only normal person in here

Simon

Yeah obviously I can't speak English tonight.

Thomas Pornin

@kalina It takes some skill to be normative all by yourself against all others.

kalina

indeed

strength of my resolve

Simon

2:47 AM

Should I be the one who calls your bullshit or?

kalina

if there was any bullshit to call, you're not in a position to call it

Simon

I really don't want to threaten to wrestle at this time of the day.

kalina

you know my feeling on your wrestling

I would be forced to set fire to you

Xander

@ThomasPornin How's the new gig?

Simon

Who on earth is on a staring spree again?

kalina

2:52 AM

obviously not I since I got starred

Mark Buffalo

@Simon Nobody can call her bullshit, as she's greater than us

Simon

wtf.

kalina

it was clearly @MarkBuffalo who is starring

Simon

I know.

Mark Buffalo

Nope, that ain't me

watch. I'll flip it

Simon

2:54 AM

I was hoping that he would step forward and admit that he's a damn donut.

Ah shit, he's not lying.

Mark Buffalo

:]

Xander

Look at the star wall...That turn of phrase simply can't be left to die in the transcript alone.

Mark Buffalo

@Simon Whether I star or not, I'm a damn donut. I've been a damn donut since the moment I came into this world drenched in donut sprinkles.

Simon

ok bye

Mark Buffalo

;{

don't leave me simon

kalina

2:56 AM

gosh get a room

Simon

am back

kalina

nooooo

Simon

pls I'm heading to bed soon newayz

kalina

well I'm already in bed

Mark Buffalo

simon

how often do you use PHP?

Simon

3:00 AM

Brag about it.

kalina

ok fine

I'm super comfy

and warm

Mark Buffalo

I've been using it here and there... lately

kalina

and did I mention comfy?

Mark Buffalo

@kalina @Simon may be able to improve this

Simon

pls Markus it depends

@kalina Noice, the heating part will suck.

Cold beds are the worst.

kalina

3:02 AM

well I solve the emptiness by cocooning myself in duvet

Mark Buffalo

@Simon When do you use it?

I'm only using it right now because 1) I hate it and it's a challenge, and 2) my web host only supports php :<

Simon

When my boss says "pls make a new module"

Simon

3:17 AM

ok bye 4 real

kalina

me too

unrelated to above ^

Thomas Pornin

3:45 AM

@Xander Looks good so far.

Xander

@ThomasPornin Nice!

Thomas Pornin

Btw I have added an answer to that OTP question.

Mark Buffalo

hmm

There appear to be fingerprinting features in docx files

Not the usual ID stuff, but installed fonts

Xander

@ThomasPornin And...It is comprehensive, as usual. :-)

Mark Buffalo

4:07 AM

@ThomasPornin Nice post... just finished reading it. It's really easy to understand, and I'm not exactly a crypto expert

void_in

8:43 AM

Is @tylerl available here?

Rоry McCune

@void_in not usually at this time of day :)

IIRC he's on one of the US'ian time zones

void_in

Thanks a lot Rory. Just wanted a little clarification from him. In one of his answers he mentioned "And you, like a wise IT admin, run all your servers elsewhere on the internet, not inside your corp network, for a whole raft of reasons I won't go into here."

Just wanted to ask why he thinks it is a bad idea to host the services in the corp network?

The answer is at security.stackexchange.com/questions/113172/…

Rоry McCune

@void_in ah yeah that could have a number of meanings... I guess in badly run corp network, many people don't segregate appropriately which makes it rather easy for attackers, but then that's not peculiarly a factor of whether it's corp or cloud, but more one of the quality of the network

Matthew

@void_in I would certainly advise running web servers and related infrastructure outside of the corporate network. Essentially, it's down to minimizing exposure to the internet

Rоry McCune

@void_in ah yeah in the general context of that answer, I think it's what @Matthew says. You don't run externally facing servers on your general corporate network

AviD

8:52 AM

I see @void I think @Simon mangled the ovid even more

void_in

@RоryMcCune Exactly. I believe the same. If the segregation is not done properly, it wont be proper else where

Matthew

I tend to point out that an internet facing server is accessible to 6bn people, but your corporate data store is available to a couple of thousand people. Why build an architecture where you have these two servers in the same environment?

Rоry McCune

so could be clearer, 'cause "cloud" and "appropriately segregated internally managed network" are in my opinion analagous here

void_in

@Matthew Hmm, I get your point. Thanks. Yeah it is a little grey area. Like "two servers in a same environment" is obviously a bad idea. That's why it needs to be segregated wither within the corp network or else where on the Internet

8:56 AM

But IMO we should be preaching segregation and not external hosting.

Matthew

@void_in Exactly - it's about segregation of risk. The risk profile for a web server or email server is different to that of a file store

void_in

Thanks @Matthew and @RоryMcCune.

Matthew

@void_in There is an availability issue there though. Hosting providers (usually) have staff monitoring 24/7, multiple redundant connections, and really fast connections. A lot of smaller businesses don't - and by smaller, I'm talking up to a few thousand staff, from previous experience...

void_in

@Matthew Yes. That's true. Hosting providers are in a much better position to deal with DDoS as well. However, again every hosting provider is different. I remember we once faced a DDoS and the provider simply blocked all incoming DNS traffic effectively blocked our DNS server to be contacted from the outside :)

Matthew

9:13 AM

@void_in Sadly, this is true. They are a very mixed bag

Lucas Kauffman

10:34 AM

-8

Q: How can i find Android secret messaging apps on wife's phone and read messages

I keep finding a vault file on my wife's Android phone? It has encrypted pictures, and text in it. How can I either decrypt it or find out the hash its using, or code to open, and access the app? I'd like to know we that is worth hiding? Is there a professional software that can help out a great ...

file-encryption

Matthew

Oops... Tried to open an old tablet with a failing charge connector, to find out if it was repairable. Cracked the screen...

Rоry McCune

@LucasKauffman aaand closed

Derpy

11:12 AM

Hi - Sorry to bother you. I just wanted to leave this link here in case anyone is interested. There is an ongoing discussion on the main meta site, and I think the opinion of some security experts may be worth having.

3

Q: How to handle possible user tracking through images?

I have come across a site-meta question that ended up on the Hot Meta Posts side bar. At the time of writing, that post has about 1000 views. Accidentally I noticed that OP used his own server (his domain name is similar to his name) to store the images on of his post. A user changed those image...

discussion images security privacy tracking

If anyone wants to give that one a look, probably you can give some more reasonable ideas about what the possible risks are.

Thank - bye.

M'vy

11:55 AM

cross-site requests heh

Simon

12:32 PM

@AviD What a donut, he totally misspelled it.

kalina

12:59 PM

euuuuuuuuuggghhhhhhhhhhh

Transcript for